SME Compliance Liability of the Managing Director 2026: 6 Risks

Internal liability, administrative fine, criminal liability: which risk hits whom

Risks 1 to 5 sit on three different levels: damages owed to one's own entity or company (Risks 1 and 2), administrative fines whose addressee is first of all the company (Risks 3 and 5), and personal criminal liability of a natural person (Risk 4; in data protection law § 42 BDSG, which likewise appears there — the administrative-fine route via § 41(1) BDSG belongs to Risk 3). Risk 6 is not a level of liability but the question of what any of this can be insured against. The distinction determines who the claim is directed against, who is the addressee of the sanction — and who bears it economically.

The column 'Framework' states what the respective provision orders: for the fining provisions the statutory maximum amount, for the liability provisions the type of claim, for § 14 StGB (German Criminal Code) the attribution effect; row 6 reproduces the statements of the first version regarding the D&O policy. Amounts to be expected cannot be derived from this.

1. Section 38 BSIG (NIS2): personal internal liability without a cap

§ 38(2) BSIG governs the personal internal liability of the management body under the company-law rules of the respective legal form — without a statutory monetary cap.

A fixed 'EUR 2 million limit' for personal liability does not exist — the amount is a fining tier against the entity itself: it applies to contraventions of enforceable orders (§ 65(5) sentence 1 no. 3 in conjunction with (2) no. 1 (a) BSIG). For infringements of the risk-management measures under Section 30 BSIG, the fining framework is up to EUR 10 million (particularly important entities) or EUR 7 million (important entities) under § 65(5) sentence 1 no. 1 BSIG. Where total turnover exceeds EUR 500 million, the fine may instead amount to up to 2% (particularly important entities) or up to 1.4% (important entities) of worldwide total turnover (§ 65(6) and (7) BSIG).

Liability is triggered by a breach of the duties under § 38(1) BSIG: management bodies of particularly important entities and important entities must implement the risk-management measures under Section 30 BSIG and supervise their implementation. The law specifically does not require a 'gross' breach of duty — liability attaches to every culpably caused loss, in accordance with the company-law rules applicable to the legal form; under the BSIG itself only where the relevant company law contains no liability rule (§ 38(2) sentence 2 BSIG). The creditor of this claim is the entity itself. Added to this is the personal training obligation of the management body (§ 38(3) BSIG). Insurable only to a limited extent (D&O policy, Risk 6).

Whom Section 38 BSIG covers in the first place

The provision applies only to particularly important entities and important entities — so classification under § 28 BSIG comes before any question of liability. An entity qualifies as a particularly important entity if it is another entity of a type specified in Annex 1 and employs at least 250 employees or has an annual turnover of more than EUR 50 million together with an annual balance sheet total of more than EUR 43 million; important entities are entities of a type specified in Annex 1 or 2 with at least 50 employees or with an annual turnover and an annual balance sheet total each exceeding EUR 10 million (§ 28(1) and (2) BSIG). The link to the annexes is part of the threshold: without allocation to a type listed in an annex, employee and turnover figures do not support the classification. Covered as particularly important entities irrespective of size are operators of critical installations, qualified trust service providers, top-level domain name registries, DNS service providers and certain telecommunications providers.

What the management body must implement and supervise

The reference point is Section 30 BSIG: appropriate, proportionate and effective technical and organisational measures, compliance with which must be documented (§ 30(1) BSIG). The minimum catalogue of § 30(2) BSIG covers ten areas: risk analysis and security concepts, handling of security incidents, business continuity including backup management and crisis management, supply chain security, secure acquisition, development and maintenance including vulnerability management, assessment of the effectiveness of the measures, cyber hygiene and training, cryptography, personnel security and access control, and multi-factor authentication and secured communication. Of these, the management body is assigned the implementation of the measures and the supervision of their implementation (§ 38(1) BSIG). This has become practically relevant since 2026: the registration deadline of § 33(1) BSIG expired in Germany on 6 March 2026 (details in the records table).

2. § 43 GmbHG: duty of care

§ 43(1) GmbHG obliges managing directors to exercise 'the diligence of a prudent businessman'. If they breach their obligations, they are liable under § 43(2) GmbHG to the company, jointly and severally, for the loss incurred — § 43 GmbHG therefore establishes internal liability, not liability towards third parties. Liability towards business partners, employees or data subjects requires a separate legal basis (such as tort law or special provisions of tax and social security law).

§ 43(1) GmbHG sets a standard of care. The individual duties are laid down in the sector-specific statutes and there they fall on the company: record of processing activities (Art. 30 GDPR), processing contracts with the statutory minimum content and selection only of processors providing sufficient guarantees (Art. 28(1) and (3) GDPR), risk-management measures (Section 30 BSIG), an internal reporting channel as a rule from 50 employees (§ 12(1) and (2) HinSchG, German Whistleblower Protection Act), protective measures against disadvantage including preventive measures (§ 12(1) to (3) AGG, German General Equal Treatment Act) and AI literacy (Art. 4 AI Act). By contrast, § 38(1) and (3) BSIG expressly assigns the implementation and supervision duty as well as attendance at training to the management body itself (Risk 1).

If one of these arrangements is missing, the company is the addressee in the first place: failing to establish and operate an internal reporting channel is an administrative offence with a framework of up to EUR 20,000; obstructing a report, retaliation and breaches of confidentiality carry up to EUR 50,000, the remaining cases up to EUR 10,000 (§ 40(2) to (6) HinSchG). The step from this corporate sanction to personal liability runs via § 43(2) GmbHG — and requires a loss to the company and a breach of duty by the managing director.

3. Art. 83 GDPR + § 41 BDSG: fines can also be personal

A person in a management position can become personally involved in fining proceedings via § 41(1) BDSG: for infringements under Art. 83(4) to (6) GDPR, the provision declares the rules of the German Administrative Offences Act (OWiG) to apply mutatis mutandis (excluding §§ 17, 35 and 36 OWiG). The fine under Art. 83 GDPR itself, by contrast, is directed against the Controller or Data Processor — as a rule, therefore, against the company, not against the management. Personal criminal liability arises under § 42 BDSG; both offences appear under Risk 4. In addition to Art. 83 GDPR, § 43 BDSG — not to be confused with § 43 GmbHG (Risk 2) — makes certain infringements in handling requests for information and informing consumers under § 30 BDSG an administrative offence punishable by a fine of up to EUR 50,000; no administrative fines are imposed on authorities and other public bodies (§ 43(2) and (3) BDSG).

Which fining framework applies depends on the type of infringement. Infringements of the obligations under Art. 25 to 39 GDPR — including notification of a Personal Data Breach and the data protection impact assessment — carry up to EUR 10 million or 2% of total worldwide annual turnover (Art. 83(4) GDPR). Infringements of the processing principles and conditions for consent (Art. 5, 6, 7, 9) as well as of the rights of data subjects (Art. 12 to 22) carry up to EUR 20 million or 4% (Art. 83(5) GDPR) — in each case whichever amount is higher.

In day-to-day practice, five duties above all touch this framework. Three of them run against the clock: notification of a breach of the protection of personal data to the supervisory authority where it is likely to result in a risk to the rights and freedoms of natural persons, without undue delay and where feasible within 72 hours of becoming aware, otherwise accompanied by reasons for the delay (Art. 33(1) GDPR); communication to the data subject without undue delay where a high risk is likely (Art. 34(1) GDPR); and the response to data subject requests without undue delay, in any event within one month, extendable by two months with reasons given within the first month (Art. 12(3) GDPR). Two are organisational: the designation of a data protection officer in the cases of Art. 37(1) GDPR, supplemented in Germany by, as a rule, at least 20 persons engaged in automated processing as well as, irrespective of that number, processing subject to a data protection impact assessment, or commercial processing for the purpose of transfer or for purposes of market or opinion research (§ 38(1) BDSG) — and that impact assessment itself, to be carried out in advance where a high risk is likely, in particular in the case of new technologies, large-scale processing of special categories of data or systematic large-scale monitoring of publicly accessible areas (Art. 35(1) and (3) GDPR).

4. § 14 StGB: criminal liability

§ 14 StGB ('acting for another') attributes to the body authorised to represent a legal person the special personal characteristics that establish criminal liability — the provision shifts special offences onto the management body, but does not create a separate criminal offence. It therefore always presupposes an offence that attaches to a special status of the perpetrator.

§ 203 StGB (violation of private secrets) regularly does not apply to a Personal Data Breach: the provision covers only the holders of secrets listed there ((1): among others doctors, lawyers, tax advisers; (2): public officials) and requires intentional, unauthorised disclosure — there is no negligence variant (§ 15 StGB). Personal criminal liability in data protection law therefore runs in practice via § 42 BDSG, not via § 203 StGB. In practical terms this means: before any criminal assessment of a Personal Data Breach comes the perpetrator-status check — is there an offence that attaches to a special status of the perpetrator? For personal criminal liability in data protection law, § 42 BDSG is the relevant criminal provision: up to three years' imprisonment for commercially transferring or making accessible, without authorisation, personal data not publicly accessible relating to a large number of persons ((1)), up to two years for unauthorised processing for payment or with the intention of enrichment or of causing harm ((2)). If no such offence exists, § 14 StGB has nothing to operate on.

5. Art. 99 EU AI Act: up to EUR 35 million / 7%

The fines under Art. 99 AI Act are directed against the operators: up to EUR 35 million or — in the case of undertakings — up to 7% of total worldwide annual turnover for the preceding financial year for non-compliance with the prohibited practices under Art. 5, whichever is higher (Art. 99(3)); up to EUR 15 million or 3% for infringements of provider obligations (Art. 16), deployer obligations (Art. 26) or transparency obligations (Art. 50) under Art. 99(4); up to EUR 7.5 million or 1% for the supply of incorrect information to authorities (Art. 99(5)). For SMEs, including start-ups, the lower of the two amounts applies in each case (Art. 99(6)) — the EUR 35 million figure is therefore not the yardstick for small undertakings. The addressee is the undertaking as provider or deployer; personal recourse against the management does not follow from Art. 99, but only via national law (company law and the law on administrative offences). The penalty rules themselves are laid down by the Member States (Art. 99(1)); in doing so they must take into account the interests of SMEs and their economic viability.

The underlying obligations have been relevant in full breadth since 2 August 2026: the AI Act has applied generally since that date, Chapters I and II with the prohibited practices of Art. 5 already applied from 2 February 2025, the obligations for general-purpose AI models from 2 August 2025; the high-risk obligations of Chapter III Sections 1–3 apply, under Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, to Annex III systems from 2 December 2027 and to AI in products under Annex I (Art. 6(1) AI Act) from 2 August 2028 (Art. 113 AI Act). The highest framework is reached via Art. 5: prohibited are, among other things, manipulative techniques causing significant harm, social scoring, emotion recognition in the workplace and in education institutions as well as biometric categorisation to infer sensitive attributes. The transparency obligations of Art. 50 fall within the framework of Art. 99(4): systems intended to interact directly with natural persons must inform them that they are dealing with an AI system ((1)); synthetic audio, image, video or text content must be marked in a machine-readable format as artificially generated or manipulated ((2)); deployers of emotion recognition or biometric categorisation systems must inform the persons concerned ((3)); anyone generating or manipulating deep fakes must disclose this ((4)). For the implementation of the Regulation, each Member State designates at least one notifying authority and at least one market surveillance authority; one market surveillance authority acts as single point of contact (Art. 70(1) and (2) AI Act). In Germany, the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) KI-MIG, German AI Market Surveillance and Innovation Promotion Act), unless sectoral authorities — such as BaFin — are competent; as at the date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act; the AI service centre at RTR is an information and advisory body without supervisory powers.

6. D&O insurance as protection

According to the statements in the first version of this article (as at 2 May 2026), D&O insurance covers part of the risks dealt with here. On that statement, compliance breaches are said to be covered in most cases, intent and gross negligence are not; administrative fines are not the subject of cover. The sum insured and the premium depend on the size of the company, the sector and the scope of cover chosen and are to be clarified by obtaining quotes.

For the six risks, this means three things. First: the two internal-liability cases (Risks 1 and 2) are claims for damages by one's own entity or company; to that extent the first version lists compliance breaches as 'covered in most cases'. Second: the fines under Art. 83 GDPR, § 65 BSIG and Art. 99 AI Act are imposed on the company as Controller or as entity or operator in any event — and, according to the statement in the first version, are not covered. Third: the fault thresholds diverge. § 38(2) BSIG attaches to any culpably caused loss and does not require a gross breach of duty, whereas the exclusion of cover, according to the statement in the first version, starts at gross negligence — between these two thresholds lies the area in which the question of cover is decided in practice.

Practical recommendation: check the policy against precisely these six items before renewal and obtain written confirmation of how claims under § 38(2) BSIG are treated. The scope of cover and the exclusions follow the terms of the respective contract, not a legal provision.

What must be documented — and what is a practical recommendation

The table lists six record-keeping and reporting duties; four of them concern management documentation: documentation, registration (one-off, with ongoing notification of changes), training and supervision — added to these are the incident report (§ 32(1) BSIG) and the implementation evidence of operators of critical installations (§ 39(1) BSIG). The addressee is in part the entity (§ 30(1), § 32(1), § 33(1), § 39(1) BSIG), in part the management body itself (§ 38(1) and (3) BSIG). Which date follows from the law and which from practice is set out per row in the column 'Requirement' — this distinction determines what counts as a breach of duty in supervisory proceedings and what remains an internal working requirement. The table reflects German law; the Austrian equivalents are in the next section.

Practical recommendation for the file: record for each training session the date, the participants, the content and the underlying legal provision, and keep these records as an annex to the management review. A significant security incident — one that has caused or can cause severe operational disruption or financial loss, or that has affected or can affect other natural or legal persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG) — cannot be postponed to the next review date: the 24-hour deadline runs from the moment of becoming aware.

Austria: different legal bases

Different sources and different authorities apply to Austrian companies: § 25 GmbHG (AT) instead of § 43 of the German GmbHG, NISG 2026 instead of the BSIG with the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) instead of the BSI, the Austrian Data Protection Act (DSG) and the Austrian Data Protection Authority (Datenschutzbehörde) instead of the BDSG and the Länder data protection authorities, the Austrian Whistleblower Protection Act (HSchG) instead of the HinSchG; the AI Act applies in the same way in both states. The system of liability is comparable, the competences are not. Points 1–4 reflect German law; the same applies to the overview table at the beginning and to the records table in the previous section. On the temporal caveat: according to the reviewed status of dates as at 2 May 2026, the NISG 2026 (BGBl. I Nr. 94/2025) applies from 1 October 2026 — all the following NISG statements are subject to this start of application; the statements on the GmbHG (AT), data protection, whistleblower protection and the AI Act are not affected by it.

• Duty of care of the managing director: § 25 GmbHG (AT) — 'the diligence of a prudent businessman', liability towards the company — in place of § 43 of the German GmbHG.
• NIS2: transposition via the NISG 2026 (instead of the BSIG): registration § 29, risk-management measures § 32, reporting obligations (24 h / 72 h / 1 month) to the CSIRT under § 34. In detail, from 1 October 2026: registration with the Cybersecurity Authority within three months, changes to the core data within two weeks (§ 29(2) to (4)); measures 'appropriate and proportionate' with the minimum catalogue of § 32(4) (a) to (j) — the German § 30(1) BSIG additionally requires effectiveness; self-declaration within twelve months of the registration obligation arising and evidence by an independent body upon request within two years, for essential entities within two months for operational and organisational implementation (§ 33(1) and (2)). Classification as an essential or important entity is governed by § 24 in conjunction with § 25 NISG 2026; the competent authority is the Cybersecurity Authority (§ 3a), not the BSI.
• Management body/NIS2 (AT): § 31 NISG 2026 — the management bodies of essential entities and important entities must ensure and supervise compliance with the risk-management measures under § 32 and must attend cybersecurity training. The NISG 2026 contains no express internal-liability provision comparable to § 38(2) BSIG; liability follows from general company law. In return, the Cybersecurity Authority may temporarily prohibit the management bodies of an essential entity from exercising managerial functions by administrative decision (§ 39(4) no. 2 NISG 2026, entry in the companies register), and administrative penalties are imposed by the district administrative authorities — a penalty against the responsible person under § 9 VStG (Austrian Administrative Penal Act) is dispensed with only where the legal person is already penalised for the same infringement (§ 44(5) NISG 2026). For administrative offences under § 45(1) NISG 2026, the penalty framework is up to EUR 10,000,000 or 2% of total worldwide annual turnover for essential entities and up to EUR 7,000,000 or 1.4% for important entities — whichever amount is higher (§ 45(2) and (3) NISG 2026).
• Data protection: supervision by the Austrian Data Protection Authority (Datenschutzbehörde, DSB) on the basis of the DSG — instead of the Länder data protection authorities and the BDSG in Germany. The Datenschutzbehörde is established as the national supervisory authority under Art. 51 GDPR (§ 18(1) DSG) and decides on the national administrative penalties: up to EUR 50,000, for example for the intentional transfer of data in breach of data secrecy — but only where the act does not already constitute an offence under Art. 83 GDPR or is not subject to stricter penalties under other administrative penal provisions (§ 62(1) DSG). Austria does not provide for a numerical threshold for the designation of a data protection officer going beyond Art. 37 GDPR (§ 5 DSG); the German 20-person threshold has no counterpart there.
• Whistleblower protection: the Austrian Whistleblower Protection Act (HSchG) instead of the HinSchG — internal whistleblowing system from 50 employees (§ 3(1), § 11(1)). Obstruction, retaliation, breaches of confidentiality and knowingly false reports are administrative offences and are punished by the district administrative authority with a fine of up to EUR 20,000, and up to EUR 40,000 in the event of repetition (§ 24 HSchG).
• EU AI Act (Art. 99): as an EU regulation, Regulation (EU) 2024/1689 applies in Germany and Austria alike — there is no national difference here.