NIS2 in Spain, two years without a law: where transposition stands and what to do this quarter
By Kike Gandia · Research · 7 min read
October 17, 2026 marks two years since the deadline to transpose Directive (EU) 2022/2555, NIS2, expired. Spain still has no law published in the BOE (Spain's Official State Gazette). What exists is a preliminary draft, the Cybersecurity Coordination and Governance Act (Ley de Coordinación y Gobernanza de la Ciberseguridad), approved by the Council of Ministers in January 2025, and an infringement procedure that has already reached the Court of Justice of the EU.
For a company, that situation invites two wrong readings: that NIS2 already binds you as if the law had passed, or that there is nothing to do until it is published. This article separates what is official from what is speculation, and ends with what makes sense to do this quarter.
- 10/17/2024
- transposition deadline expired (Spain missed it)
- 01/14/2025
- preliminary draft at the Council of Ministers (urgent procedure)
- 07/08/2026
- referral to the Court of Justice (with a request for penalties)
- Unpublished
- transposition law in the BOE (as of October 13, 2026)
The official timeline
- December 14, 2022 — The directive is adopted
NIS2 replaces the first NIS Directive and sets October 17, 2024 as the deadline for Member States to adopt their national measures. - October 17, 2024 — The deadline expires
Spain does not notify the Commission of full transposition of the directive. - November 28, 2024 — Letter of formal notice
First stage of the European Commission's infringement procedure. - January 14, 2025 — Preliminary draft law
The Council of Ministers approves the preliminary draft of the Cybersecurity Coordination and Governance Act under the urgent procedure: before going to Parliament it needs the mandatory reports and an opinion from the Council of State. - May 7, 2025 — Reasoned opinion
Second stage of the infringement procedure. - December 15, 2025 — Government answer in the Senate
The Government describes the text as a preliminary draft "at an advanced stage." - July 8, 2026 — Referral to the Court of Justice
The Commission takes Spain, together with Ireland, France and the Netherlands, to the CJEU and asks for a lump sum and daily penalty payments until full transposition is notified. The amounts are for the Court to set.
As of this article we have not found the law published in the BOE. We will update it when that changes.
What the preliminary draft says
The known text is the one the Government presented in January 2025, and it may change during the legislative process. According to the official presentation, these are its main pieces:
| Piece | What the preliminary draft provides |
|---|---|
| National authority | A new National Cybersecurity Center that directs, drives and coordinates the system and acts as the cybersecurity crisis management authority |
| Supervisory authorities | The Cybersecurity Coordination Office (Secretariat of State for Security), the National Cryptologic Center (CCN), the Secretariat of State for Telecommunications and Digital Infrastructure, and the Secretariat of State for Digitalization and Artificial Intelligence |
| Scope | Public and private entities in high-criticality sectors (energy, transport, banking and financial markets, health, water, digital infrastructure and technology services, among others) and in lower-criticality sectors such as postal and courier services, including entities from other EU Member States that operate or offer services in Spain |
| Obligations | An individual risk assessment, measures to secure networks and systems, reporting of significant incidents, and informing the recipients of their services about cyber threats that may affect them |
What transposition does not change is the directive's minimum content: the risk-management measures of Article 21, the accountability of management bodies under Article 20, the Article 23 reporting sequence (24 hours, 72 hours and one month) and the penalty caps of Article 34. A Member State has limited room when transposing, and the Spanish law can be expected to follow them closely. We cover them in our guide to NIS2 compliance and in NIS2 fines and penalties.
What applies in the meantime
An untransposed directive imposes no direct obligations or penalties on a private company. The framework of the first directive remains in force: Royal Decree-Law 12/2018 and its implementing Royal Decree 43/2021, for the operators of essential services and digital service providers already within its scope. According to the Spain page maintained by the European Commission, the reference CSIRTs are INCIBE-CERT for the private sector and CCN-CERT for the public sector, and the competent authority for private operators of essential services is the Secretariat of State for Security, through CNPIC.
If you manufacture products with digital elements. There is one reporting obligation that is already in force without waiting for any Spanish law: the Cyber Resilience Act's, a directly applicable regulation since September 11, 2026. We cover it in CRA reporting is now mandatory.
Why waiting for the law is a bad strategy
- Customers Your customers won't wait for the BOE
- An in-scope entity in another Member State that has already transposed has to manage the risk in its supply chain, and it will pass the requirements on to you by contract: specific measures, reporting deadlines and technical evidence.
- Time The work doesn't fit in a few weeks
- Applicability, a supplier inventory, a gap analysis against Article 21, a reporting procedure and sign-off by management. In a mid-sized organization it cannot be done between the law's publication and its entry into force.
- Text The essentials are already known
- The ten measures of Article 21 and the Article 23 deadlines come from the directive. What the Spanish law can specify is authorities, registration and the penalty procedure, not the core of what has to be done.
- CJEU Pressure is rising, the date is unknown
- The referral to the Court of Justice pushes toward adoption, but sets no date. Planning around a specific date is a bet; planning around the content of the directive is not.
What to do this quarter
- 1 — Confirm whether it applies to you
An Annex I or Annex II sector, medium-sized or larger, and the cases that do not depend on size, company by company across the group. - 2 — Inventory critical suppliers
Who has access to your systems or handles relevant information, ranked by criticality. It is the requirement that generates the most work, and the first one your own customers will ask about. - 3 — Gap analysis
Your current state against the ten measures of Article 21 and the reporting obligations, with a plan prioritized by risk. - 4 — Reporting procedure
Who decides that an incident is significant and on what criteria, and how the 24-hour, 72-hour and one-month deadlines are met. What makes these deadlines fail is almost never drafting the notice: it is not knowing in time that one is due. - 5 — Management sign-off
Article 20 requires the management body to approve the measures, oversee their implementation and get trained. You need formal approval and documented reviews. - 6 — Evidence that it works
Article 21(2)(f) requires assessing the effectiveness of the measures. A pentest or a periodic technical audit is the most direct way to produce that evidence; the pentesting scoping form helps size it.
What may change from Brussels
The Digital Omnibus proposal the Commission tabled on November 19, 2025 introduces a single reporting point for cybersecurity and data incidents. It is still at the proposal stage: according to the European Parliament's tracker, updated September 20, 2026, the Council vote on its negotiating mandate scheduled for June 26 was canceled, and Parliament's draft report has drawn more than 1,750 amendments. It may simplify the channel you report through, but not the obligation to detect and classify the incident in time.
If you want this update when the law is published, the newsletter is the place, and the other EU deadlines that affect you are in the EU compliance calendar. And if you would rather not wait, our NIS2 compliance consulting starts with the applicability report and the gap analysis.
Related service
Topics
#NIS2 #Cybersecurity-Coordination-and-Governance-Act #Transposition #Spain #Compliance #Incident-reporting
Keep reading
- European compliance calendar 2026-2030: CRA, AI Act, Data Act and everything still to come
- A badly scoped pentest isn't cheap: it's useless
- ISO 27001 in 2026: what has really changed and what you still need to get certified
- Cloudflare vs. LaLiga: The clash of titans threatening the internet in Spain
- The Evolution of Offshore Finance: Legal Loopholes, Leaks and the Rise of the US "Onshore Haven"
Sources
- Directive (EU) 2022/2555 — official NIS2 text on EUR-Lex
- La Moncloa — the Government presents the future Cybersecurity Coordination and Governance Act (January 14, 2025, in Spanish)
- Spanish Senate — Government answer to a written question on NIS2 transposition (December 15, 2025, in Spanish)
- European Commission — Spain referred to the Court of Justice for failing to transpose NIS2 (July 8, 2026)
- European Commission — NIS in Spain: authorities, CSIRTs and single point of contact
- European Parliament — Legislative Train: Digital Omnibus proposal (2025/0360(COD))