NIS2 for Public Administration — Your sector in the annexes: public administration entities, word for word

In this lesson

Quote the two types of entity of Annex I, point 10, and explain what the words “as defined by a Member State in accordance with national law” leave to national law.
Test a public body against the definition of article 6(35): national recognition, the three bodies the definition leaves out, and the four criteria.
Tell a public administration entity apart from a publicly owned company, a court, a parliament, a central bank, a municipality or a university, and route each to the right provision.
Build the register of bodies that a ministry or a regional authority needs before it can answer the scope question.

The entry, word for word

Annex I of Directive (EU) 2022/2555 lists the “SECTORS OF HIGH CRITICALITY” in three columns: sector, subsector and type of entity. Point 10, public administration, has no subsector. It names two types of entity:

Sector	Type of entity
10. Public administration	“Public administration entities of central governments as defined by a Member State in accordance with national law”
10. Public administration	“Public administration entities at regional level as defined by a Member State in accordance with national law”

Three features set this entry apart.

No other Union act defines the type. Rows such as those for gas define a type by reference to another act, for example “Distribution system operators as defined in Article 2, point (6), of Directive 2009/73/EC”. Point 10 refers to no other act. It uses a term that NIS2 defines itself, in article 6(35), and hands the boundary of “central governments” and of the “regional level” to national law.
No local level. The entry stops at the regional level. Municipalities and other local bodies are not an Annex I type; article 2(5)(a) lets a member state bring them in, as lesson 1.2 explains.
Two lines, two regimes. The annex places the two types side by side, but the scope and classification rules treat them differently. Central government is in scope whatever its size and is essential; the regional level is brought in by article 2(2)(f)(ii) following a risk-based assessment, and article 3(1) does not name it among the essential entities. Lesson 1.2 works through both.

What “as defined by a Member State” does

Art. 2(2)(f)

The scope provision repeats the formula. Article 2(2)(f) applies the directive, regardless of size, where the entity is a public administration entity:

“(i) of central government as defined by a Member State in accordance with national law; or”
“(ii) at regional level as defined by a Member State in accordance with national law that, following a risk-based assessment, provides services the disruption of which could have a significant impact on critical societal or economic activities.”

The formula does two things. First, it makes the boundary a national question: which ministries, agencies and other bodies form central government, and which tier counts as regional, is answered by national law, not by the directive. Second, it does not make the type optional: once a body is a public administration entity of central government under that national definition, article 2(2)(f)(i) applies the directive to it with no further assessment; only the exclusion of article 2(7) can take it out.

A ministry therefore cannot answer the scope question from the directive alone. It needs the national transposition act and the national definition. Both differ across the member states and change over time, so this course states none of them: start from the transposition tracker and your country page under /nis2/.

The definition of article 6(35)

Art. 6(35)

Article 6(35) defines a ‘public administration entity’ as “an entity recognised as such in a Member State in accordance with national law, not including the judiciary, parliaments or central banks, which complies with the following criteria:”

“it is established for the purpose of meeting needs in the general interest and does not have an industrial or commercial character;”
“it has legal personality or is entitled by law to act on behalf of another entity with legal personality;”
“it is financed, for the most part, by the State, regional authorities or by other bodies governed by public law, is subject to management supervision by those authorities or bodies, or has an administrative, managerial or supervisory board, more than half of whose members are appointed by the State, regional authorities or by other bodies governed by public law;”
“it has the power to address to natural or legal persons administrative or regulatory decisions affecting their rights in the cross-border movement of persons, goods, services or capital;”

Read it in three steps.

1. National recognition. The directive does not create the category; it borrows the national one and then narrows it.

2. Three bodies left out. The definition does not include “the judiciary, parliaments or central banks”. A court, a parliament and a central bank are therefore not public administration entities for NIS2, whatever their national status, and point 10 does not reach them.

3. Criteria (a) to (d). The entity must comply with “the following criteria”, and the list joins them without an “or”: read them together. Inside criterion (c), by contrast, the text offers three alternatives joined by “or”.

(a) General interest, no industrial or commercial character. A state-owned company that sells on a market fails this criterion. It is not a public administration entity, although it may be in scope through its own sector, such as energy or transport.
(b) Legal personality, or acting for an entity that has it. The second limb covers, for example, a ministry that has no legal personality of its own but is entitled by law to act on behalf of the State.
(c) Public financing, supervision or appointments. Any one of the three alternatives is enough: majority public financing, management supervision by public authorities, or a board more than half of whose members are publicly appointed.
(d) Decision-making power. How broadly this criterion is read is for national law and the transposition. Record your reading and the decisions you rely on, rather than assume it.

Who is outside point 10, and where they go

Art. 2(1), 2(5), 2(7)

Body	Under point 10?	Where it stands
Ministry or central government agency recognised under national law and meeting article 6(35)	Yes, first type	In scope regardless of size (Art. 2(2)(f)(i)); essential (Art. 3(1)(d))
Regional authority, as nationally defined	Yes, second type	In scope following a risk-based assessment (Art. 2(2)(f)(ii))
Municipality or other local body	No	Only if the member state so provides (Art. 2(5)(a))
Courts, parliaments, central banks	No	Left out of the definition (Art. 6(35))
Public administration entity carrying out its activities in national security, public security, defence or law enforcement	No	The directive does not apply to it (Art. 2(7))
Publicly owned company with an industrial or commercial character	No: fails criterion (a)	Its own sector, if any, under the size rule, where the rule that public control of 25 % or more prevents SME status is set aside (Art. 2(1), second subparagraph)
School or university	No	Only if the member state applies the directive to “education institutions, in particular where they carry out critical research activities” (Art. 2(5)(b)); the research organisation type of Annex II “does not include educational institutions” (Art. 6(41))

One point deserves emphasis: public ownership does not make a body a public administration entity. A municipally owned water utility or a state-owned hospital company is assessed under its own sector, with its own size and class. Whether a particular body also meets the four criteria of article 6(35) is a separate question, decided on the national definition and on the facts.

Build the register before you answer

Art. 3(3)-(4)

Under article 3(4), member states require essential and important entities to submit at least their name, contact details and, “where applicable, the relevant sector and subsector referred to in Annex I or II”. A government that has never mapped its own perimeter cannot do that reliably. In practice, start with a register with one line per body that acts in its own name, and these columns:

the legal basis of creation, and the national provision that recognises the body as public administration;
the tier: central, regional or local, under the national definition;
criteria (a) to (d) of article 6(35), each with the evidence relied on;
whether the body is a court, parliament or central bank, or carries out its activities in the areas of article 2(7);
any other Annex type the body also matches, for example a trust service it provides;
the conclusion, the provision it rests on, the date and the reviewer.

The register is a practice tool, not a legal requirement, but every later answer depends on it.

In practice

Fictional case. The National Vehicle Registry Agency is a fictional central government agency of a fictional member state, with 900 staff. National administrative law lists it among the bodies of central government. Its register line reads:

(a) created by statute to keep the national vehicle register; no market activity. Met.
(b) no separate legal personality; acts on behalf of the State under its founding statute. Met through the second limb.
(c) financed from the State budget. Met.
(d) registers and deregisters vehicles, including vehicles brought in from other member states, by administrative decision. Met, on the agency's reading, which its legal service has documented.

Conclusion: a public administration entity of central government under Annex I, point 10, in scope under article 2(2)(f)(i). Its 900 staff play no part in that answer. The agency also owns a company that sells personalised number plates. That company has a commercial character, fails criterion (a), and gets its own register line, with its own sector and size test. The government shared service centre that runs the agency's data centre is a separate body; whether it is itself a public administration entity is decided on its own line, not inferred from the agency's.

What a supervisor will ask

On which national definition of central government or regional level do you rely? The provision cited in your register, with the date it was checked.
How did you apply article 6(35)? The register line, criterion by criterion, with the evidence for criterion (d).
Which bodies did you leave out, and why? The excluded lines: subsidiaries with a commercial character, bodies in the article 2(7) areas, local bodies.
Who maintains the register? The owner, the review date and the trigger for a review, such as a reorganisation of government.

Key points

Annex I, point 10, names two types: public administration entities of central governments, and at regional level, each “as defined by a Member State in accordance with national law”.
National law draws the boundary of central government and of the regional level; it does not make the central government type optional.
Article 6(35) requires national recognition, leaves out the judiciary, parliaments and central banks, and sets four criteria, (a) to (d).
Public ownership is not the test: a body with an industrial or commercial character fails criterion (a) and is assessed under its own sector.
Local bodies and education institutions are outside point 10 unless a member state uses article 2(5).