Complass
The management body is liable: what § 38 BSIG requires from managing directors
A question at the shareholders' meeting, three duties in the law and a binder that is still missing: how managing directors and executive boards meet § 38 BSIG calmly and verifiably.
With the transposition of the NIS2 Directive, the German BSI Act (BSIG) places duties of their own on the management bodies of essential and important entities: they must implement the risk-management measures under § 30 BSIG, oversee their implementation and take part in training regularly (§ 38 BSIG, Art. 20 NIS2 Directive). Anyone who culpably breaches the duties to implement and oversee is liable to their own entity under the company law of its legal form; the training duty is checked by the BSI.
The whitepaper is aimed at managing directors and executive boards in every sector. It explains the three duties and how they differ from § 30 BSIG, sets out liability, supervision and fines with exact references, and proposes a practical evidence plan: resolution on the measures, reporting rhythm, training records and documentation, plus a roadmap for the first 90 days.
Each obligation chapter includes a short "Implementation in Complass" box (decision W11); only features already live are named.
15 pages · Version 1.1 · as of 07.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.