## [The digital duty of care: the personal liability of boards and their members in relation to technology risks](/en_GB/new/digital-duty-care-personal-liability-boards-and-their-members-relation-technology-risks)
# The digital duty of care: the personal liability of boards and their members in relation to technology risks
11 / 11 / 2026
-
- [](https://www.linkedin.com/sharing/share-offsite/?url=https://www.garrigues.com/en_GB/new/digital-duty-care-personal-liability-boards-and-their-members-relation-technology-risks)
- []()
- []()
[Read the article in the newsletter
](/sites/default/files/noticias/files/newsletter-economia-del-dato-octubre-2026_en.pdf)
Previous Next
**Cybersecurity is no longer simply a technical issue. It has now become an essential corporate governance responsibility. The convergence of European laws on cybersecurity, digital resilience, and artificial intelligence is shaping a new duty of care for directors, requiring their direct and continuous involvement in managing technology risks and potentially giving rise to personal liability implications.**
Until very recently, cybersecurity fell within the responsibilities of chief information officers or heads of IT security. Boards of directors only dealt with this subject, if at all, following a major incident and to manage its financial or reputational consequences. This was a technical matter, unrelated to corporate governance, that did not regularly feature on their agenda or create personal concern among directors. Today, that blithe delegation of responsibility has become a legal risk for every director.
The European Union has now produced an extensive collection of laws and regulations on the subject (NIS 2, DORA, the Cyber Resilience Regulation, the GDPR, and the Artificial Intelligence Act). This article does not aim to provide an exhaustive analysis of any of these laws regulations, but rather to present a proposition that is especially important for senior management: the convergence of these laws and regulations is, in fact, giving rise to a new standard of care or directors and senior executives concerning cybersecurity and technology risk. We refer to this below as the digital duty of care.
## Legislative convergence: a mesh of obligations directed at managing bodies
In just a few years, European lawmakers have adopted legislation with a variety of purposes and scopes, although they all share a common feature: they impose direct, rather than simply delegable, obligations on the highest governing body of the organizations in their scope. This is no coincidence, it is a legislative policy decision. These are the main components of that mesh of laws and regulations.
**NIS 2 Directive**
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022, on measures for a high common level of cybersecurity across the Union, is probably the most explicit piece of legislation due to imposing direct liability on managing bodies. Under article 20 they are required to approve cybersecurity risk management measures, in addition to overseeing their implementation, and they can be held liable for the entity’s infringements. That article also requires specific cybersecurity training for their members and encourages regular training for employees.
In Spain, the Preliminary Bill for a Cybersecurity Coordination and Governance Law, drawn up to transpose this directive, creates the National Cybersecurity Center and establishes the institutional framework and obligations that will implement the NIS 2 requirements.
**DORA Regulation**
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022, on digital operational resilience for the financial sector, applicable since January 17, 2025, follows the same line of thinking in greater detail. Article 5 imposes ultimate responsibility on the managing body for defining and approving a digital operational resilience strategy, establishing ICT roles and responsibilities, determining technology risk tolerance, and approving, overseeing, and reviewing business continuity and recovery plans. The EBA guidelines adapted to DORA step up the involvement of managing bodies. Furthermore, the obligation to maintain up-to-date information on IT service providers makes oversight of the digital supply chain a governance function.
**Artificial Intelligence Act**
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, laying down harmonised rules on artificial intelligence, is particularly relevant due to its cybersecurity and risk management requirements. Article 9 requires providers of high-risk systems to have a continuous and iterative management system throughout the entire life cycle. Article 15 lays down that those systems must be resilient against attempts at unauthorized manipulation. For general-purpose AI models presenting systemic risk, it imposes enhanced obligations, including protection against cyber threats.
**Cyber Resilience Act**
Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024, on horizontal cybersecurity requirements for products with digital elements completes the mesh from a product perspective. It imposes obligations for products with digital components throughout their entire life cycle: security by design and by default, active vulnerability management, and incident reporting. Any company that manufactures or markets connected products falls within its scope, and therefore it applies to a very broad spectrum of European industry.
A clear conclusion can be drawn from a combined reading of these legal acts, and other related ones, such as the GDP: cybersecurity is no longer a matter than can simply be delegated. It is a corporate governance responsibility, and the people in charge can be held accountable.
## The digital duty of care: a new fiduciary standard
The accumulation of obligations is not simply the placing of layer upon layer of sector-specific laws and regulations. Taken together, these provisions are shaping a digital duty of care: a fiduciary standard required of directors in relation to cybersecurity, digital resilience, and technology risk management. It is the logical consequence of the legislative convergence described above.
Directors’ general duty of care has experienced a gradual sectoral refinement. This was the case with criminal law compliance: the liability of legal entities compelled boards to become involved in risk prevention, approve organizational and management models, create oversight bodies, and allocate resources to the compliance function. A similar process occurred in relation to anti-money laundering processes, to the point where oversight of the anti-money laundering system became a personal duty of the managing bodies.
Cybersecurity is following the same path, although with one distinctive feature: speed. The transition from generic security obligations, such as those under the GDPR, to a detailed framework of direct responsibilities has taken place in just a few years. Companies and their directors have a much narrower window for adaptation.
This duty has four characteristics that set it apart from other duty of care standards:
- It is **continuous**, not a one-time event. The dynamic nature of threats demands constant vigilance. It is not enough simply to approve and file a policy: the board must keep track of its suitability in a threat landscape which, by definition, is constantly changing and the directors must stay informed about ICT risks.
- It is **cross-functional**. Cybersecurity affects the entire organization: supply chain, customer data, production systems, and intellectual property. The managing body needs to have an overall view, rather than one fragmented into departments or business lines.
- It is **technically demanding**. NIS 2 requires specific training for the members of managing bodies. They cannot be effective at overseeing something they do not understand, and technical complexity cannot justify the board’s inaction. Ignorance of technology is no longer a reasonable defense.
- **Personal liability** cannot be transferred. Members of the managing body can and should rely on internal and external experts, although liability for oversight cannot be transferred. NIS 2 and DORA impose liability on the managing body and provide for personal consequences, including, in certain cases, temporary disqualification for individuals holding management positions.
These provisions converge to shape a standard that goes beyond the generic duty of care expected of an orderly businessperson. As the case law and regulatory practice flesh out its content, it will become established as an independent parameter for assessing the conduct of directors.
## Artificial intelligence as a multiplier of cybersecurity risk for the board
While the regulatory landscape already imposes significant requirements, artificial intelligence acts as a multiplier of risk and, therefore, of liability in relation to cybersecurity.
AI has a dual nature. It is a powerful tool for defense, in terms of threat detection, anomaly analysis, response automation, and predictive identification of vulnerabilities, although it is also a sophisticated attack vector: data poisoning, adversarial attacks, deepfakes for social engineering, automated malware generation, or hidden instructions in working papers.
The AI Act addresses this dual role. High-risk systems must achieve an adequate level of cybersecurity and be resilient against unauthorized manipulation. Their risk management system must identify known and reasonably foreseeable risks, including cybersecurity risks, throughout the entire life cycle. For general-purpose models presenting systemic risk, the obligations are even more stringent.
The significance for boards lies in the convergence of these obligations with those in NIS 2, DORA, the CRA, and the GDPR. A company deploying AI must simultaneously monitor the requirements applicable to the system, the data, the ICT infrastructure, and, where relevant, the connected product. All of these provisions may converge on a single technological asset.
This creates an area of heightened liability: the adoption of AI multiplies cybersecurity obligations and raises the standard of care required of the managing body. Implementing AI is not simply a business or innovation decision; it has direct implications on directors’ personal liability.
Moreover, the legislation cannot be updated quickly enough to keep up with the pace of change in AI. Lawmakers have preferred principles and risk management over technical requirements that quickly become obsolete. This flexibility places an interpretation responsibility on the board: determining what level of cybersecurity is appropriate for an AI system at any given time.
## Practical consequences for managing bodies
The described framework has immediate implications for the organization of boards. Without claiming to be exhaustive, the following are notable:
- Cybersecurity must be a recurring item on their agendas. The board must receive structured information on the status of security, incidents, vulnerabilities, emerging threats, and the degree of legislative compliance, with proportional frequency to the entity’s risk profile.
- Training for board members is not optional. They must acquire and maintain sufficient knowledge to understand their organization’s risks and critically assess the measures taken. The goal is not to turn them into technical experts, but instead to equip them with the knowledge needed to engage in informed dialog that will enable them to oversee operations effectively.
- Directors’ and executives’ liability insurance policies must be reviewed. It needs to be checked whether they adequately cover scenarios arising from cybersecurity incidents and whether their coverage is consistent with the penalties and personal liabilities under NIS 2. Inadequate coverage may also reveal a shortfall in the standard of care.
- Organizations of a certain size should create or strengthen specialized technology risk committees. These structures enable the board to fulfill their obligations with the necessary technical depth, without diluting their ultimate liability.
- The digital supply chain takes on a governance dimension. DORA and the CRA require visibility into the risks arising from technology dependence on third parties. Outsourcing IT services does not outsource liability.
- Any decision to adopt AI must include a specific cybersecurity assessment, addressing both legislative compliance and the operational risk that the system introduces into the organization.
## Final thoughts
We are facing a paradigm shift: cybersecurity is no longer a technical cost and has now become a fiduciary duty. European legislation has charted a path toward holding governing bodies personally liable in relation to cybersecurity and digital resilience matters.
The digital duty of care is not a theoretical possibility. It is the result of a combined reading of NIS 2, DORA, the AI Act, the GDPR, and the CRA. Any board member of a company subject to these pieces of legislation must be aware that their personal liability is legally defined, is monitored by regulators with the authority to impose penalties and can be enforced in court.
The question is no longer whether a board member should address cybersecurity. The question is how much personal risk they are willing to assume if they do not.
This evolution is reminiscent of the transformation of ESG factors: from a marginal and voluntary issue to a pillar of corporate governance. Cybersecurity and digital resilience are going down a similar path, although at a faster pace and with more immediate and personal consequences: direct penalties, liability for directors, and even temporary disqualification in the most serious cases.
The growing sophistication of cyber risk and D&O policies, with specific types of coverage and exclusions, confirms that this is not simply an academic issue, but instead a market reality that boards must include in their strategy and risk assessment.
In short, cybersecurity has entered the boardroom and is here to stay. Boards that understand this reality will not simply comply with the law: they will protect their organizations, shareholders, and themselves. Blithely delegating responsibility to the IT department is no longer a legally tenable option.
[Data Protection](/en_GB/tags/data-protection), [Spain](/en_GB/tags/spain), [Europe](/en_GB/tags/europe), [Artificial Intelligence](/en_GB/tags/artificial-intelligence), [Garrigues Digital](/en_GB/tags/garrigues-digital)
---
This publication is provided for information purposes only and does not constitute legal advice or advice of any other kind. It does not seek to offer a comprehensive summary of the legislation and developments to which it refers nor to cover all published material, but rather to provide an overview of selected topics. It is therefore recommended that the official texts be consulted and specific professional advice be sought. Garrigues does not accept any liability for the use made of this information and assumes no obligation to update it after publication.
---
### Contact
[Alejandro Padín](/en_GB/team/alejandro-padin-vidal)
[Contact]()
- +34 91 514 52 00
[Madrid](https://www.garrigues.com/en_GB/office/madrid)
[Find more professionals](../team)
### Related services
- [Data Economy, Privacy and Cybersecurity ](/en_GB/services/data-economy-privacy-and-cybersecurity)
-
## Find a publication
Select service Administrative and Constitutional Law Agribusiness and Food Automotive Banking and Finance Corporate and M&A Corporate Governance and Sustainable Development Criminal Law and Internal Investigations Data Economy, Privacy and Cybersecurity Dispute Resolution: Litigation and Arbitration Energy EU and Antitrust Law Family Business Fashion Law Financial Regulation G-advisory Human Capital Services Infrastructure Insurance Intellectual Property Labor and Employment Life Sciences and Healthcare Media and Entertainment Planning, Zoning and Environment Private Equity Real Estate Restructuring and Insolvency Securities Markets Sports Startups & Open innovation Sustainability Tax Technology, Communications and Digital Tourism and Hotels Transport, Logistics and Shipping Facet Services detail Facet Services detail
Select type of content Publications Newsletters Garrigues collection Laws: amendments at a glance News Facet Publication type detail Facet Publication type detail
Min
Max
## News search engine