Attending the Bucharest Cybersecurity Conference 2026 last week reinforced a conviction I have developed over time: one of the greatest cybersecurity vulnerabilities facing businesses today may not be technological. It may be organisational.
Companies continue to invest in sophisticated security tools, external consultants and increasingly complex technological solutions. Yet an important question remains: who, within the organisation, truly owns cybersecurity risk?
For many years, the answer was relatively straightforward. Cybersecurity was primarily the responsibility of the IT department. Management expected technical teams to protect systems, prevent attacks and restore operations when incidents occurred.
That approach is increasingly difficult to sustain.
Cybersecurity has become a matter of corporate governance, regulatory compliance, business continuity and, ultimately, management accountability. The legal implications of a cyber incident can be just as consequential as the technical disruption itself.
The changing nature of cybersecurity responsibility
The European regulatory framework reflects this transformation.
The NIS2 Directive represents a significant shift in how cybersecurity is approached at organisational level. Rather than treating security as an exclusively technical obligation, it places particular emphasis on governance, risk management and the involvement of management bodies.
Under NIS2, management bodies of entities within its scope are expected to approve cybersecurity risk-management measures, oversee their implementation and receive appropriate training. The Directive also requires Member States to ensure that management bodies can be held liable for infringements by the entities concerned, in accordance with the applicable national framework.
This is an important distinction.
It means that cybersecurity can no longer be delegated to technical teams without meaningful oversight. Management remains responsible for ensuring that appropriate organisational measures, internal procedures and reporting mechanisms are in place.
A similar philosophy can be found in the Digital Operational Resilience Act (DORA), which establishes detailed requirements for ICT risk management in the financial sector and expressly assigns ultimate responsibility for managing ICT risk to the management body.
Although these regulatory instruments apply to different categories of organisations, the direction is clear: cybersecurity is becoming part of the legal responsibilities associated with managing a business.
The practical question is whether corporate governance structures are evolving quickly enough to reflect this reality.
Compliance does not necessarily mean resilience
One concern I find particularly relevant is the tendency to approach cybersecurity primarily as a compliance exercise.
Organisations often focus on policies, procedures, risk assessments, contractual clauses and regulatory reporting obligations. These are necessary, and in many cases mandatory. But their existence does not necessarily demonstrate that an organisation is prepared to deal with a serious cyber incident.
A company may have a comprehensive cybersecurity policy and still lack a clear decision-making process when a ransomware attack disrupts its operations.
It may have contractual security requirements imposed on its suppliers without understanding how dependent its business is on a particular technology provider.
It may have an incident-response plan without having established who is authorised to make urgent decisions, when legal counsel should become involved or how communications with regulators, customers and business partners should be coordinated.
In other words, there is a significant difference between documenting compliance and achieving operational resilience.
From a legal perspective, that distinction matters.
When an incident occurs, the relevant questions will not necessarily be limited to whether the company had adopted the required policies. They may also concern whether identified risks were appropriately assessed, whether management exercised adequate oversight and whether the organisation acted reasonably in preparing for and responding to the incident.
Cyber resilience should therefore be understood not merely as a regulatory objective, but as a practical test of corporate governance.
Artificial intelligence is making the question more urgent
The rapid adoption of artificial intelligence adds another layer of complexity.
AI is increasingly integrated into business processes, customer interactions, data analysis, software development and cybersecurity operations. In some cases, AI systems are moving beyond generating information towards performing actions with varying degrees of autonomy.
This creates significant opportunities, but also raises questions about control, accountability and risk allocation.
Consider an organisation deploying an AI-powered system capable of accessing internal databases, communicating with external platforms or executing operational tasks.
Who determines the limits of that system’s authority? Who assesses the risks arising from its access to sensitive information? Who is responsible for monitoring its behaviour? And what happens if the system makes a decision or performs an action that results in a security incident, contractual breach or unlawful processing of personal data?
These are not exclusively technical questions.
They require consideration of cybersecurity obligations, data protection requirements, contractual liability, internal governance arrangements and, where applicable, the EU AI Act.
The challenge is particularly significant because organisations may adopt AI tools faster than they develop the governance structures needed to supervise them.
For legal advisers, this calls for a more integrated approach. AI governance, cybersecurity, privacy and contractual risk management should not be treated as entirely separate areas of compliance.
They increasingly concern the same underlying issue: how an organisation maintains meaningful control over the technologies on which it depends.
The legal department must be involved before an incident occurs
Traditionally, lawyers have often become directly involved in cybersecurity matters after something has gone wrong: a personal data breach, a ransomware incident, a regulatory investigation or a dispute with a technology provider.
That reactive approach is no longer sufficient.
Legal teams have an important role to play before an incident occurs, particularly in defining responsibilities, establishing internal governance arrangements and ensuring that cybersecurity obligations are appropriately reflected in contractual and operational frameworks.
This includes reviewing technology and outsourcing agreements, assessing regulatory notification requirements, clarifying the allocation of responsibilities between the company and its service providers, and supporting the development of incident-response procedures.
It also means helping management understand the legal consequences of cybersecurity decisions.
For example, selecting a cloud provider is not simply a question of price, performance and technical security. It may also involve data protection, regulatory requirements, subcontracting arrangements, access to information, business continuity and exit strategies.
Similarly, a decision to deploy an AI solution should consider not only its commercial benefits but also the organisation’s ability to supervise its use and address the risks it creates.
Legal advice becomes most valuable when these issues are considered during the decision-making process, rather than after the relevant risks have materialised.
Cybersecurity as a measure of good governance
There is a broader question behind all these developments.
What does it mean to manage a company responsibly in an economy where almost every important business function depends on digital infrastructure?
In my view, cybersecurity should increasingly be considered alongside other fundamental governance issues, such as financial risk, regulatory compliance, internal controls and business continuity.
This does not mean that directors are expected to become cybersecurity specialists. Nor does it mean that every security incident necessarily indicates a failure of management or gives rise to legal liability.
Cyber threats cannot be eliminated entirely, and the applicable legal standards vary depending on the organisation, its activities and the relevant regulatory framework.
However, management should be capable of understanding the organisation’s principal cyber risks, asking informed questions, allocating appropriate resources and ensuring that credible mechanisms exist to manage and respond to those risks.
This requires an ongoing dialogue between management, IT and security teams, legal advisers and compliance professionals.
It also requires a shift in mindset: from treating cybersecurity as a technical cost to recognising it as an essential element of business resilience and responsible corporate management.
A necessary change in perspective
My main takeaway from participating in BCC2026 is that the most important cybersecurity conversation may no longer be about which technologies organisations should adopt, but about how they should govern the risks arising from their growing dependence on technology.
European regulation is reinforcing this change, but legal compliance alone should not be the ultimate objective.
The real challenge is to build organisations in which cybersecurity responsibilities are clearly allocated, risks are understood at management level and legal, technical and operational functions work together before a crisis occurs.
For businesses, this is increasingly a question of governance, accountability and long-term resilience.
For lawyers, it is also a reminder that understanding technology is becoming indispensable to understanding the legal risks faced by our clients.
Cybersecurity may begin with technology, but responsibility for it cannot end with the IT department.
