Corporate governance framework: who decides and who supervises?

A corporate governance framework is the set of rules that determines who in your company decides what, who supervises, and how directors account for their decisions. In the Netherlands most of that framework is laid down by law in Book 2 of the Dutch Civil Code (Burgerlijk Wetboek, BW); the Dutch Corporate Governance Code adds binding “comply or explain” rules only for listed companies.

For a private company (bv) the framework is mainly the articles of association, the shareholders’ agreement and a few internal rules. For a listed or large company it also includes a supervisory structure, committees and extensive reporting duties. Below we explain the legal building blocks, the choices you can make and the steps to put a workable framework in place.

Why does a governance framework matter?

A clear framework prevents disputes about authority and protects directors against liability. It also shows investors, banks and regulators that decisions are taken with care.

Under Dutch law, directors must perform their duties properly (Article 2:9 BW). If a decision goes wrong, the question is whether the director acted with due care, took the right information into account and respected the internal rules. A framework that records who decides what, and on what basis, is the best evidence that this was the case.

What does Dutch law say about the company interest?

Directors must act in the interest of the company and its business (vennootschappelijk belang). That is not only the interest of the shareholders.

The Supreme Court (Hoge Raad) confirmed in the Cancun judgment (ECLI:NL:HR:2014:797) that directors must take into account the interests of all those involved in the company, such as shareholders, employees and creditors. While serving the company interest, directors must avoid harming those stakeholders unnecessarily or disproportionately.

One-tier or two-tier board: which structure fits?

Dutch law allows both. In a two-tier structure a management board runs the company and a separate supervisory board (raad van commissarissen) supervises it; in a one-tier structure executive and non-executive directors sit together on one board.

The two-tier board

The two-tier board is the traditional Dutch model. The management board (bestuur) manages the company. The supervisory board supervises the management and the general course of affairs and advises the management board.

Supervisory directors must also act in the company interest. They are not representatives of the shareholders who appointed them. Their duty is to supervise independently, to ask critical questions and to be properly informed.

The one-tier board

Since 1 January 2013 a bv or nv can opt for a one-tier board (Article 2:129a and Article 2:239a BW). Executive directors manage the company; non-executive directors supervise.

The law requires that the chair of a one-tier board is a non-executive director, and that the division of tasks is recorded in the articles of association or board rules. The one-tier model is often chosen by international groups that are familiar with it, but it requires clear agreements on information and responsibility. In principle all directors share collective responsibility, which makes a proper division of tasks important for the non-executive directors.

When is a supervisory structure mandatory?

For most private companies a supervisory board is optional. It becomes mandatory under the large company regime (structuurregime) when a company meets the statutory criteria for three consecutive years.

Those criteria are, in short: issued capital and reserves above a statutory threshold, a works council established under a legal obligation, and at least 100 employees in the Netherlands (Articles 2:153 and 2:263 BW). A company within the regime must have a supervisory board or a one-tier board with comparable powers. The supervisory board then gains powers, such as appointing and dismissing directors in the full regime, and the works council gets a right to recommend a third of the supervisory directors. There are exemptions and a mitigated regime for certain international groups.

Who decides what: shareholders, board and supervisors?

The general meeting (algemene vergadering) appoints and dismisses directors, adopts the annual accounts and decides on amendments to the articles. The board manages the company and represents it.

For a bv, the general meeting must meet, or decide in writing, at least once a year (Article 2:218 BW); for an nv the annual meeting must be held within six months of the end of the financial year (Article 2:108 BW). The articles can give the general meeting the power to give instructions to the board. The board must follow those instructions unless they conflict with the company interest (Article 2:239(4) BW).

Most frameworks add a list of reserved matters: decisions that need prior approval of the general meeting or the supervisory board. Examples are acquisitions above a set amount, taking on significant debt, entering into new markets and appointing senior management. Such approval rights work internally. Towards third parties, a director who is authorised to represent the company can generally still bind it, even without internal approval (Article 2:240(3) BW). Our article on the shareholders’ agreement explains how shareholders can record further arrangements between themselves.

How do you record decision rights?

Put the basic rules in the articles of association and the details in board rules and an approval matrix. That keeps the articles stable while day-to-day rules can be adjusted.

A practical approval matrix sets out, per type of decision, who prepares it, who decides and who must approve it, with monetary thresholds and co-signing rules. It also records how conflicts are dealt with and how decisions are minuted. Minutes and decision memos are your evidence later that the board acted with care.

What duties do directors have?

Directors must perform their duties properly, act in the company interest and stay out of decisions in which they have a conflicting personal interest. Breach of those duties can lead to personal liability.

Conflicts of interest

A director with a direct or indirect personal interest that conflicts with the company interest may not take part in the deliberations and decision-making (Article 2:129(6) and Article 2:239(6) BW). If no board decision can be taken as a result, the supervisory board decides or, if there is none, the general meeting, unless the articles provide otherwise.

Transactions with related parties, such as a director’s own company or a major shareholder, deserve a separate procedure. Record who declared the interest, who decided and on what terms. For listed companies, the law adds specific rules on material related-party transactions.

Liability of directors

A director is liable towards the company only if he or she can be seriously blamed (ernstig verwijt) for improper performance of duties. Towards third parties and in bankruptcy, stricter rules can apply.

In bankruptcy, directors can be held jointly liable for the deficit if they clearly performed their duties improperly and this is an important cause of the bankruptcy (Article 2:248 BW). Failing to keep proper accounts or to file the annual accounts on time creates a legal presumption that the duties were improperly performed. A private company can only make distributions to shareholders if the board approves them and the company can continue to pay its debts afterwards (Article 2:216 BW). Our articles on liability of directors and on financial security within corporate law discuss these risks in more detail.

A good framework reduces these risks. It documents what information the board had, how risks were assessed and who approved the decision. A discharge (decharge) by the general meeting only covers facts that were apparent from the annual accounts or otherwise disclosed to the meeting, and directors’ and officers’ insurance usually excludes intentional misconduct.

How do you organise risk management and internal control?

The board is responsible for identifying the main risks and for controls that keep them within acceptable limits. The supervisory board or non-executive directors supervise this.

Many companies use recognised models, such as COSO for internal control, ISO 31000 for risk management and the three lines model, in which management owns the risks, a compliance function sets policy and internal audit gives independent assurance. For listed companies, best practice provision 1.4.3 of the Dutch Corporate Governance Code requires an in-control statement in the management report.

For a smaller company, a simpler system works: separation of duties for payments, a four-eyes principle above a set amount, a monthly financial close and a short risk register with owners. The key point is that the board can show it knew the main risks and acted on them.

What should you arrange for integrity and whistleblowing?

Employers with 50 or more employees must have an internal reporting procedure for suspected wrongdoing under the Whistleblowers Protection Act (Wet bescherming klokkenluiders). Reporters are protected against retaliation.

A code of conduct sets out the rules on conflicts of interest, gifts and anti-bribery. A reporting channel only works if people trust it. That requires confidential handling, a clear procedure for investigation and a board or committee that follows up on reports and on the lessons learned.

What role do the works council and other stakeholders play?

A company with 50 or more employees in the Netherlands must set up a works council (ondernemingsraad) under the Works Councils Act (Wet op de ondernemingsraden, WOR). The works council has a right to be consulted on important economic decisions and a right of consent on important employment rules.

The right of advice covers decisions such as a transfer of control, a reorganisation, a significant investment or the appointment or dismissal of a director (Article 25 and Article 30 WOR). The advice must be requested at a stage when it can still influence the decision. The right of consent covers arrangements such as pension, working hours and personnel monitoring systems (Article 27 WOR). Build these rights into the planning of decisions, not as an afterthought.

Shareholders exercise their rights at the general meeting. Listed companies also maintain an investor dialogue. Banks and other financiers often have information and approval rights under the loan documentation, which should be reflected in the approval matrix.

What reporting duties apply?

Every bv and nv must prepare annual accounts and, depending on its size, a management report, and file them with the Chamber of Commerce (KvK). Larger companies must also have the accounts audited.

For a bv, the board prepares the annual accounts within five months of the end of the financial year; the general meeting can extend this by up to five months (Article 2:210 BW). After adoption, the accounts must be filed with the KvK within eight days, and in any event within twelve months of the end of the financial year. Late filing can lead to a fine and, in bankruptcy, to the presumption of improper management mentioned above.

Sustainability reporting under the EU Corporate Sustainability Reporting Directive (CSRD) applies to large and listed companies. Its scope and timetable were changed by the EU in 2025, so check whether and when your company falls within it.

When does the Dutch Corporate Governance Code apply?

The Code applies to listed companies with their registered office in the Netherlands. They must state in their management report whether they comply with its principles and best practice provisions and explain any deviation.

This “comply or explain” duty has a statutory basis in Article 2:391 BW and the related decree on the content of the management report. The current version of the Code dates from December 2022 and gives more attention to sustainable long-term value creation, diversity and the culture of the company. The Monitoring Committee Corporate Governance reports on how companies apply it.

Unlisted companies are not bound by the Code, but many use it as a reference, for example when they prepare for investors or a sale. Pick the elements that fit your size rather than copying the whole Code.

Diversity on the board

Since 1 January 2022, the supervisory board of a listed nv must consist of at least one third men and at least one third women. An appointment that does not meet this is void.

Large nvs and bvs must also set appropriate and ambitious targets for the gender balance on their board, supervisory board and senior management, draw up a plan to achieve them, and report on this annually to the Social and Economic Council (SER).

Which EU rules affect governance?

Besides Dutch company law, several EU rules place responsibilities directly with the board. The most important concern data protection, cybersecurity and artificial intelligence.

• The General Data Protection Regulation (GDPR) requires the company to be able to demonstrate compliance, to appoint a data protection officer in certain cases and to report data breaches to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours.
• The NIS2 Directive, implemented in the Netherlands through the Cybersecurity Act (Cyberbeveiligingswet), requires entities in scope to take cybersecurity measures that the management body approves and oversees.
• The EU AI Act, which entered into force on 1 August 2024 and applies in phases, sets duties for companies that develop or use AI systems, depending on the risk level.

Assign responsibility for each of these areas to a named board member and make sure the board receives regular reports.

How do you tailor governance to your company?

Keep the framework proportionate. A start-up needs clear decision rights and basic controls; a group with foreign subsidiaries needs a common baseline with local additions.

Groups and cross-border operations

In a group, the parent company sets the baseline policies and the reserved matters. Each subsidiary’s board must still act in the interest of its own company.

That tension matters in practice. An instruction from the parent that harms the subsidiary, for example by moving assets out of it, can expose the subsidiary’s directors to liability. Keep a central entity register with directors, signatories and filing dates, and make sure local boards actually meet and decide.

Foundations and associations

Since 1 July 2021, the Management and Supervision of Legal Entities Act (Wet bestuur en toezicht rechtspersonen, WBTR) has applied similar rules on duties, conflicts of interest and liability to foundations and associations.

What should you check as a director?

As a director you carry personal liability under Articles 2:9 and 2:248 BW, so check that the framework protects you in practice:

• Do you know which decisions need prior approval under the articles or the shareholders’ agreement, and is that approval recorded?
• Have you declared every conflicting personal interest and stayed out of that decision (Article 2:239(6) BW for a bv)?
• Are board decisions minuted, with the information on which they were based?
• Are the annual accounts prepared and filed with the KvK within the statutory deadlines?
• Has the works council been asked for advice in time on decisions listed in Article 25 WOR?

What should you check as a shareholder?

As a shareholder you exercise your influence through the general meeting and the documents you sign, so check:

• Which decisions the articles reserve for the general meeting, and whether you can give the board instructions (Article 2:239(4) BW).
• Who appoints and dismisses directors and supervisory directors, and whether the large company regime limits that right.
• What information rights you have between meetings, under the law or the shareholders’ agreement.
• Whether distributions are tested against the distribution test of Article 2:216 BW before you receive them.
• How deadlock and exit are resolved, for example by a transfer clause or an inquiry procedure (enquêteprocedure) at the Enterprise Chamber.

What can we do for you with your governance framework?

Our corporate law team sets up and reviews governance for Dutch and international companies:

• We review your articles of association and shareholders’ agreement against Book 2 BW and your actual decision-making.
• We draft board rules, an approval matrix and a conflict-of-interest procedure.
• We assess whether the large company regime applies and which exemption or mitigated regime is available.
• We plan the works council’s advice and consent rights into major decisions such as a reorganisation or sale.
• We advise directors on personal liability exposure before a high-risk decision is taken.

Summary

• A corporate governance framework sets out who decides, who supervises and how directors account for their decisions.
• In the Netherlands the core rules are in Book 2 BW; the Dutch Corporate Governance Code applies to listed companies on a comply-or-explain basis.
• Directors must act in the company interest, which includes the interests of employees, creditors and other stakeholders.
• You can choose between a two-tier and a one-tier board; the large company regime makes supervision mandatory.
• Record authority in the articles, board rules and an approval matrix, and involve the works council in time.

The statutory rules can be found in Book 2 of the Dutch Civil Code.

Frequently asked questions