October 2026. Under NIS2, responsibility for cyber risk management sits explicitly with the management body. This is not decorative wording: the directive expects the board to approve the measures, oversee them and build its own knowledge. Here is what that means in practice and what evidence you can show.
Three things the board must do
NIS2 (Article 20) places three obligations on the management body: approve the cyber risk management measures, oversee their implementation and follow training. Management members can also be held liable if the organisation breaches the rules. See also our article on liability across the chain.
Approve: a decision with a date
An approval only exists if someone can prove it. Record the key documents in a board decision or in the minutes: the risk policy, the ISMS scope, the risk appetite and the annual security plan. The ISMS management review (clause 9.3) is a natural moment, as long as the board genuinely reviews the material. See management review in practice.
Oversee: look at numbers, not feelings
Oversight needs recurring reporting. Keep it small: open high risks, incidents and notification lead times, status of internal audits and corrective actions, and the main supplier risks. A KPI dashboard with five to eight indicators is enough, as long as the board reacts to it every quarter and records that.
Training: short, concrete and demonstrable
The law does not prescribe a fixed duration. It does expect board members to know enough to assess risk. A session of a few hours per year, tied to a real scenario such as a tabletop exercise, is easier to defend than a standalone e-learning. Keep the attendance list, the agenda and a short summary of what was discussed.
What evidence belongs to the board
A compact file is enough: board decisions on the policy, minutes showing risks and figures were discussed, proof of participation in training or an exercise, and the annual calendar. That file shows the topic sits structurally on the board table. To see how complete your own file is, try the readiness scan. See also the NIS2 hub.
This article is general information and not legal advice. Consult a lawyer for your situation.