The NIS2 Directive (EU 2022/2555) strengthens cybersecurity across Europe and expands the number of companies required to protect their systems against cyberattacks. Its aim is to improve prevention, incident response and the continuity of essential services for the economy and society.

The deadline for transposing the Directive into Spanish law was 17 October 2024. However, Spain has yet to complete the transposition process. In January 2025, the Government approved the preliminary draft Cybersecurity Coordination and Governance Act, but the legislation remains pending. In July 2026, the European Commission decided to refer Spain to the Court of Justice of the European Union for failing to meet this obligation.

Which companies will be affected?

Spain currently has its own regulatory framework, based primarily on Royal Decree-Law 12/2018 and its implementing regulations, which applies to operators of essential services and certain digital service providers. The transposition of NIS2 will extend the scope of these obligations to a wider range of public and private entities.

The Directive covers 18 sectors, including energy, transport, banking, healthcare, drinking water supply, digital infrastructure, postal services, waste management, the chemical industry, food production and distribution, and certain technology manufacturers and providers.

In general, medium-sized and large companies operating in the sectors covered by the Directive will be included, as will certain entities regardless of their size. As a result, companies that have not previously been directly subject to specific obligations of this kind will need to assess whether they fall within the scope of the new framework.

What will change once the Directive is transposed?

Affected companies will have to implement technical and organizational measures to manage cybersecurity risks. These will include protecting their systems, managing vulnerabilities, ensuring the security of their suppliers, and establishing incident response and recovery plans.

They will also be required to report significant incidents within the time limits set out in the Directive: an initial alert within a maximum of 24 hours and a subsequent notification within 72 hours, followed by a final report in accordance with the applicable requirements.

Another key change concerns the role of senior management. Management bodies will be required to approve and oversee cybersecurity measures and acquire the knowledge necessary to understand and assess risks. Non-compliance may result in inspections, corrective measures and financial penalties.

What should companies do?

Although Spain has not yet passed its transposition law, companies can begin assessing whether they may fall within the scope of NIS2, reviewing their security measures and identifying gaps in risk management, incident response and supplier oversight.

The new regulation represents a significant shift: cybersecurity is no longer solely a technical issue but also a matter of management responsibility and regulatory compliance. Taking proactive steps will enable companies to prepare for the new requirements, reduce their exposure to cyberattacks and limit potential legal and operational consequences.