Andorra’s Llei 22/2022 of 9 June applies to essential and important entities in the sectors of its annexes (energy, banking, health, digital infrastructure and others) with 50 people or ten million euros, and to some of any size. It requires risk management, a security delegate and incident notification. A reform is in draft.
Which law is it and since when does it apply?
Its official name is Llei 22/2022, del 9 de juny, de mesures per a la seguretat de les xarxes i dels sistemes d’informació (Law 22/2022 of 9 June on measures for the security of networks and information systems). The Consell General (Andorra’s parliament) passed it on 9 June 2022 and it was published in the BOPA (Butlletí Oficial del Principat d’Andorra, Andorra’s official gazette) no. 76 on 22 June 2022. It entered into force the following day, 23 June 2022, but the chapter on supervision and the penalties regime do so two years after that entry into force, that is, on 23 June 2024 (fourth final provision). The explanatory memorandum says it is based on Directive (EU) 2016/1148, the first EU network security directive, adapted to Andorra.
Three bodies are involved. The national cybersecurity agency (Agència Nacional de Ciberseguretat, ANC-AD) supervises most sectors and is the national point of contact. The Andorran financial authority (Autoritat Financera Andorrana, AFA) supervises financial entities and financial markets. CSIRT-AD is the incident response team that receives the notifications (Articles 6 and 8).
Who does it apply to?
The law distinguishes between essential entities (Annex I) and important entities (Annex II).
- Essential: energy, transport, financial entities, financial markets, healthcare (including hospitals, private clinics and primary care centres), water, public administration and digital infrastructure: providers of DNS, cloud computing, data centres, content delivery networks, trust services and electronic communications.
- Important: waste management, postal and courier services, chemicals, food, manufacture of certain products (medical, computer, electrical, machinery, vehicles) and digital service providers (online marketplaces, search engines, social networks).
Size also counts. As a general rule, the law applies to entities with 50 people or more, or with more than ten million euros in turnover or balance sheet total (Article 2.1). There is no minimum size for electronic communications networks and services, trust services, top-level domain registries and DNS providers, or for public administration (Article 2.2).
Tourism, retail and professional services do not appear as a sector in the annexes. That does not mean they are left out: an essential or important entity must manage the security of its suppliers and make sure they meet the necessary measures (Articles 12.1, 13.3.e and 14.1.a). A hotel, a law firm or a shop that works for a bank or a clinic may receive requests for documentation, even if the law does not bind it directly.
The ANC-AD must establish the list of essential and important services (Article 6.4.b) and keep a register of entities (Article 25.4.b). We have not found the notice with that list in an official source; check directly with the ANC-AD.
What the law asks of an essential or important entity
- Identify itself to the competent authority and keep its details up to date (Article 10).
- Manage risks with proportionate technical and organisational measures: security policy, incident management, continuity, supply chain security, testing and auditing, cryptography (Articles 12 and 13). The measures are formalised in a statement of applicability that is reviewed every three years and refers to the National Security Scheme (Esquema Nacional de Seguretat); we have not found the published text of that scheme.
- Appoint an information security delegate and a deputy, and communicate their contact details within one month (Article 18). The delegate may be a member of staff or act under a services contract (Article 18.7).
- Notify significant incidents to CSIRT-AD: an initial notification within 24 hours of becoming aware of the incident, intermediate notifications if requested, and a final report within one month (Article 15.4). Article 15.1 also sets a limit of 72 hours. CSIRT-AD’s instructions for resolving the incident are binding (Article 14.1.b).
- Involve management. The management body approves the risk measures, supervises their application, is accountable for them and takes regular training (Article 17).
An incident is significant if it has caused or may cause substantial operational disruption or financial loss, or if it affects other natural or legal persons causing considerable harm (Article 15.3). Notifying does not replace a criminal complaint (Article 15.7) or any communications required to other bodies (Article 15.11), such as notifying the Andorran Data Protection Agency of a personal data breach (Article 36 of Llei 29/2021, Andorra’s data protection law).
Supervision and penalties
Essential entities can be inspected and audited periodically; important ones after the fact, if there are signs of non-compliance (Articles 23 and 24). If an essential entity does not carry out the measures required of it, the authority may suspend its certification and temporarily prohibit the responsible persons from exercising management functions.
The fines are as follows (Article 36):
| Seriousness | Amount |
|---|---|
| Very serious | €30,001 to €100,000 |
| Serious | €15,001 to €30,000 |
| Minor | warning, or €500 to €15,000 |
Very serious infringements include, among others, failing to send identification information, failing to correct deficiencies after a formal notice, repeatedly (from the second time) failing to comply with the notification of incidents with significant disruptive effects, and failing to resolve incidents with that effect (Article 34.2). To grade them, intent, damage, number of users affected and turnover are taken into account, among other factors (Article 37).
Comparison with NIS2 for companies that also operate in the EU
Andorra is not in the EU, so Directive (EU) 2022/2555 (NIS2) is not Andorran law. It replaced the 2016 directive, had to be transposed before 17 October 2024 and applies from 18 October 2024 (Article 41), with a law in each Member State.
| Llei 22/2022 (Andorra) | NIS2 (EU) | |
|---|---|---|
| Who | Essential and important entities in the annexes, with 50 people or ten million euros; no minimum in telecommunications, trust services, DNS and domain registries | Entities in Annexes I and II that are medium-sized or large enterprises; no minimum in the same cases and some more (Article 2) |
| Notification | Initial within 24 hours, final report in one month (and a 72-hour limit in Article 15.1) | Early warning within 24 hours, notification within 72 hours, final report in one month (Article 23) |
| Management | Approves, supervises and is accountable; training (Article 17) | The same (Article 20) |
| Fines | From €500 to €100,000 | A maximum of at least €10 million or 2% of turnover for essential entities; €7 million or 1.4% for important ones (Article 34) |
| Supervision | ANC-AD and AFA | Authorities designated in each Member State |
For an Andorran company, there are two routes in. The first is having an establishment in the EU: jurisdiction depends on the State where the entity is established (Article 26(1)), and a subsidiary in Spain or France in a sector listed in the annexes may fall under the corresponding national law. The second is being a supplier to an affected entity: NIS2 requires supply chain security to be addressed (Article 21(2)(d)), and customers will ask for evidence. For DNS, cloud, data centre, managed service and managed security service providers that are not in the EU but offer services there, the directive requires them to designate a representative in the EU (Article 26(3)). The state of transposition in each country must be checked in the national law.
A reform in draft
On 23 June 2026, the Council of Ministers approved a draft bill amending Llei 22/2022 (note from the Government of Andorra of the same date). According to the note, critical entities will have to have a security operations centre (SOC), the obligation to notify incidents extends to all entities, public radio and television become an essential sector, the penalties regime is adjusted to favour notification and cooperation between CSIRT-AD and the police is strengthened.
It is a draft, not a law in force. As of 25 October 2026 we have not found any amending law published in the BOPA, so what we describe above is the 2022 text. Check again before making decisions that depend on it.
Where we have an interest
TutumSec, the cybersecurity vertical of BDR Group, offers vCISO consulting, audits, pentesting, SOC/MDR, incident response and an information security technical office that supports NIS2 compliance. So we have an interest in the topic. We do not decide whether an entity is essential or important: that is for the ANC-AD.
What to do now
- Check in the annexes whether your service appears there and, if so, confirm with the ANC-AD that you are on its list.
- Appoint an information security delegate and a deputy, and communicate their contact details.
- Write the security policy and the risk analysis, and prepare the statement of applicability.
- Define who detects an incident, who decides whether it is significant and who alerts CSIRT-AD within 24 hours.
- If you are not obliged, review what customers who are may ask of you.
Frequently asked questions
Is an Andorran retail or tourism SME obliged?
Only if its service is one of the types in the annexes and it reaches the size threshold. Retail, tourism and professional services do not appear there as a sector, but it may receive requirements from customers that do.
How long is there to notify an incident?
The initial notification is within 24 hours of becoming aware of it; the final report, within one month. Article 15.1 also mentions 72 hours.
Does NIS2 apply to an Andorran company?
Not directly because it is Andorran. It depends on whether it has an establishment in the EU, on the sector and the size, and on whether it is a supplier to an affected entity.
Is the reform already in force?
No. It is a draft bill approved by the Government on 23 June 2026; the text in force is the 2022 one.
Sources
- General Council of Andorra. Llei 22/2022, of 9 June, on measures for the security of networks and information systems (in Catalan), Articles 2, 6, 10, 12 to 15, 17, 18, 23, 24, 34 to 37, fourth final provision and Annexes I and II. BOPA no. 76, 22 June 2022. Accessed: 25 October 2026. https://www.consellgeneral.ad/fitxers/documents/lleis-2022/llei-22-2022-del-9-de-juny-de-mesures-per-a-la-seguretat-de-les-xarxes-i-dels-sistemes-d2019informacio
- Government of Andorra. The Government strengthens the cybersecurity framework to adapt it to the evolution of the digital environment (in Catalan), 23 June 2026. Accessed: 25 October 2026. https://www.govern.ad/ca/w/el-govern-reforca-el-marc-de-ciberseguretat-per-adaptar-lo-a-l-evolucio-de-l-entorn-digital
- European Parliament and Council. Directive (EU) 2022/2555 of 14 December 2022 (NIS2), Articles 2, 20, 21, 23, 26, 34 and 41. OJ L 333, 27 December 2022. Accessed: 25 October 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555
Want to know how it affects you?
If you want to review how it affects you and where to start, see the service page: Cybersecurity for businesses. The services in detail are at TutumSec.