NIS2 for Public administration
The area of widest national divergence. Whether regional and local bodies are in scope is a national choice, so the answer differs across the 27.
Which entities are covered
Public administration entities of central government as defined by a member state, and public administration entities at regional level where a member state so provides.
Sub-sectors named in the annex
- Central government
- Regional government where a member state so provides
Scope traps specific to this sector
Trap 1
Local authorities may or may not be in scope depending on the member state — the directive leaves it open.
Trap 2
The size-cap rule does not apply in the usual way: designation drives scope here.
Trap 3
Public hospitals, water utilities and transport authorities can be caught twice, by their sector and by this entry.
What else applies to you
National public-sector security frameworks; the EU Cybersecurity Regulation for Union institutions.
NIS2 rarely arrives alone. Where another EU act covers the same ground and is at least equivalent in effect, article 4 disapplies the corresponding NIS2 provisions — but only those, and only where that test is met.