What is the basis of directors' liability?

(A legal analysis in the light of O.U.G. nr. 155/2024 (Government Emergency Ordinance no. 155/2024) and Directive (EU) 2022/2555 - NIS2)

IT security has ceased to be a technical matter that can be delegated to specialists and has become a corporate governance attribute and a component of directors' duty of care and loyalty. But what is the basis of directors' liability? And where do we draw the line between governance and managerial diligence?

O.U.G. nr. 155/2024 lays down a clear standard of liability: the management bodies of essential entities (companies in critical sectors such as energy, transport and healthcare) must approve cyber risk management policies and measures, ensure that they are implemented and continuously oversee compliance with the legal requirements.

1. The regulatory framework and the legal interest protected

Developments in European and national cyber security legislation mark a structural shift in the role of executive management. By transposing Directive (EU) 2022/2555 (NIS2), O.U.G. nr. 155/2024 (Government Emergency Ordinance no. 155/2024) has, for the first time in Romanian law, established express legal liability of management bodies for managerial negligence that allows cyber incidents to occur or to worsen.

This obligation therefore goes beyond mere formal oversight. Management functions become direct addressees of the compliance obligation, required to demonstrate the exercise of active diligence - planning, control, verification and remediation.

Yet how is the standard of an informed representative to be determined? Liability is coupled with a professional training obligation: members of management bodies must attend accredited cyber security courses and ensure that staff with relevant responsibilities are trained.

This gives shape to the figure of the informed representative, able to assess the risks and take decisions on an informed basis. A lack of training or of minimum competence does not exclude liability; it amounts to a form of managerial negligence.

2. The positive obligations that give rise to management liability

At the first stage, the focus is on implementing security measures and carrying out a cyber audit. In practice, the entities concerned must (i) adopt technical and organisational measures that are appropriate and proportionate to the risks identified, (ii) build security requirements into the supply chain and (iii) submit to periodic and ad hoc audits carried out by independent bodies or by the competent authority.

Management functions are liable for failing to implement these measures, for implementing them superficially or for failing to oversee them. Any shortcoming in planning, budget allocation or managerial control may be classified as a lack of diligence.

Incident reporting will subsequently become standard practice, with entities being required to notify significant incidents to the Directoratul Național de Securitate Cibernetică (DNSC) (National Cyber Security Directorate) in stages: an early warning within 24 hours of discovering the incident, a detailed notification within 72 hours and a final report within 30 days.

This obligation is not merely procedural; it sets a standard of managerial response. Failure to report, unjustified delay or the provision of inaccurate information will engage management liability for lack of oversight or poor risk management.

3. Supervision and enforcement mechanisms

The DNSC is the authority responsible for control, supervision and enforcement. It may order:

regular or ad hoc security audits;
requests for documents, policies and evidence of the implementation of measures;
binding instructions to remedy shortcomings;
orders to cease non-compliant conduct;
the appointment of a monitoring officer with specified duties.

These powers give the authority an active role as guardian of managerial diligence, enabling it to intervene before negligence materialises in a major incident.

In serious cases, where the entity fails to comply with the measures imposed, the authority may request the temporary suspension of certifications or a ban on holding executive office or acting as legal representative for the persons responsible.

This sanction, administrative and preventive in nature, marks a stage in the maturing of the legal regime: liability becomes personal, shifting from the entity to the individual decision-maker.

4. Administrative liability of management

The legislator has provided a specific administrative sanctions regime for members of management bodies who fail to comply with their legal obligations. The sanctions regime set out in O.U.G. nr. 155/2024 therefore applies differently to entities and to management, in accordance with Article 50:

In assessing measures and sanctions, account will be taken of the duration of the conduct, any previous breaches, the damage caused, the conduct towards the authorities and the steps taken to remedy the situation. Management bodies are liable for granting DNSC staff access to the premises and data subject to control, in accordance with paragraph 3;
In the case of serious breaches, regard will be had to repeated conduct, obstruction of audits, the provision of false information and failure to comply with DNSC instructions.

It is important to note that Article 50(4) provides that the general meeting of shareholders and the board of directors are not management bodies within the meaning of the ordinance. Liability therefore attaches to persons holding executive office (directors, executive officers), not to deliberative bodies.

This legislative clarification allows us to conclude that the direct pecuniary liability of members of non-executive boards is limited. The personal liability of management is expressed chiefly through corrective measures, temporary bans and administrative sanctions, rather than through fines imposed automatically on individuals.

5. Managerial diligence as a means of exoneration

In order to avoid incurring liability, directors must demonstrate active and documented diligence. The relevant evidence includes:

an annual cyber-compliance plan approved at management level;
the formal appointment of a CISO with genuine authority;
a dedicated IT/OT security budget;
periodic external audits;
incident simulations and resilience testing;
documented training and decision-making records.

In the absence of such evidence, liability for managerial negligence is presumed. Even so, the assessment must be proportionate to the sector concerned and to the size of the entity - the principle of proportionality requires the organisational context to be assessed, rather than sanctions to be applied automatically.

6. Interaction with other legal regimes

Cyber incidents may overlap with separately regulated areas, in particular personal data protection (GDPR) and the regime governing critical entities.
O.U.G. nr. 155/2024 expressly provides that, where a security breach may lead to a personal data breach, the competent authority is to inform the data protection authority, thereby avoiding double sanctioning.

By comparison, Legea nr. 362/2018 (NIS1) imposed security and notification obligations on entities alone, without establishing any personal liability on the part of management. Through O.U.G. 155/2024, the legislator adds a governance dimension: management becomes directly responsible for implementing and overseeing technical measures.

Articles 25–30 of O.U.G. 155/2024 set out the minimum security requirements and the mechanisms for incident notification and management, taking over the NIS1 principles while extending them through mandatory audits, impact assessments and cross-border cooperation.

In addition, art. 50 (1)–(4) strengthens the criteria for assessing the gravity of breaches and draws a clear distinction between the liability of the entity and that of its executive management bodies.

The result is a shift from collective liability (NIS1) to individual managerial liability (NIS2), in line with European trends towards making governance obligations personal.

7. Practical conclusions: towards a new culture of digital accountability

The liability of directors for cyber security incidents marks the shift from formal compliance to personal accountability. The informed director becomes the pivot of organisational resilience. Individual pecuniary sanctions must nevertheless be interpreted strictly, in accordance with art. 50 (4). The accountability tools remain corrective measures and bans, not direct financial penalties.

Through this framework, O.U.G. nr. 155/2024, brings Romanian corporate governance up to European standards, establishing a culture of digital diligence. Against a background of increasingly sophisticated cyber attacks, the director becomes the guarantor not only of prudent financial management, but also of sustainable cyber security.