This guide shows who is meant, what each task means in daily work and what an annual plan looks like without folders full of email.
Who counts as management
Under § 2 no. 13 BSIG, management is every natural person called by law, articles or partnership agreement to run the business and represent the entity.
- GmbH: the managing directors.
- Stock corporation (AG): the members of the management board.
- All members: The duty does not rest only with the person responsible for IT.
Exceptions apply, among others, to operators of energy supply networks and energy facilities subject to §§ 5c to 5e EnWG (§ 28(5) BSIG). For them, § 5e EnWG sets out the duties of management. § 38 BSIG also does not apply to operators of public telecommunications networks and providers of publicly available telecommunications services (§ 28(5) sentence 1 no. 1 BSIG). Nor does § 38 BSIG apply to financial entities covered by the DORA Regulation (EU) 2022/2554 (§ 28(6) BSIG). Our guide on NIS2 applicability explains whether your company is covered at all.
Three tasks at a glance
| Task | What the law says | What it means in daily work | Reference |
|---|---|---|---|
| Implement | Implement the measures under § 30 BSIG | Know the measures, approve them as suitable, provide budget and staff | § 38(1) BSIG, Art. 20(1) NIS2 |
| Oversee | Oversee the implementation | Check the status in a fixed rhythm, ask questions, steer | § 38(1) BSIG |
| Train | Attend training regularly | Identify and assess risks, judge the impact on your own services | § 38(3) BSIG |
Art. 20(1) of the NIS2 Directive says "approve", § 38(1) BSIG says "implement". The government's explanatory memorandum links the two: management approves the measures as suitable and continuously oversees their implementation (BT-Drs. 21/1501, p. 154).
Delegating: what works and what does not
The work may sit with the CISO, the head of IT or a service provider. The explanatory memorandum also says that the management body remains ultimately responsible when it uses assistants (BT-Drs. 21/1501, p. 154).
| What you can hand over | What stays with management |
|---|---|
| Drafting and running measures | Approving measures and providing the means |
| Preparing reports and key figures | Reading reports, challenging them and deciding |
| Organizing training | Attending the training in person |
The annual plan in six steps
The law does not say how often management checks the status. The quarterly rhythm is our recommendation.
- Record the classification. Record whether your entity is essential or important, with the reasons.
- Name the roles. Decide who runs the topic day to day and who reports to management.
- Approve the measures. Management reviews the status of the measures in the ten areas of § 30(2) BSIG, assesses it and decides. Put this in writing.
- Oversee every quarter. Check key figures, open points and your own instructions from the last meeting.
- Plan the training. Enter the next date for every member, including new members.
- File the evidence. Keep decisions, oversight and attendance certificates in one place.
What belongs in the quarterly report
One page is enough if it allows decisions. Five blocks have proven useful:
- Status of measures: What is in place per area, and what is open?
- Incidents: What happened, what was reported and what follows from it?
- Risks: Which risks are new, have grown or are waiting for a decision?
- Supply chain: Which important suppliers are assessed, and where is evidence missing?
- Decisions: What does management need today: budget, staff, a priority?
Training: what counts
The aim of the training is sufficient knowledge and skills to identify and assess risks and risk management practices and to judge their impact on the services of the entity (§ 38(3) BSIG).
- Interval: According to the explanatory memorandum, training counts as regular if it is offered at least every three years (BT-Drs. 21/1501, p. 154). A shorter interval is possible and sensible when new risks appear.
- Format: The law prescribes neither provider nor format.
- In person: Every member has to attend personally.
- Record: Keep the date, duration, provider, content and attendance certificate.
Liability in plain terms
If management breaches its duties under paragraph 1, it is liable to its entity for culpably caused damage under the company law of its legal form (§ 38(2) sentence 1 BSIG). Examples are § 43 GmbHG and § 93 AktG. Under the BSIG itself it is liable only if that law contains no rule (§ 38(2) sentence 2 BSIG).
In practice this means: if you can show decisions, oversight and training, you can show what management did. The entity documents compliance with the measures in any case (§ 30(1) sentence 3 BSIG).
Example from industry
The example is invented. A maker of packaging machines with 300 staff has two managing directors. The commercial managing director sees NIS2 as a topic for her technical colleague.
- January: Both approve the measures and release budget for segmenting production.
- April: The CISO reports: remote maintenance is still open and one supplier is not answering. Management sets a date.
- June: Both attend training with a tabletop exercise.
- October: After an incident at a service provider, management changes a priority and records it.
Checklist
- Classification of the entity recorded with reasons.
- All members of management named.
- Operational responsibility and reporting line settled.
- Measures under § 30(2) BSIG approved, means provided.
- Reporting rhythm set and dates in the calendar.
- Training planned for every member, attendance recorded.
- Decisions, oversight and training kept in one place.
Management duties in Complass
No more hunting for the decision, the quarterly report and the certificate across spreadsheets and email. In Complass they sit on one page:
- Cockpit: The card "What applies to you" shows the duties that follow from your classification, plus open actions and deadlines.
- Decision: Complass compiles the current status of the measures. Every member reviews and confirms in person.
- Oversight: Every member confirms key figures and open actions and can enter their own decisions and instructions.
- Training: You record the date, content and certificate. The next training appears on the deadlines page.
- Evidence: One PDF contains decisions, oversight, training and checksums for the period you choose.
Frequently asked questions
Is it enough to appoint a CISO?
No. The CISO can run the work. Management remains ultimately responsible and has to oversee implementation itself.
Does every member of management need training?
Yes. § 38(3) BSIG addresses management, and every person under § 2 no. 13 BSIG belongs to it. The law does not provide for one member attending on behalf of another.
How often does management have to check the status?
The law sets no interval. The explanatory memorandum speaks of continuous oversight. We recommend a fixed date every quarter.
Do supervisory or advisory boards need training?
§ 2 no. 13 BSIG names persons called to run the business and represent the entity. A supervisory board oversees the management and does not run the business itself (§ 111(4) sentence 1 AktG). By its wording it is not covered. This can differ for an advisory board to which the articles of association grant management and representation powers. Check your articles of association for this.
Does the BSI check the training?
It can. For essential entities § 61 BSIG names the training duty expressly, and § 62 BSIG does so for important entities. Complete evidence saves you the search.
In a demo we use the demo company to show you how decision, oversight and training come together in Complass.
Request a demo Try it for 14 days
Read more
- Whitepaper on the duties of management under § 38 BSIG
- Guide "Implementing NIS2: the step-by-step guide"
- Guide "Who is affected by NIS2?"
- NIS2 and the BSIG in Complass: applicability, duties and implementation
- Compliance management: catalogs, action plan and evidence
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of the BSIG and the company law of your legal form are authoritative. As of November 2026.