2026-11-11 - NIS2 and management bodies: approving, overseeing, answering
Read on website
---
Fourth article in the
series NIS2 in Italy, beyond the deadlines
, introduced in the
first article on the method for reading the sources
. Sources updated as of 24 October 2026.
“We have delegated information security to the security officer, who reports to the chief executive officer.” It is a sentence often heard in boardrooms, and it is correct from an organisational standpoint. Under the NIS rules it is incomplete: some activities can be entrusted to internal or external structures, but approving, overseeing and answering remain tasks of the body.
The thesis of this article is that Article 23 of the NIS Decree brings information security into the responsibility of the top level with a broader scope than that of the Directive, and that the critical point is not the resolution of approval, but the possibility of demonstrating effective and continuous oversight.
What the Directive requires
Article 20 of
Directive (EU) 2022/2555
contains two rules. The management bodies of essential and important entities approve the risk-management measures taken pursuant to Article 21, oversee their implementation and can be held liable for infringements of that Article. The members of the body are also required to follow training, while for employees the Directive merely asks the Member States to encourage it.
For essential entities only, Article 32(6) adds that the natural persons who represent or control them must have the power to ensure compliance with the Directive and can be held liable for breach of that duty.
What the Italian Decree adds
Article 23 of
Legislative Decree No. 138 of 4 September 2024 (NIS Decree)
takes up the Directive and widens its scope on three points.
.tbl-wrap{overflow-x:auto;margin:1.5rem 0}table.compare{width:100%;border-collapse:collapse;font-size:.92rem}table.compare th{background:#26215c;color:#fff;padding:.6rem .7rem;text-align:left;vertical-align:top}table.compare td{padding:.55rem .7rem;border-bottom:1px solid #ddd;vertical-align:top}table.compare tr:nth-child(even) td{background:#f4f4f8}table.compare td:first-child{font-weight:600}.tbl-note{font-size:.85rem;font-style:italic;margin-top:.4rem}@media(prefers-color-scheme:dark){table.compare td{border-bottom:1px solid #444}table.compare tr:nth-child(even) td{background:#1e1e2a}}
ProfileDirective, Article 20NIS Decree, Article 23
ApprovalRisk-management measures taken pursuant to Article 21.Implementation arrangements for the measures taken pursuant to Article 24.
OversightImplementation of the measures under Article 21.Implementation of all the obligations of Chapter IV and of Article 7, hence also incident notification, registration and updating of information.
LiabilityInfringements of Article 21.Breaches of the Decree.
TrainingMandatory for the members of the body; to be encouraged for employees.Mandatory for the bodies; the bodies promote consistent periodic training for employees.
InformationNot provided for in Article 20.The bodies are informed periodically or, where appropriate, promptly of incidents and notifications (paragraph 3).
In my view, the extension of oversight to Article 7 and to the whole of Chapter IV is the most significant difference. It means that the correctness of the annual registration, of the updating of information and of the notifications also falls within the body’s sphere of control, not only the adoption of technical measures.
ACN Determination 314287/2026
(which replaced Determination 127437/2026 from 25 October 2026) makes this explicit: the bodies oversee registration, communication and updating of information and answer for any breaches (Article 2, paragraph 3).
Who the management and administrative bodies are
The
Agency’s FAQs on roles
identify the bodies as those holding the power of direction of the organisation, starting with the board of directors. Where the board does not exist or does not perform steering functions, the body with equivalent functions is identified, including from the articles of association or the founding law; the legal representative is in any case included. Managers who are not members of the body, the point of contact and the security officer are not members, unless they also sit on the board.
The identification is not theoretical. With the annual update the entity lists the members of the bodies as natural persons responsible pursuant to Article 38, paragraph 5, of the Decree, and each member accepts the designation by accessing the Agency’s portal (Determination 314287/2026, Articles 16 and 17). Financial entities subject to the DORA Regulation are exempt from this listing, without prejudice to voluntary participation.
What is approved
ACN Determination 379907/2025
breaks down the approval obligation into the requirements of the baseline measures. The
reading guide
and FAQ ODA.10 gather them into a single list: the organisation for information security, the security policies, the risk assessment, the risk treatment plan, the vulnerability management plan, the adaptation plan, the business continuity, disaster recovery and crisis management plans, the training plan, the incident management plan.
On the level of detail, FAQs ODA.10, ODA.11 and ODA.12, updated in July 2026, offer three clarifications:
- the documents approved by the body must reflect the requirements of the measures at least at the level of direction and strategic planning, so as to enable the body to exercise its function knowingly;
- the technical and operational detail, such as procedures, instructions and manuals, can be entrusted to the competent structures without approval by the body;
- the updating of those operational documents does not require a new approval of the strategic documents that refer to them.
It is a reasonable reading, which distinguishes direction from management, and does not ask the body to know the technical detail of the procedures: for the incident management plan the list of procedures with the related references is sufficient. It has, however, a corollary, which the same FAQ ODA.10 makes explicit: the approved documents must set out the requirements at least at the level of direction and strategic planning, so as to enable the body to exercise its function knowingly. A document that merely refers onwards, without that steering content, leaves the function a formal one.
What is delegated and what is not
FAQs ODA.8 and ODA.9 set the boundary. The performance of the activities needed to implement the obligations can be delegated. The approval of the documents cannot be delegated, as it belongs to the body in its collegial form or to the single-person body, nor can the obligations of Article 23 be transferred to individual directors or to other functions. For companies, the Agency refers to Articles 2381 and 2392 of the Civil Code on the relationship between the board and delegated bodies.
The rules on the point of contact follow the same logic. Determination 314287/2026 provides that the point of contact reports directly to the top level and to the bodies (Article 4, paragraph 5), that its designation does not remove the responsibility of the bodies and of the natural persons (paragraph 6), and that in the event of replacement it is the bodies that designate the successor without delay (paragraph 7).
The training obligation of the bodies is reflected in the baseline measures: the information security training plan covers staff, “including the management and administrative bodies”, and is approved by those same bodies (measure PR.AT-01). The same requirement calls for a register of trained employees.
The information obligation of Article 23, paragraph 3, is linked to two requirements of the baseline measures: the periodic reports to the bodies on the outcomes of the adaptation plan (measure ID.IM-01) and the internal communication arrangements, including towards the bodies, provided for by the incident management plan (measure RS.MA-01). Prompt information on a significant incident is therefore not a practice of good governance, but a necessary content of the system.
Liability
The Decree regulates liability on several levels, which I will take up in the article on supervision and sanctions. Here I set out its essential terms.
- Breaches of the obligations of Article 23 are penalised, as regards the entity, with the highest financial penalties provided for by the Decree (Article 38, paragraph 8).
- For essential entities, the natural persons responsible for them or representing them must ensure compliance with the Decree and can be held liable for breach of that duty (Article 38, paragraph 5).
- If the entity fails to comply with a formal warning from the Agency, the accessory penalty of disqualification from performing managerial functions within the same entity, until compliance, may be imposed on natural persons, including the members of the bodies of essential and important entities (Article 38, paragraph 6).
- For public employees, the rules on managerial, disciplinary and administrative-accounting liability remain unaffected (Article 38, paragraph 7).
Open question. Article 23, paragraph 1, point (c), states that the bodies “are responsible for the breaches referred to in this Decree”. The Decree does not attach to this wording a separate personal financial penalty: the financial penalties fall on the entity, while the personal accessory measure presupposes a formal warning that has not been complied with. In my view, the provision operates above all as a standard of diligence for the body, relevant for civil liability towards the company and for the assessment of conduct in supervisory proceedings; it remains to be seen how the Agency will use it in its proceedings.
The evidence of oversight
The sources clearly indicate the types of trace from which the exercise of the function is inferred: the resolutions approving the documents indicated by the baseline specifications, the periodic reports received by the body, the information on incidents and notifications, the participation of the members in training. The common feature is continuity: an isolated approval demonstrates an act, not oversight.
In my view, Article 23 is the provision that most changes the internal balance of the organisations subject to the rules. The Directive provides for approval of the measures, oversight of their implementation and liability for infringements of Article 21; the Decree extends oversight to all the obligations of Chapter IV and to registration, and links liability to any breach of the Decree. The FAQs of July 2026 have made the documentary burden more manageable, by distinguishing strategic documents from operational ones, without reducing the substance of the obligation.
The consequence is that the matter is not settled by appointing a technical figure, however qualified. A structured information flow between those who manage security and those who answer for it is the condition that enables the body to approve, oversee and decide knowingly, and to demonstrate it; on its own it does not guarantee compliance, which also requires the training of the members and documented decisions.
Practical guidance. One mistake to avoid is to consider the obligation discharged by a formal approval of the documents; what matters is that the body receives periodic and prompt information and that effective direction emerges from its decisions.
Reference documents
European Union
- Directive (EU) 2022/2555 (NIS2), Articles 20 and 32:
http://data.europa.eu/eli/dir/2022/2555/oj
Italy
- Legislative Decree No. 138 of 4 September 2024, Article 23:
Normattiva
- Legislative Decree No. 138 of 4 September 2024, Article 38:
Normattiva
- ACN Determination 379907/2025 and Annexes 1 and 2:
acn.gov.it
,
Annex 1
,
Annex 2
- ACN Determination 314287/2026:
acn.gov.it
- ACN, reading guide to the baseline specifications:
acn.gov.it
- ACN, FAQs on roles and procedures:
acn.gov.it
- ACN, update of the FAQs on management bodies (14 July 2026):
acn.gov.it
---
This article is for general information purposes and does not constitute legal advice. The framework is updated as of 24 October 2026; governance arrangements must be assessed in relation to the legal nature and the articles of association of each entity.
---
New to Gemini? This capsule is best read with a Gemini client, such as Lagrange.
Lagrange - a Gemini client for desktop, iOS and Android
Back to articles list
English section
Home