What Section 38 BSIG requires of management

This page covers the duties of management under Section 38 of the German BSI Act (BSIG), which transposes Article 20 of the NIS2 Directive (EU) 2022/2555. The BSIG applies to essential entities (in Germany: besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen). The training duty in Section 38(3) is covered on the page on NIS2 training for management; the measures required by Section 30 in detail are on the Section 30 BSIG page, and all obligations at a glance in the overview of NIS2 requirements. This is general information on the BSIG as amended on 22 October 2026, not legal advice; individual cases need a legal assessment.

What does Section 38 BSIG say?

Section 38 has three subsections on implementation, liability and training. It has applied since 6 December 2025 with no general transition period, whether or not the entity has already registered with the BSI, the Federal Office for Information Security.

Management within the meaning of the BSIG is every natural person appointed by law, articles of association or partnership agreement to run the business and represent the entity (Section 2 no. 13). In a GmbH these are the managing directors, in an AG the members of the management board.

The NIS2 Directive words this slightly differently in Article 20(1): there, management bodies “approve” the measures and oversee their implementation. By saying “implement”, the German act asks for more than an approval. For entities in Germany, the wording of the BSIG applies.

What do “implement and oversee” mean day to day?

Implementing means that management ensures the Section 30 measures are actually taken: appropriate, proportionate and effective technical and organisational measures whose compliance the entity documents (Section 30(1)). Overseeing means being informed about the status at regular intervals and stepping in when something is not working.

In our view, five activities belong to this, and no company can hand them off completely:

• Set objectives and boundaries: adopt the security policy and the risk appetite, that is, decide which risks the company is not willing to take.
• Assign responsibilities: appoint a person who is responsible for information security and reports directly to management.
• Provide resources: approve the budget, working time and service providers the action plan needs.
• Ask for the status: receive and read a report at fixed intervals.
• Decide: resolve delays, conflicting goals and remaining risks instead of leaving them open.

For the eleven digital entity types covered by Implementing Regulation (EU) 2024/2690 (such as cloud providers, data centres and managed service providers, listed in full in the sector directory), this is set out in more detail. For all other entities these rules are voluntary and serve as a useful benchmark:

What can management delegate, and what not?

Management may distribute the work on the measures; oversight stays with it. Section 38(1) addresses both duties to management itself. The BSI puts it this way: the choice of how to implement is free, while responsibility for the level of security required by law lies entirely with company management.

If management has several members and an allocation of responsibilities, the topic can sit in one portfolio. The BSIG still names every individual member of management as addressee (see the FAQ below).

Appointing an external information security officer is one way to distribute the work. Blackfort Technology describes this service on the page external information security officer.

How does management evidence its oversight?

Ideally with records showing that it was informed and made decisions. The law prescribes no form or interval for this. Compliance with the Section 30(1) measures must be documented, however, and when the BSI orders it, an entity has to prove that it has implemented the requirements.

Suitable evidence examples, by origin:

A report on its own proves little if nothing ever follows from it. It becomes meaningful when later reports show that adopted measures were implemented, or why they were not.

How are managing directors liable under NIS2 (Section 38(2) BSIG)?

Section 38(2) sets out internal liability: management is liable to its own entity for culpably caused damage, under the company law rules that apply to the legal form. The BSIG itself only steps in where company law has no such rule.

For the GmbH, the rule is Section 43 of the Limited Liability Companies Act (GmbHG): managing directors must apply the diligence of a prudent businessperson and are liable to the company for damage resulting from a breach of their duties. For the AG, Section 93 of the Stock Corporation Act (AktG) applies; in a dispute, the board member bears the burden of proving that they acted with due care. Section 38(2) BSIG links liability for breaches of Section 38(1) to these established rules. It does not regulate liability towards customers or third parties. Whether liability towards third parties arises from other provisions, such as contract or tort law, has to be assessed case by case.

Three distinctions help with the assessment:

• Fines: Section 65 BSIG has no offence of its own for Section 38. The offences attach to duties of the entity, such as measures under Section 30 that were not taken or not documented, or a missed report under Section 32. Under general administrative offences law, however, a fine can also be imposed on the members of management who act for the entity (Section 9 of the Administrative Offences Act, OWiG), and alongside them on the entity itself (Section 30 OWiG). The amount depends on the offence; details are in the overview of NIS2 requirements.
• Supervision: For essential entities, the competent supervisory authority can, as a last resort, temporarily prohibit unreliable members of management from exercising their functions if the entity has not complied with BSI orders despite a deadline (Section 61(9)). For important entities, the BSI only reviews when facts suggest a breach (Section 62).
• Individual case: Whether damage, fault and a breach of duty exist in a specific case is a legal question that a lawyer specialising in company law should answer.

Who is Section 38 not applicable to?

Section 38 applies to the management of essential and important entities. Under Section 28(5) and (6), exemptions cover, among others, operators of public telecommunications networks and providers of publicly available telecommunications services, certain operators in the energy sector, financial entities under DORA, and gematik and operators of telematics infrastructure services. The exemptions have counter-exceptions, for example when further activities under Annex 1 or 2 are added; details are on the page check NIS2 applicability. For telecoms providers, Blackfort Technology explains the legal position on the page telecoms providers under NIS2 and the TKG. Section 38 does not apply in the federal administration (Section 29(2)); there, the training duty of management is set out in Section 43(2).

Example: a manufacturer with two managing directors

Fictitious example, not a client. A manufacturer of measuring equipment with 160 employees falls under Annex 2 (manufacture of electronic and optical products) and is therefore an important entity. The GmbH has two managing directors: the commercial director is responsible for IT, the technical director for production and development. IT consists of three people; network and firewall are looked after by a service provider. One IT employee is appointed information security officer, with a direct reporting line to both managing directors.

Management adopts a twelve-month action plan (see action plan) and agrees on a report every quarter. The report goes to both managing directors, is discussed at the management meeting, and the decisions are recorded in the minutes. The following report for the third quarter of 2026 shows what this looks like.

Template: report to management (quarterly)

The template is our recommendation; the law does not prescribe structure or frequency. The values come from the fictitious example above.

1. Header

2. Status of the measures under Section 30(2) BSIG

3. Metrics

4. Security incidents and reports

Two security incidents this quarter: a phished account (locked after 40 minutes, no data exfiltration found) and a firewall outage of 2 hours (hardware fault). Both were assessed under the reporting process; neither was a significant security incident, so no report to the BSI was made. The assessment and its reasoning are kept in the incident register.

5. Decisions required

6. Minutes entry

On decision D2: the BSI points out that the BSIG requires appropriate, effective and proportionate measures, whereas ISO 27001 allows risk acceptance. Simply accepting a risk is therefore not a safe route; in the example, management adopts interim measures and a fixed date. How the risks are rated is shown on the page risk analysis.

Three typical gaps

How Blackfort Technology helps

We set up the reporting line with you, deliver the first report based on your actual status and support the discussion with management. A good starting point is the NIS2 gap analysis, whose result can be used directly as the first report.