News

NIS2 in Spain: where transposition stands and what to do now

On 25/10/2026 Spain has still not transposed the NIS2 Directive. Status of the law, who is affected, obligations and what companies can do now.

Published By BDR Group11 min read

On 25 October 2026 Spain has still not transposed the NIS2 Directive (EU) 2022/2555. The Government approved the draft bill on 14 January 2025, but there is no law in the BOE (Boletín Oficial del Estado, Spain’s official gazette) and the Cortes (Spain’s parliament) were dissolved on 5 October. The Directive’s measures can already be prepared, though.

Where the Spanish law stands

The vehicle is the draft Cybersecurity Coordination and Governance Act (anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad). This is what appears in official sources as of 25 October 2026:

  • 17 October 2024: deadline for transposing the Directive (Article 41). Spain did not meet it.
  • 28 November 2024 and 7 May 2025: the European Commission sends Spain the letter of formal notice and the reasoned opinion.
  • 14 January 2025: the Council of Ministers approves the draft and agrees to process it urgently so that it can be approved again, in a second reading, as soon as possible.
  • 17 March 2026: that day’s Council of Ministers summary says the law is being processed by the Ministry of the Interior and that the draft was approved in January.
  • 8 July 2026: the Commission takes Spain, Ireland, France and the Netherlands to the Court of Justice of the EU for failing to notify transposition, and asks for financial penalties.
  • 5 October 2026: Real Decreto 806/2026 (a royal decree) dissolves the Congress of Deputies and the Senate and calls elections for 29 November. The new chambers will meet on 23 December (BOE of 6 October).

We have gone through the Council of Ministers summaries published between 24 March and 13 October 2026, and none records the bill being approved. The BOE’s consolidated legislation database has no law with that title, and we have not found the bill registered in the Congress. It should not be confused with the bill on the protection and resilience of critical entities, which the Government approved on 17 March 2026 and which is a different law. At the end of September some specialist media said the Government was about to take the next step; we have not been able to confirm it in any official source and we do not take it as a fact.

The upshot is that we cannot say when it will become law. With the Cortes dissolved, parliamentary processing cannot begin until there are new chambers. In the meantime the earlier regime remains in force: Real Decreto-ley 12/2018 (a royal decree-law on the security of networks and information systems) and Real Decreto 43/2021 (a royal decree), which apply to operators of essential services in the strategic sectors and to certain digital services (online marketplaces, search engines and cloud computing).

Who it will affect: essential and important entities

The Directive applies, in general, to public or private entities that are medium-sized or larger and belong to one of the sectors in Annexes I or II (Article 2(1)). Recommendation 2003/361/EC regards as small an enterprise with fewer than 50 persons and a turnover or balance sheet total of up to 10 million euros. In practical terms: from 50 persons, or with turnover and balance sheet above 10 million.

  • Annex I (sectors of high criticality): energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space.
  • Annex II (other critical sectors): postal and courier services, waste management, chemicals, food (wholesale distribution and industrial production or processing), manufacturing, digital providers and research.

Some types of entity are included whatever their size, such as DNS service providers, top-level domain name registries and trust service providers (Article 2(2)). The usual sectors of a Catalan or Andorran SME (retail, hospitality, professional services) do not appear as such.

Type (Article 3)Who falls inMaximum fine that Member States must provide for, as a minimum (Article 34)
Essential entityAnnex I entities that exceed the medium-sized limits, and some types with no size threshold10 million euros or 2% of worldwide turnover, whichever is higher
Important entityThe remaining entities in Annexes I and II7 million euros or 1.4% of worldwide turnover, whichever is higher

The Spanish draft, according to the Government’s summary of 14 January 2025, would apply to entities with tax residence in Spain or resident in another EU State that offer services there, requires risk assessment and notification of significant incidents, requires the appointment of an information security officer (accredited, in essential entities) and creates a National Cybersecurity Centre. These are details of a text that may change.

The Directive’s obligations: Articles 20, 21 and 23

Management (Article 20). Management bodies approve the risk-management measures, oversee their implementation and can be held liable if they are not met. Their members must undergo cybersecurity training.

Security measures (Article 21). They must be proportionate to the risk and cover at least ten areas:

  1. Policies on risk analysis and information system security.
  2. Incident handling.
  3. Continuity: backup management, disaster recovery and crisis management.
  4. Supply chain security.
  5. Security in the acquisition, development and maintenance of systems, including vulnerability handling.
  6. Assessment of the effectiveness of the measures.
  7. Basic cyber hygiene and training.
  8. Cryptography and encryption.
  9. Human resources security, access control and asset management.
  10. Multi-factor authentication and secured communications.

Incident notification (Article 23). An incident is significant if it has caused or may cause severe operational disruption or financial loss, or considerable damage to third parties. An early warning must be sent within 24 hours of becoming aware of it, an incident notification with an initial assessment within 72 hours and a final report one month after that notification, plus an intermediate report if the authority asks for one.

What about Andorran companies that serve Spain?

Andorra is not in the EU. The Directive refers to entities providing services in the Union (Article 2(1)), but jurisdiction lies with the Member State where the entity is established (Article 26). The obligation to designate a representative in the EU only applies to certain digital providers not established in the Union, such as DNS, cloud, data centre or managed service providers. Our reading is that an Andorran company outside those categories would not receive a direct obligation from a Spanish law, but the final text will decide, and it is worth confirming with a legal adviser.

The real effect arrives by another route. An affected Spanish entity has to manage the security of its supply chain (Article 21(2)(d) and 21(3)), and it will ask its suppliers for contractual commitments, evidence of controls and incident notification deadlines.

Andorra also has its own law: Llei 22/2022, of 9 June, on measures for the security of networks and information systems (BOPA no. 76, 22 June 2022; the BOPA, Butlletí Oficial del Principat d’Andorra, is Andorra’s official gazette), with essential and important entities and, in the published wording, a scope that includes those with 50 or more people or above 10 million euros in turnover or balance sheet total. Check the version in force before acting on it.

What to do now

There is no need to wait for the law to start: the Article 21 measures are good security practice that, in part, the GDPR already requires (Article 32).

  1. Find out whether you are in scope, directly or through a client. Check your sector, your size and whether any large client in the Annex sectors is going to ask you for guarantees. INCIBE publishes a table of entities by sector and size on its NIS2 page.
  2. Take the issue to management. Management should approve the measures, appoint someone responsible and undergo training, as Article 20 asks.
  3. Compare yourself with the ten measures. Run a gap analysis and rank it by priority: two-step verification, tested backups and recovery, incident handling and supplier security are usually the first gaps.
  4. Prepare the notification procedure. Who decides that an incident is significant, who raises the alert, with what data and in what time. The 24 and 72 hours leave no room to improvise, and the GDPR already requires personal data breaches to be notified to the authority within 72 hours (Article 33).
  5. Review your contracts. Those with your suppliers and your clients: which security and notification obligations they contain, and what evidence you can offer.

Where we have an interest, and where we don’t

To be clear: BDR Group does cybersecurity consulting through TutumSec, so we have an interest in this topic. According to our service page, we offer an initial diagnosis with a technical audit, pentesting and a gap analysis against NIS2 and ISO 27001, outsourced CISO consultancy and an information security technical office to support NIS2 compliance. That does not mean every company needs them: finding out whether you are in scope does not require any supplier.

Frequently asked questions

Am I already required to comply with NIS2?

In principle, not directly. The Directive is addressed to the Member States (Article 46), and the obligations for companies will be set by the Spanish law, which does not yet exist. Until there is a law, the earlier regime applies to essential operators and certain digital services. This is a general reading; for a specific case, consult a legal adviser.

Will SMEs be included?

The Directive’s general rule is that they will if they are medium-sized or large and in a sector of the Annexes. The Spanish text may add nuances, and on 20 January 2026 the Commission proposed targeted amendments to the Directive; they are a proposal and we have not checked that they have been adopted.

What if I am only a supplier to an affected entity?

You will not necessarily have a legal obligation of your own, but you will have a contractual one: the affected entity has to secure its supply chain and will pass that on in its contracts.

When will it become law?

We do not know. The Government still has to approve the bill, then parliamentary processing and publication in the BOE must follow, and the Cortes are dissolved until after the elections of 29 November 2026.

Sources

Want to know whether NIS2 affects you?

If you want to review where your company’s cybersecurity stands against NIS2 and where to start, see the service page: Cybersecurity for businesses. All the services are at TutumSec.

Back to News

News

Related articles