Cybersecurity and Directors' Liability: Failure to Oversee Technological Risks

1. The facts

   According to reports by outlets such as BeBeez and Milano Finanza, there has been a significant increase in liability actions against corporate boards that suffered massive losses due to ransomware attacks or so-called CEO Fraud schemes. The cases, which saw several rulings on the merits by the Milan Business Court, involve directors accused of failing to implement even basic digital defense measures.

   Many of these cases are currently pending in first instance, where bankruptcy trustees or new shareholders challenge not the failure of a technical choice, but the total absence of IT governance. Specifically, recent orders have highlighted how the failure to oversee information flows and the lack of incident response protocols exposed companies to unreasonable risks, leading to the removal of corporate officers and claims for millions in damages due to business interruptions.

2. 

   The rules at play

   The regulatory framework revolves around three fundamental pillars:

   1. Art. 2086, paragraph 2, c.c., which imposes the duty to establish an organizational setup adequate to the nature and size of the business, now permanently incorporating the digital component;
   2. Art. 2381 c.c., specifying the duty of delegated bodies to setup and maintain such arrangements and of the board to assess their adequacy based on information flows;
   3. Legislative Decree 138/2024, transposing the NIS 2 Directive, which introduces direct personal liability for governing bodies for failing to approve and oversee cyber risk management measures. A breach of these provisions entails joint and several liability under Art. 2392 c.c. for damages caused to the company and to creditors.

3. What the case law says

   Case law on the merits has clarified a fundamental distinction: the Business Judgment Rule protects management discretion, but not the omission of procedural duties. Judges have affirmed that establishing an adequate organizational setup is not an unreviewable business choice, but a pre-decisional legal duty.

   According to established case law, a director is liable when ignoring red flags or failing to activate the necessary information flows. In the technological sphere, the lack of a disaster recovery plan or the absence of staff training are not considered unfortunate business decisions, but rather professional negligence for failing to exercise the diligence required by the nature of the office. Higher court jurisprudence in related fields has specified that risk monitoring must be continuous and documented, making digital inertia a ground for liability when damage is foreseeable.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Constantly monitor the recording in the minutes of information flows between the IT department and the Board to prove compliance with the duty to act in an informed manner.
   2. Advise clients to adopt certified minimum protocols (e.g., ISO 27001) in order to raise the defense of having implemented abstractly adequate setups.
   3. Verify that D&O (Directors & Officers) policies do not contain specific exclusions for cybersecurity damages stemming from gross organizational negligence.

References: Art. 2086 c.c.Art. 2381 c.c.Art. 2392 c.c.D.Lgs. 138/2024Direttiva NIS 2

Editorial oversight: Avv. Federico Papa·ICAMUpdated 29 August 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction