NIS2 in Spain: where the law stands and what already applies

By Kike Gandia · Co-Founder & CEO, OSCP

As of 8 October 2026, Spain has not transposed the NIS2 Directive. The deadline expired on 17 October 2024; the Government approved a draft Law on the Coordination and Governance of Cybersecurity in January 2025, but that law has not been published in the Official State Gazette (BOE). On 8 July 2026 the European Commission referred Spain to the Court of Justice of the EU for failing to transpose it, and on 6 October Royal Decree 806/2026 dissolved Parliament and called a general election for 29 November. In practice, no Spanish NIS2 law will be passed by Parliament before 2027. This page explains what that means for your company, what already applies even without the law, and what to do in the meantime. We update it at every milestone.

The short answer

Timeline: how we got here

What the snap election changes

While Parliament is dissolved no law can be debated or passed. The new chambers are constituted on 23 December 2026; then come the investiture vote and the formation of a government. From election day, the outgoing Government is also a caretaker government, and a caretaker government cannot send bills to Parliament.

That is why the January 2025 draft depends on the next Government: it will have to pick it up, change it or replace it, and send it to Parliament as a bill. It is reasonable to expect the structure to stay, because the directive sets the essentials: sectors, size thresholds, risk management, incident reporting and minimum penalties.

There is a fast track that does not depend on ordinary parliamentary procedure: a royal decree-law. With Parliament dissolved, it is validated by the Standing Committee. This is not exotic: NIS1 was transposed exactly that way, with Royal Decree-law 12/2018. With a case open before the Court of Justice and daily fines requested, it cannot be ruled out.

What does not change: pressure from Brussels keeps building, and companies in NIS2 sectors have known for two years what will be required of them.

Does NIS2 already apply to me without a Spanish law?

On its own, the directive does not impose direct obligations on private companies: it needs a national law to transpose it. Until there is one, no Spanish authority can fine you for breaching NIS2 as such, and there are no "retroactive penalties": an offence can only be punished if the rule was in force when it was committed.

That does not mean you have no obligations today. Depending on who you are, this already applies:

Implementing Regulation (EU) 2024/2690 deserves a note: it is a regulation, not a directive, so it needs no transposition. It details the technical measures NIS2 requires from digital providers: DNS, cloud, data centres, content delivery networks, managed and managed security services, online marketplaces, search engines, social networks and trust services. How it is enforced in Spain without a national law that designates an authority and a penalty regime is debatable, but if you provide those services, it is the technical benchmark you will be asked for.

The obligation that arrives before the law: your customers

For many Spanish companies the first NIS2 requirement does not come from the BOE but from a contract. Member States that have already transposed the directive, such as Italy and Belgium since October 2024, require their entities to manage the risk of their supply chain. That turns into security questionnaires, contract clauses and supplier audits, including for Spanish suppliers.

The same goes for financial entities subject to DORA, which must control their ICT providers, and for the public administration, which requires the ENS from its suppliers. If you sell technology or services to any of them, your customer's question will not wait for the Spanish law.

What the Spanish draft says (if it is picked up)

The January 2025 text is not law and may change, but it shows where the rule is heading:

• It creates a National Cybersecurity Centre as the national authority, with supervision split among several bodies by sector.
• It applies the directive's classification into essential and important entities, by sector and size (generally medium and large companies: 50 employees or more, or turnover above 10 million euros).
• It imposes the risk-management measures of article 21 of the directive and the liability of management bodies.
• It includes the directive's incident reporting: early warning within 24 hours, notification within 72 hours and a final report within one month.
• It follows the directive's penalties: up to 10 million euros or 2% of worldwide turnover for essential entities, and up to 7 million or 1.4% for important ones.

What to do in the meantime

Waiting for the law is not a plan: when it arrives, the adaptation period will be short, and it will ask for the same things the directive already asks for. The sensible order:

1. Find out whether you are in scope. Sector in annex I or II of the directive, and size. If in doubt, check before investing.
2. Run a gap analysis against article 21 of the directive (and Implementing Regulation 2024/2690 if you are a digital provider).
3. Prepare incident reporting: who decides, who reports, with which template and how fast. A 24-hour clock leaves no room to improvise.
4. Sort out your supply chain: inventory of critical suppliers, security clauses and evidence, because you will be asked for them and will have to ask for them.
5. Reuse what you already have: ISO 27001 certification or the ENS cover much of the work; do not start from scratch.
6. Involve senior management: personal liability for management bodies is one of the changes that matters most.

FAQ

Is NIS2 in force in Spain?

Not as Spanish law. The directive has been in force in the EU since January 2023 and the transposition deadline expired on 17 October 2024, but Spain has not yet passed the law that incorporates it. The previous regime still applies: Royal Decree-law 12/2018 and Royal Decree 43/2021.

Can I be fined for not complying with NIS2 if there is no law?

Not for NIS2 as such: a national law is needed to define offences and penalties, and that law will only apply to conduct after it enters into force. You can be fined under rules already in force, such as the GDPR, the ENS, DORA or the NIS1 regime if it applies to you.

When will Spain pass its NIS2 law?

There is no official date. With Parliament dissolved for the 29 November 2026 general election, no law can be passed until the new chambers are constituted and a government is formed. An ordinary law will not arrive before 2027; a royal decree-law, like the one that transposed NIS1 in 2018, could be faster.

What has the European Union done about Spain's delay?

It opened infringement proceedings (INFR(2024)0270): a letter of formal notice in November 2024, a reasoned opinion in May 2025 and, on 8 July 2026, a referral to the EU Court of Justice asking for a lump sum and daily fines. The Court will decide the amount.

Will my company be covered by NIS2?

It depends on sector and size. The directive covers sectors such as energy, transport, banking, health, water, digital infrastructure, managed ICT services, public administration, postal services, waste, chemicals, food, manufacturing and research, generally for medium and large companies. Some providers, such as DNS or trust service providers, are covered regardless of size.

If I already have ISO 27001 or the ENS, do I comply with NIS2?

Not automatically, but you are a good part of the way there: risk management, controls, incident management and continuous improvement. What is usually missing is incident reporting within the NIS2 deadlines, supply-chain management in the detail it requires and formal involvement of senior management.

Related service

NIS2 compliance consulting

Related content

• How to comply with NIS2
• NIS2 fines and penalties
• DORA vs NIS2
• CRA vs NIS2
• ISO 27001 vs ENS
• Hacked: what to do in the first 24 hours

Sources

• Directiva (UE) 2022/2555 (NIS2)
• Reglamento de Ejecución (UE) 2024/2690
• Comisión Europea — remisión de Irlanda, España, Francia y Países Bajos al Tribunal de Justicia (8-7-2026)
• Ministerio del Interior — el Consejo de Ministros aprueba el anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad
• Real Decreto-ley 12/2018, de seguridad de las redes y sistemas de información

Check whether NIS2 applies to you and what is missing