Section 38 BSIG Management Liability: D&O Insurance and Protection Plan

Main article: NIS2 implementation in Germany — the full article on the topic.

1. The elements of Section 38 BSIG

If managing directors breach the duty to implement and supervise the risk management measures under Section 30 BSIG, they are personally liable to their entity for the culpably caused damage (§ 38(2) BSIG). § 38(2) BSIG contains no monetary cap on liability — internal liability follows without limit the company law applicable to the legal form (e.g. § 43 GmbHG, § 93 AktG). An often-cited figure of 'EUR 2 million' is not a statutory limit but at most a contractually agreed D&O cover amount; in the BSIG the figure also appears as a fine tier (section 6). In addition, fines under § 65 BSIG (provisions on fines) may apply — these ranges attach to the entity (section 6).

The provision is divided into three subsections which together form the scope of management's duties:

In practice this means for a GmbH: the legal basis for internal liability is § 43 GmbHG; for other legal forms, the relevant company law liability provision (e.g. § 93 AktG). § 38(2) sentence 2 BSIG applies independently only where the relevant company law provides no liability rule. The duty whose breach is examined, however, follows in every case from § 38(1) BSIG.

Decisive in practice is the standard of fault: the Act specifically does not require a 'gross' breach of duty — liability arises for any culpably caused damage, that is, already for simple negligence. The EU law background is Art. 20(1) of Directive (EU) 2022/2555: management bodies must approve the risk management measures, oversee their implementation and can be held responsible for infringements.

2. The D&O insurance standard

The cover amount and premium of D&O insurance for managing directors and management boards depend on the size and sector of the entity, the chosen scope of cover and the group of insured persons; reliable figures come only from quotes for your own entity. When choosing the cover amount, bear in mind that § 38(2) BSIG contains no monetary cap on liability (section 1).

Insurance is not part of the catalogue of duties in Section 38 BSIG (section 1) — it replaces neither any of the duties set out there nor the documentation under § 30(1) BSIG.

Practice recommendation: anyone reviewing or renewing a policy should measure the scope of cover against the liability standard of § 38(2) BSIG (for the standard, see section 1) — customary policies draw the line at gross negligence (see section 3). The following five questions are derived from that liability standard:

1. Is internal liability covered? Does the policy cover claims by the company itself — and not only claims by third parties? That is precisely where § 38(2) BSIG applies (section 1).
2. From which degree of fault does the policy draw the line? For the statutory standard, see section 1. Where exactly does the policy draw the line?
3. Are defence costs covered on a provisional basis? Are lawyers' and court costs initially borne even if intent is later established — and what then applies to their recovery?
4. Who is insured? Does the policy apply to all members of management, including former members and the officers of subsidiaries?
5. Who bears the premium, and is the decision documented? Practice recommendation: the record and the underlying resolution belong in the same file as the resolutions under § 38(1) BSIG.

Suitable review points are the renewal date of the policy, every change in management and every change of status of the entity — for example when growth first makes it an important or particularly important entity under § 28 BSIG.

3. Scope of cover: what customary policies bear — and where the gap to § 38(2) BSIG lies

Customary D&O policies bear defence costs and damages to the company itself, and to a limited extent damages to third parties; not borne are intent, gross negligence, fines and the costs of criminal prosecution (market figure, as at the first version: 2 May 2026). The overview sets each item against the liability standard of § 38(2) BSIG:

From this follows the central gap: statutory liability reaches further than customary policies cover. The policy bears the lower range (standard: section 1). Liability itself extends beyond it up to gross negligence and intent; precisely this upper range remains the personal risk of management. All the more important is documented compliance build-up — it is the evidence that management has implemented and supervised in accordance with § 38(1) BSIG.

4. Mandatory protective measures for managing directors

Two of the five building blocks are required by law — the documentation under § 30(1) BSIG and personal attendance of training under § 38(3) BSIG; for operators of critical installations, the evidence under § 39(1) BSIG is added. Compliance officer, a fixed audit cycle and a compliance report to the supervisory board are practice recommendations.

What belongs in the documentation: § 30(1) BSIG requires compliance with the risk management measures to be documented; according to its wording, the provision does not name a catalogue of contents. As a practice recommendation — and not as a statutory requirement — the catalogue of § 30(2) BSIG gives the documentation its structure: one section per area of measures (the ten areas are listed below under 'Compliance report: content and cycle'), within it the measure taken, the role responsible for it, the date of the last update and the document evidencing compliance. Three of these records are the ones that experience shows are missing in audits — the supplier list with risk classification including contractual clauses (no. 4; typical audit finding: no cybersecurity clauses in the contracts), the dated test result per area (no. 6; finding: no documented KPIs) and attendance documents and evaluation of the phishing simulation (no. 7; finding: no phishing simulation carried out); they belong in exactly this file. The cycle and responsibility for the evidence under § 39(1) BSIG are set out in the evidence chain (section 8).

Audit cycle: it has proven effective to stagger the ten areas of measures under § 30(2) BSIG across the year so that each area comes up once a year: the compliance officer prepares the review, management signs off the result — it cannot hand over the supervision required by § 38(1) BSIG. The evidence for each area is the same dated test result that also supports the documentation under § 30(1) BSIG. Operators of critical installations align the cycle with the three-year evidence requirement of § 39(1) BSIG (section 8); entities outside § 39 BSIG set it themselves. Likewise a practice recommendation without a statutory deadline is quarterly reporting to management.

Compliance officer: sensibly defined, the role takes on three tasks: maintaining the documentation under § 30(1) BSIG, operating the reporting process under § 32 BSIG and preparing the report to management. The reporting line is management itself: the appointment does not relieve it (responsibility under § 38(1) BSIG cannot be delegated, see section 1) but gives it the basis for supervision.

Evidence of training under § 38(3) BSIG

§ 38(3) BSIG requires management to attend training regularly; according to its wording, the provision does not prescribe a fixed cycle or catalogue of contents. Art. 20(2) of Directive (EU) 2022/2555 likewise stops at the duty of members of management bodies to attend and the duty to offer employees comparable training on a regular basis. Anyone looking for the one correct frequency is therefore looking for something the Act leaves open; the gap is to be filled on a risk basis and documented.

As a practice recommendation — not as a statutory deadline — the following has proven effective: once a year as a matter of routine, plus on specific occasions at every change in management and after a significant security incident. The proof of participation should state date, duration, content, list of participants and signature and be filed with the records on the documentation duty — so that it sits in the same documentation strand as the records under § 30(1) BSIG (practice recommendation). Management training is to be kept separate from the training of all employees under § 30(2) no. 7 BSIG: the former is a personal duty of management.

Austria: from 1 October 2026, § 31(2) NISG 2026 is worded more narrowly than the BSIG — it requires specifically designed cybersecurity training for management bodies; employees are to be offered comparable training on a regular basis. Anyone combining both levels in a general awareness unit should therefore keep the wording 'specifically designed' in mind and evidence the management training separately.

Compliance report: content and cycle

Four points belong in the compliance report: the status of the documentation under § 30(1) BSIG, open points from the ten areas of measures under § 30(2) BSIG, the proofs of participation in training under § 38(3) BSIG and reports made under § 32 BSIG. A suitable cycle is the sequence of meetings the supervisory body holds in any event, but at least once a year and after every significant security incident. Report and cycle are practice recommendations; what is anchored in law is the supervisory duty under § 38(1) BSIG and the documentation duty under § 30(1) BSIG.

The ten areas of measures under § 30(2) BSIG give the report its structure: 1. policies on risk analysis and information system security, 2. incident handling, 3. business continuity (backup, recovery, crisis management), 4. supply chain security, 5. security in acquisition, development and maintenance, 6. effectiveness assessment, 7. cyber hygiene and training, 8. cryptography and encryption, 9. personnel security and access control, 10. multi-factor authentication, continuous authentication and secure communication. A maturity assessment per area is provided by the NIS2 mandatory measures audit.

5. Special case: the supervisory board

Specifically, the supervisory board has three things to do for NIS2 — all of them practice recommendations, since Section 38 BSIG addresses management: receive management's compliance report (for content and cycle, see section 4), follow up on open points from the ten areas of measures under § 30(2) BSIG and record its deliberations in the minutes. The minutes are the evidence that supervision took place — for management as well as for the supervisory body.

On liability: the supervisory board is personally liable for a breach of its supervisory duties — but the provision supporting this is not Section 38 BSIG, since according to its wording that provision obliges the management of particularly important and important entities. Which provision supports the liability of the supervisory body in an individual case belongs in the hands of legal advisers.

On insurance: cover for the supervisory board is to be treated as separate cover. Whether and to what extent a policy taken out for management also covers supervisory bodies follows primarily from the group of insured persons named in its terms — that is question 4 of the checklist in section 2, and it is to be asked separately for the supervisory board.

6. Fine ranges under § 65 BSIG

For serious breaches of duty — among others against the risk management obligations (Section 30 BSIG) and the reporting obligations (§ 32 BSIG) — the fine range under § 65(5) sentence 1 no. 1 BSIG extends to EUR 10 million for particularly important entities and to EUR 7 million for important entities; above a total turnover of EUR 500 million, the percentage variant applies instead — and only for the infringements designated in § 65(6) and (7) BSIG. The ranges of § 65(5) to (7) BSIG are directed against the entity; personal liability of management is governed by § 38(2) BSIG (internal liability). Each row of the overview names the source and — where the Act names it — the infringement to which the respective range attaches:

Unlike the Directive, the BSIG knows no blanket 'whichever is higher': the turnover variant applies only above a total turnover of more than EUR 500 million and only for the infringements designated in § 65(6) and (7) BSIG. Total turnover here is the sum of all worldwide turnover of the undertaking to which the entity belongs in the financial year preceding the authority's decision (§ 65(8) BSIG).

A directly relieving rule stands at the end of the provision: if a data protection supervisory authority has already imposed a fine under the GDPR for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG).

7. Austria: § 31 NISG 2026 instead of Section 38 BSIG

In Austria, from 1 October 2026, § 31 NISG 2026 (BGBl. I Nr. 94/2025) takes over the role of Section 38 BSIG: the management bodies of essential and important entities must ensure and supervise compliance with the risk management measures under § 32 NISG 2026 (subs. 1) and must attend specifically designed cybersecurity training (subs. 2). The NISG 2026 contains no express internal liability provision along the lines of § 38(2) BSIG — liability there follows from general company law, for managing directors of an Austrian GmbH from § 25 GmbHG (AT) with the same standard of care of a prudent businessperson.

In return, the NISG 2026 provides for a person-related supervisory measure: the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) may temporarily prohibit the management bodies of an essential entity from exercising management functions by decision; the prohibition is entered in the commercial register (§ 39(4) no. 2 NISG 2026). A penalty on the responsible person under § 9 VStG is waived only if the legal person is already penalised for the same infringement (§ 44(5) NISG 2026). For administrative offences under § 45(1) NISG 2026, the penalty ranges extend to EUR 10 million or 2 % of total worldwide annual turnover for essential entities and to EUR 7 million or 1.4 % for important entities — whichever amount is higher (§ 45(2) and (3) NISG 2026).

8. Protection plan: the evidence chain

Anyone starting from scratch builds the evidence chain in six steps: 1. determine whether the entity is in scope and its category under § 28 BSIG, 2. catch up on registration under § 33 BSIG, 3. pass a management resolution, 4. set up the documentation under § 30(1) BSIG, 5. carry out training and evidence it, 6. establish the reporting process under § 32 BSIG. Practice recommendation on the minimum content of the resolution in step 3: date of the resolution, designation of the measures resolved for each area of § 30(2) BSIG (or reference to the documentation under § 30(1) BSIG in its respective version), the members of management passing the resolution by name, the determination of how and at what intervals implementation is supervised, and the next review date. The following overview lists the records in this order of steps and names, for each record, the provision to which it attaches; the columns 'Responsible' and 'Cycle / trigger' are practice recommendations unless they expressly state 'statutory'. The seventh row falls outside the sequence of steps: it concerns the three-yearly evidence requirement under § 39(1) BSIG and is addressed solely to operators of critical installations.

The starting point already lies in the past: the NIS2UmsuCG entered into force on 6 December 2025; under § 33(1) BSIG, registration must be carried out no later than three months after the entity acquires that status, and the BSI points out that the statutory registration deadline has already expired. A missing registration can be caught up on — through the same registration facility set up jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), in practice via the 'Mein Unternehmenskonto' portal (§ 33(1) BSIG). Late registration is also subject to a fine: it is an administrative offence to fail to submit the information under § 33(1) BSIG or to fail to submit it in time (§ 65(2) no. 6 BSIG) — so catch up without further delay. If an entity does not fulfil its registration obligation, the BSI can carry out the registration itself (§ 33(3) BSIG). Practice recommendation: document the catching-up itself — date, reason and registration confirmation belong in the same file as the training and resolution documents. For Austrian entities, from the date the NISG 2026 becomes applicable on 1 October 2026, the self-declaration of the implemented measures to the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) within twelve months of the registration obligation arising is added (§ 33(1) NISG 2026).