NIS2 for Public administration
Who is covered is settled in national law twice over: the member state defines which entities are central-government and regional public administration (Annex I, point 10), and may extend the directive to public administration entities at local level (art. 2(5)(a)).
Which entities are covered
Public administration entities of central governments as defined by a member state in accordance with national law; public administration entities at regional level as defined by a member state in accordance with national law. A public administration entity is one recognised as such under national law that meets the criteria of article 6(35)(a) to (d), not including the judiciary, parliaments or central banks.
Sub-sectors named in the annex
None. Annex I divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
Public administration entities of central government are in scope and essential whatever their size (art. 2(2)(f)(i), 3(1)(d)). Entities at regional level are in scope whatever their size where, following a risk-based assessment, they provide services the disruption of which could have a significant impact on critical societal or economic activities (art. 2(2)(f)(ii)); article 3(1)(d) does not name them, so they are important (art. 3(2)) unless another point of article 3(1) applies. Read literally, point (a) would make one above the medium-sized ceilings essential; whether the enterprise thresholds of Recommendation 2003/361/EC fit a public administration body is not settled by the text. Each member state lays down whether and to what extent administrative fines may be imposed on public administration entities (art. 34(7)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
A regional entity is not covered by being regional: article 2(2)(f)(ii) brings it in where, following a risk-based assessment, it provides services whose disruption could have a significant impact on critical societal or economic activities.
Trap 2
The directive does not apply to public administration entities that carry out their activities in the areas of national security, public security, defence or law enforcement (art. 2(7)). Recital 8 confines this to entities whose activities are predominantly in those areas, and entities with regulatory competences are not excluded on the law-enforcement ground.
Trap 3
Jurisdiction lies with the member state which established the entity (art. 26(1)(c)).
What else applies to you
Directive (EU) 2022/2557 (CER), whose annex also lists public administration entities of central governments (point 9), for those identified as critical entities.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.