This article considers how the transposition of Directive (EU) 2022/2555 of the European Parliament and of the Council (NIS2) affects Estonian company law, focusing on the civil and administrative liability of management board members.
NIS2 does not apply directly in Estonia as a regulation. Its requirements become binding on businesses and their management bodies through national law. In practice, board member liability arises from the Cybersecurity Act (KüTS) and its implementing legislation rather than from the directive itself.
Estonia has chosen a phased implementation, so not all obligations apply to businesses and their boards simultaneously. Some requirements, including the risk management framework and the clarification of management bodies' roles, apply earlier, while certain supervision and enforcement mechanisms are subject to transitional periods.
This phased approach is not a reason to postpone considering requirements that do not yet apply. Strategically, it makes sense to start aligning practices with them now.
1. Why NIS2 changes board responsibility in Estonia
Over the past decade, digital resilience has moved from a technical side issue to a central management concern. Information security was previously treated mainly as an operational risk managed by IT departments or external providers. NIS2 fundamentally changes that approach.
NIS2 regulates more than technical safeguards: it explicitly moves responsibility to management bodies. Cybersecurity now sits alongside financial management, internal controls and risk management, for which the management board is directly responsible.
In Estonian law, transposition through the Cybersecurity Act creates a conceptual tension with the general duty of care under the Commercial Code (ÄS). Under section 315 and Supreme Court case law, board members may rely on specialists in areas where they lack expertise. Article 20(2) of NIS2 limits this approach by requiring management training and preventing complete delegation of responsibility for approving risk management measures.
2. A board member's duty of care under NIS2
2.1. The diligence of a prudent businessperson: why lack of knowledge is no longer enough
Section 315(1) of the Commercial Code requires a board member to perform their duties with the diligence of a prudent businessperson. The Supreme Court interprets this as acting in good faith, on sufficient information and in the company's interests. A board member need not be an expert in every field and may reasonably rely on professional advisers.
NIS2 narrows this “privilege of ignorance” in cybersecurity. Article 20(1) requires Member States to ensure that management bodies approve cybersecurity risk management measures and oversee their implementation. Paragraph 2 requires management body members to receive training so they can assess cyber risks independently.
A board member's lack of knowledge may therefore cease to be a neutral factual circumstance and become a breach of the duty of care. A member who systematically fails to learn about cyber risks cannot avoid responsibility merely by saying they trusted the IT manager or information security specialist.
For a board member, the key points are:
- Cybersecurity is legally defined as a management responsibility.
- The training obligation and the requirement to approve risk management arise directly from the law, without requiring a separate additional breach.
- Liability is assessed by asking whether the member was reasonably aware of NIS2 obligations when decisions were taken.
2.2. Delegation: what the board cannot pass on
Delegation is normal and often necessary in company management. NIS2 does not abolish it, but establishes a core of non-delegable responsibility for cybersecurity risk management.
Planning and implementing technical solutions can still be delegated. The board remains responsible for the adequacy and suitability of risk management measures. This resembles accounting: a board may use a professional accountant but remains responsible for the annual report it signs. NIS2 extends this principle to IT architecture and cybersecurity.
3. Civil liability for NIS2 breaches: fines and recourse claims
An administrative fine imposed on a company for breaching NIS2 requirements may reach €10 million or 2% of worldwide turnover. This raises the question of a board member's financial liability to the company under section 315(2) of the Commercial Code.
Because NIS2 expressly assigns obligations to the management body, establishing causation between a board member's inaction and company losses becomes easier. In practice:
- The breach may be failure to complete required training or approve a risk assessment.
- The loss may be a fine or financial damage caused by a cyberattack.
- Causation may be inferred from the fact that diligent management would have identified and mitigated the risk.
This creates grounds for internal recourse: a company may seek compensation from board members who treated information security as merely technical rather than strategic.
4. Management bans under NIS2: not yet introduced in Estonia, but legally possible
Article 32(5)(b) permits the temporary suspension of a natural person's right to perform management functions in essential entities. Estonia has not expressly transposed this measure into the version of the Cybersecurity Act discussed in this article.
This does not mean that management bans are excluded from Estonian law in the NIS2 context. The directive authorises Member States to introduce such a measure, and Estonia may do so through amendments or implementing legislation if practical or supervisory experience makes it necessary.
4.1. Nature and purpose of the measure
In Estonia, business prohibitions have mainly been associated with insolvency or offence proceedings. NIS2 introduces a management ban as an administrative coercive measure intended to secure compliance with cybersecurity requirements, rather than punish a past breach.
This raises a question about its real addressee. Formally, the restriction applies to an individual; substantively, it pressures the legal entity to change its behaviour.
4.2. Proportionality and constitutional questions
Temporarily suspending management rights would significantly interfere with the freedom to conduct business and choose an occupation. Section 11 of the Constitution requires such interference to be proportionate and used only where necessary.
In the NIS2 context, a management ban can be justified only where:
- The breach is repeated and systemic.
- Less restrictive administrative measures have failed.
- A specific board member's significant personal inaction has been established, such as knowingly refusing resources needed to address critical security risks.
Implementing rules should avoid an automatic link between a cyber incident and a management ban. Otherwise, liability would turn on the outcome rather than the board's conduct, contrary to the nature of the duty of care.
5. What a board member should remember
NIS2 is more than an IT regulation: it is an important company law instrument reshaping good governance in a digital environment.
For a board member:
- The standard of care has changed, and relying on ignorance does not remove responsibility.
- Cybersecurity responsibility is personal and can be delegated only to a limited extent.
- Risks are financial and may also affect a professional career through a management ban.
Estonia must ensure that sanctions introduced under NIS2 are constitutional, proportionate and procedurally clear. Otherwise, legal certainty suffers in a business environment where cyber incidents are an unavoidable reality.
Has your company completed a board due diligence audit?
There is no need to start from scratch. We have prepared a sample addressing the NIS2 directive and the Cybersecurity Act.
👉 GET THE BOARD DUE DILIGENCE AUDIT SAMPLE