Cybersecurity as a Management Responsibility: When Are Corporate Directors Liable for “Hacker Attacks”?
In modern corporate governance, the question is no longer whether a company will be targeted by cybercriminals, but only when this will happen. The number of successful cyberattacks is also increasing. For managing directors (GmbH), executive board members, and supervisory board members (AG), this brings a topic into focus that extends far beyond the IT department alone: personal liability for deficiencies in cybersecurity.
Managing Director Liability – Business Judgment Rule
Managing directors constantly face critical business decisions that shape the success of their companies. The economic outcome of these decisions is often uncertain by nature. Investments, strategic realignments, and everyday business operations all involve both opportunities and risks. Effective risk management and well-informed decision-making are therefore essential for sustainable business growth and long-term corporate success.
Austrian corporate law recognizes this business reality and does not hold managing directors liable for every incorrect decision. Instead, it provides an important legal safeguard: the Business Judgment Rule.
This principle clarifies that liability does not depend on whether a business decision ultimately leads to economic success or failure. Rather, the decisive factor is how the decision was made.