Section 38 BSIG
Management obligations and personal internal liability under the NIS2UmsuCG
TL;DR
Section 38 of the German BSI Act (BSIG) (in force since 6 December 2025) obliges the management of essential and important entities to approve the risk management measures under § 30, to monitor their implementation and to attend training. Where obligations are breached culpably, § 38(2) provides for personal internal liability towards the entity under the rules of the company law applicable to the legal form.
What is Section 38 BSIG?
§ 38 BSIG is the sharpest provision for NIS2 compliance: it places the management personally under obligation. The obligations:
- Subsection (1): implementation of the risk management measures under § 30 and monitoring of their implementation — not delegable to the IT or compliance department
- Subsection (2): personal internal liability towards the entity in the event of a culpable breach of duty — under the rules of the company law applicable to the legal form (subsidiary, where no liability rule exists there)
- Subsection (3): obligation to attend training — on identifying and assessing cybersecurity risks
Germany and Austria compared
The responsibility of the management bodies is based on Art. 20 of the NIS2 Directive (Directive (EU) 2022/2555) and is implemented in Germany and Austria in separate national acts.
Germany — § 38 BSIG
The management of particularly important entities and important entities must implement the risk management measures under § 30 BSIG and monitor their implementation (subsection (1)). If they breach these obligations, they are liable to their entity for culpably caused damage under the rules of the company law applicable to the legal form (subsection (2)). They must also attend training regularly (subsection (3)). Supervision: Federal Office for Information Security (BSI).
Austria — § 31 NISG 2026
In Austria, the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (BGBl. I Nr. 94/2025) implements the directive. The management bodies of essential and important entities must ensure and supervise compliance with the risk management measures under § 32 NISG 2026 (§ 31(1)). They must attend specifically designed cybersecurity training; comparable training must be offered to employees on a regular basis (§ 31(2)). Supervision: Cybersecurity Authority (Cybersicherheitsbehörde, Austria).
Practical example
The managing director of an insurance company (an important entity) declines to approve an MFA solution despite an explicit recommendation from the CISO — on cost grounds. Six months later, the company falls victim to a ransomware attack carried out via compromised admin accounts. Damage: EUR 2.5 million.
Possible consequences: a BSI fine of up to EUR 7 million / 1.4% of turnover; personal liability of the managing director under § 38(2) for the EUR 2.5 million in damage towards the entity; in the case of a stock corporation, additional internal liability of the management board under §93 AktG. D&O insurance does not necessarily provide cover where gross negligence can be demonstrated.