NIS2 for public administration and local government scope

Does NIS2 apply to public administration and local government?

Central and regional public administration entities are in scope of NIS2 as Annex I, point 10 sectors, but only as each Member State defines them under its national law. Local government and education institutions are not covered automatically. They fall within NIS2 only if the national transposition law extends the Directive to them, which Article 2(5) allows Member States to do, with education institutions carrying out critical research named as a particular case. A public body asking whether NIS2 binds it should therefore start with its national transposition law, not with the Directive text alone.

Two exclusions come before any sector question. Article 2(7) removes public administration entities working in national security, public security, defense or law enforcement from NIS2 altogether, so a body's core mission and its legal classification matter more than its label as a public authority. Central government entities are a different case: under Article 2 they are covered regardless of size and are treated as essential entities. Public bodies should confirm with their national competent authority which of their units are central, which are regional, which are local, and which fall under the security exclusion, and record that decision in writing. Where a unit sits on the boundary, the national definition and the national security exclusion decide the answer, not the Directive alone.

Once a public body is in scope, ask the national authority what enforcement applies to it. Each Member State decides whether public administration entities can be fined under Article 34(7), and the temporary suspension and prohibition measures in Article 32(5) do not apply to them. These limits change the risk profile, but they do not remove the Article 21 risk-management duties or the Article 23 reporting duties that the body would otherwise owe. Confirm the national penalty rules in the text the Member State notified to the Commission, which Article 36 required by 17 January 2025.

How essential and important status applies to each public body type

Central government entities sit in Annex I, point 10, as public administration entities of central governments, and NIS2 treats them as essential regardless of size. That means the classification does not depend on headcount or budget. Because they are essential, they fall under ex ante supervision, where the competent authority can inspect and audit before any incident occurs, rather than only reacting afterwards. The Article 21 risk-management measures and the Article 23 reporting duties apply in full, and the enforcement tools in Article 32 are available to the authority.

Size is irrelevant: a small central body still counts as essential under the directive's size-independent rule.
Ex ante supervision: expect periodic inspections, security audits and information requests before any incident.
Full Article 21 scope: all ten minimum measures apply without a proportionality carve-out from the entity's size.
Reporting clock: the 24-hour early warning, 72-hour notification and one-month final report apply to significant incidents.
Fines are a national decision: the Member State decides whether public administration entities can be fined at all.

Confirm with the national competent authority which bodies it treats as central government entities under national law, and how it applies Article 32 measures to public bodies.

What limits apply to fines and management bans for public bodies

The limits change who decides on fines and which enforcement tools are available to supervisors, while the obligations themselves still apply in full. The four cards below cover what national law decides, when penalty rules were due, which temporary measures are excluded, and where enforcement sits.

Fines set by each Member State

Article 34(7) leaves it to each Member State to decide whether and to what extent public administration entities can be fined. A public body's fining exposure therefore depends on the national transposition law where it is established, and it varies by country, by central and regional level, and by whether local bodies were brought into scope. Check whether your national law allows fines on public entities, which authority can impose them, and whether any fine would be paid from your own budget or by the state. Record the answer so finance and the board plan from the same facts.

Penalty rules notified by 2025

Member States had to notify their penalty rules to the Commission by 17 January 2025 under Article 36. Those national rules are the reference for what a public body actually faces, so leadership should obtain the text of its national penalty provisions and any public-sector clauses within them. Ask the national authority or counsel which provisions apply to your entity type and whether they changed after notification. Keep the answer in the governance file, since it shows the board understood its exposure when it approved the Article 21 measures.

Suspension and prohibition excluded

The temporary suspension and prohibition measures of Article 32(5) do not apply to public administration entities. Supervisors cannot use these tools to halt a public service or bar an official from management functions as a sanction. This removes one lever of pressure, but it does not reduce the duties in Article 21 or the reporting duties in Article 23. Boards should plan service continuity on the assumption that scrutiny will come through audits, information requests and other measures, and should confirm with the national authority which enforcement tools remain available.

Enforcement stays national

Supervision, inspections, security audits, information requests and enforcement remain with the national competent authority of the Member State that established the public body, as set out under Article 26(1). A public body cannot treat supervision as an internal matter, because it must produce evidence to that authority on request. Identify the competent authority now, learn its reporting route and evidence expectations, and assign one named owner for responding. Local bodies and education institutions should confirm whether their Member State has extended NIS2 to them at all before assuming any of these rules apply.

What still applies to a public body even where fines are limited

Limited fines do not mean limited duties. A public administration entity in scope of NIS2 still has to meet the Article 21 risk-management measures, the Article 20 duties of its management body and the Article 23 reporting obligations. What the Member State decides is whether and to what extent public administration entities can be fined (Article 34(7)), and the temporary suspension and prohibition measures of Article 32(5) do not apply to them. Those are enforcement limits, not exemptions from the obligations themselves. Confirm with your national competent authority and your national transposition law which of these duties apply to your body and what supervisory measures remain available.

The practical split is simple to state. The organization owns its controls: the risk analysis, the policies, the management body's approval and oversight, and the decisions about what to accept as residual risk. An implementation partner can prepare systems, configuration baselines, logging, backup and incident handling procedures, and the evidence that shows they work. Only the supervisory authority decides whether that evidence is sufficient, through information requests, inspections, security audits or scans. Ask your national authority which evidence it expects and in what form, because NIS2 does not create a certificate that can be handed over as proof.

Plan for reporting first. Article 23 requires an early warning, an incident notification and a final report on significant incidents, and public bodies should not assume that a lower fine ceiling reduces the reporting clock. Run a tabletop exercise against the 24-hour early warning, confirm who in your body is authorized to submit it, and record which national channel applies. Then check the management body's role under Article 20, including the cybersecurity training it must receive, so that the people who approve the measures can also answer a supervisor's questions about them.

How a public body confirms its NIS2 status step by step

This sequence lets a public body establish, in order, which national law applies, which of its bodies are in scope, which Member State supervises them, and whether each is essential or important, with a written record the management body can approve.

Confirm the national transposition law
Start by identifying the national law that transposes NIS2 in the Member State where the body is established, since the directive binds entities through that law. Legal counsel or the national competent authority's published guidance should confirm which statute applies and how it defines public administration at central, regional and local level. Record the law's title, its date of application and the authority named in it. The step is complete when the legal basis is written down and signed off by the body's legal function, and when the team knows whether the Member State has extended scope to local government or education institutions under Article 2(5).
Map each body against Annex I point 10
List every entity the organization administers, including ministries, agencies, regional authorities, municipalities, and any education or research institutions, and test each one against the public administration category in Annex I point 10 as the national law defines it. Central government and regional public administration fall within that category, while local level depends on the national choice. Record which bodies fall in scope and which do not. The output is an entity register with a stated reason for each decision, reviewed by the legal and governance owners.
Check the Article 2 exceptions
For each body that appears in scope, test the exceptions in Article 2. Bodies working in national security, public security, defense or law enforcement are excluded under Article 2(7). Entities exempted from DORA under Article 2(4) of Regulation (EU) 2022/2554 are excluded under Article 2(10). Also check whether the body is a central government entity, which Article 2 treats as in scope regardless of size, or a critical entity under Directive (EU) 2022/2557. The output is a documented exception analysis per body, with the legal reasoning attached, so an authority can follow each conclusion.
Establish jurisdiction under Article 26(1)
For each in-scope body, confirm the Member State with jurisdiction. Article 26(1) places public administration entities under the Member State that established them, so a body set up under one national law generally answers to that state's authority even if it serves citizens elsewhere. Check whether any body has cross-border establishment or operations that could raise a question about which authority supervises it. Record the jurisdiction decision and the name of the competent authority. The step is complete when each in-scope body has a named supervising authority and the decision is confirmed by legal counsel.
Record the essential or important classification
Classify each in-scope body as essential or important under Article 3(1). Central government entities and critical entities under Directive (EU) 2022/2557 are essential regardless of size, and the national law may set further rules for regional bodies. Document the basis for each classification, because essential entities face ex ante supervision and important entities face ex post supervision under Articles 32 and 33. The output is a classification table listing each body, its category, the legal basis and the supervision regime it triggers.
Confirm the supervisory authority and penalty regime
Confirm the national competent authority that will supervise each body and the penalty rules that apply to public administration. Each Member State decides whether and to what extent public administration entities can be fined under Article 34(7), and the temporary suspension and prohibition measures of Article 32(5) do not apply to them. Ask the authority for its published guidance on public bodies and record the enforcement tools available. The output is a supervision note for each body that states the authority, the regime and the measures that do not apply.
Document the outcome for the management body
Assemble the outputs of the previous steps into one submission for the management body: the legal basis, the entity register, the exception analysis, the jurisdiction decisions, the classification table and the supervision notes. The management body needs to approve these findings and understand its duties under Article 20, which apply to the Article 21 measures. Record the date of approval and the named owner for each body. The step is complete when the management body has formally adopted the status record and the owner has a schedule to revisit it when the national law, the entity structure or the proposed NIS2 amendments change.

What to ask the national authority before planning the program

Public bodies often find that the national transposition law leaves key choices to the Member State. Written answers from the national competent authority settle those choices before budgets and roles are fixed. The cards below cover the questions that most change scope, penalties and supervision for public administration.

Regional and local definitions

Annex I point 10 covers central and regional public administration as each Member State defines them in national law. Ask the authority which bodies in your region fall under the regional definition, and whether a list or register of covered entities exists. Request the exact statutory provision, since a body's status often depends on its legal form and founding act rather than its function.

Local government extension

NIS2 lets Member States extend the Directive to public administration at local level and to education institutions, in particular those carrying out critical research. Ask whether your country has used that option, for which municipalities or institutions, and from what date. If the extension is not yet adopted, ask whether a consultation or timetable has been published.

Penalties for public bodies

Each Member State decides whether public administration entities can be fined at all. Ask the authority whether administrative fines apply to public bodies in your sector, and how the penalty rules notified to the Commission treat them. Also confirm which temporary suspension or management prohibition measures are excluded for public administration, because those exclusions change how management liability is planned.

Supervisory regime and jurisdiction

Public administration entities fall under the Member State that established them, and the supervisory regime depends on whether the body is essential or important under national law. Ask which authority supervises your body, whether supervision is ex ante or ex post, and who acts as the contact point for incident reports. Ask for the jurisdiction answer in writing before assuming it matches a neighboring authority's practice.

National security and defense carve-outs

NIS2 does not apply to public administration entities working in national security, public security, defense or law enforcement. The line between covered and excluded units is drawn by national rules, so mixed bodies may be partly in scope. Ask the authority to confirm in writing which units or activities are excluded, and whether any sector-specific law displaces NIS2 for your body.

Written answers and records

Verbal guidance from a ministry or regulator rarely survives a later inspection. Request written answers that cite the transposition law, date the answer and name the responsible unit. File them with the scope decision so that the program's assumptions can be shown to a supervisor and revisited when the law or the proposed amendments change.

Frequently asked questions about NIS2 for public bodies

Is a municipality covered by NIS2?

Not automatically. NIS2 covers public administration at central government level and at regional level, as each Member State defines them under national law. Local government is outside the baseline, but Member States may extend NIS2 to public administration entities at local level under Article 2(5). Whether your municipality is in scope therefore depends on the national transposition law where it is established. Check the national law, the national competent authority's guidance and any list of covered bodies the authority publishes. A municipal entity that provides services that fall under another listed sector, such as drinking water, may be covered under that sector instead, so review the sector pages as well.

Can fines be imposed on a public body under NIS2?

Each Member State decides whether and to what extent public administration entities can be fined under Article 34(7). Some national laws may allow fines, others may limit them, and some may rely on other supervisory tools. Member States had to notify their penalty rules to the Commission by 17 January 2025 under Article 36, so the applicable rules are in the national penalty provisions. Separately, the temporary suspension and prohibition measures in Article 32(5) do not apply to public administration entities. Ask the national authority which enforcement measures it can use against your body and how it applies them to public sector entities.

Does the national security exclusion cover a whole authority?

No, not by default. Article 2(7) excludes public administration entities that work in national security, public security, defense or law enforcement, but the exclusion is tied to those activities rather than to the legal form of the body. An authority with mixed functions needs to decide which activities fall inside the exclusion and which do not, and document that decision. Member States set the detail in national law, so the boundary should be confirmed with the national competent authority or the relevant ministry. Keep the scoping decision and its reasoning in writing, because a supervisor may ask for it.

What effort should a public body plan for in NIS2 readiness?

The effort depends on the entity's scope, its existing security program and the national rules that apply. Work out first whether you are in scope and under which Annex and classification, because that determines which obligations apply. The main drivers are the number of systems and services covered, the state of current risk management, the management body's time for approvals and training under Article 20, and the reporting process required by Article 23. Treat the Article 21 measures as the core of the work. No supplied source gives a standard duration or budget for public bodies, so ask the national authority for guidance and compare any consultant quote against a written scope that lists deliverables, systems and responsibilities.

Can an implementation partner certify that our public body complies with NIS2?

No. NIS2 creates no certificate of compliance, and no implementation partner can issue one. The organization owns its controls and its compliance decisions. DeployOpen prepares systems, controls and evidence for an assessment, and national competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines under Articles 32 to 34. Where a national scheme or contract asks for an independent assessment, that assessor must be independent of the implementation work. Confirm with your authority which evidence it expects and who may perform any independent review it accepts.

Do public bodies face management bans under NIS2?

Public administration entities are excluded from the temporary suspension and prohibition measures in Article 32(5), so a national authority cannot use those measures against them. That exclusion covers the body itself. Management body duties under Article 20, including approving and overseeing the Article 21 measures, still apply to the governing bodies of in-scope public entities. Check how your national law implements these duties and what sanctions, if any, apply to officials personally. Confirm the answer with national counsel before relying on it.

How an implementation partner fits into a public body's program

The public body owns its NIS2 program. Its management body approves and oversees the Article 21 measures, and its own staff decide what risks to accept, which controls apply and who answers to the competent authority. An implementation partner works inside that structure. DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the body's own infrastructure, and prepares the systems, configurations and evidence that the body's controls depend on. The work runs under a fixed-scope written agreement that sets the scope, deliverables and timelines before any work starts, so the body can see what it is buying and who is responsible for each output.

The boundary matters as much as the work. DeployOpen does not issue audit reports, attestations or certificates, and NIS2 creates no certificate of compliance in any case. Compliance is evaluated by the national competent authority or an independent assessor the authority or the body engages, through inspections, security audits, security scans and information requests. Hiring an implementation partner does not guarantee a supervisory outcome, and a body should not present a partner's documentation as an independent finding. Ask any partner to state in writing which deliverables are prepared for the body's own review and which, if any, the body must obtain from a third party.

Before signing, a public body should confirm three points: which controls and evidence the partner will produce, who inside the body signs off each deliverable, and how handover works after the engagement ends. Confirm with your national competent authority or the national transposition law how it expects public administration entities to demonstrate compliance, since national rules decide whether and to what extent fines apply. Ongoing support, upgrades and continuous testing can be added through a retainer, but the body should decide in advance which of these it needs to keep its program current.

How DeployOpen scopes and prepares NIS2 evidence for public bodies

DeployOpen works on NIS2 for public administration and local government as an implementation partner. We prepare systems, controls and evidence inside your own infrastructure, while your organization owns its controls and management decisions and only an independent authority or assessor reviews compliance.

How we scope

Confirm which public bodies in your organization fall under national central or regional rules and which are subject to a Member State option.
Record the national security, defense, law enforcement and public security boundaries that may exclude specific bodies or systems from NIS2.
Agree deliverables, systems in scope and timelines in writing before any work starts, as engagements are fixed-scope.

How we build

Implement and harden self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks against the Article 21 measures.
Configure logging, access control, backup and vulnerability management so each control produces dated, reviewable records for supervisors.
Test applications, APIs and infrastructure in scope, and document the findings, fixes and retest results for your management body.

How we hand over

Deliver a control-by-control evidence map showing where each measure is implemented, who owns it and where the proof is stored.
Document runbooks for incident detection and the 24-hour, 72-hour and one-month reporting steps, so your own staff can operate them.
Provide training material for management body members and agree which responsibilities stay with your internal security and legal teams.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer, with scope and response terms written into the agreement.
Keep documentation current as national transposition rules, supervisor expectations and ENISA guidance change.
Confirm with your national competent authority and your legal counsel which obligations apply to your specific public body.

NIS2 for public administration and local government