NIS2 in Spain

Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad

Bill, not law yet This page follows the Cybersecurity Coordination Law (draft). The rules can change before it passes.

Bill: Cybersecurity Coordination Law (draft)
Authority: National Cybersecurity Centre (planned)
Classes: entidad esencial (essential), entidad importante (important)
Register: Control authorities
ISO 27001: Helps, not enough alone

Check your company for Spain

Know when Spain changes its NIS2 rules

One email when the law, the deadlines or the portal change.

Where the bill stands

Spain has no NIS2 law in force. The Council of Ministers approved a draft law (anteproyecto) on 2025-01-14. On 2026-03-17 the Interior minister still called it an anteproyecto. The data below follows the draft text that Spain notified to the European Commission. It can change before it passes. The law takes effect the day after publication in the BOE.

Name: Anteproyecto de Ley de Coordinación y Gobernanza de la CiberseguridadDraft Law on Coordination and Governance of Cybersecurity
Status: Bill, not law yet
Text: Read the Cybersecurity Coordination Law (draft)

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Spain differs

Art. 4(1)(c) of the draft Medium-sized public electronic communications network providers are essential. Under the Directive they would be important.
Art. 4(1)(c) of the draft Medium-sized public electronic communications service providers are essential. Under the Directive they would be important.
Art. 3(1) of the draft The size test needs 50 or more employees and annual turnover or balance sheet above EUR 10 million.
Art. 3(2) of the draft Some entities are in scope at any size, for example the sole provider of an essential service in Spain and public sector bodies. The control authority can also name an entity by reasoned decision.
Art. 4 of the draft Municipalities with more than 20,000 inhabitants are important. Operators of essential services named before 2023-01-16 are essential.
Art. 3(6) and 4(7) of the draft Financial entities under DORA are out of the risk, reporting, supervision and fines rules. Sector rules with equal effect take precedence.

Also note

The draft names 3 control authorities by sector. The Ministry of Defence acts through the National Cryptologic Centre. The Ministry for Digital Transformation and Civil Service is the second authority. The Ministry of the Interior acts through the Cybersecurity Coordination Office.
The draft has not passed. Dates, fines and duties can change. Check the Cortes and the BOE before you act.
Large entities in Annex I sectors are essential. All other in-scope entities are important. Qualified trust service providers, TLD registries and DNS providers are essential at any size.

Registration

No registration portal exists yet. The draft gives 3 months after you become an essential or important entity to send your data to the control authority. Report changes within 2 weeks. The National Cybersecurity Centre keeps the list and reviews it at least every 2 years. Digital infrastructure providers also go into a separate register.

Portal: Control authorities
Rule: Deadline counts from the day you come into scope
Later entrants: 3 months after you come into scope
You need: Evaluate your own class, then send the control authority your name, contact data, IP ranges, sector and the EU states where you serve. A regulation will set the mechanism.
Changes: Report changes to your data within 14 days

Incident reporting

24 hEarly warning
72 hIncident notification
1 monthFinal reportafter the incident notification

Send the reports to the control authority, through the national reference CSIRT (CCN-CERT), on the National Platform for Notification and Follow-up of Cyber Incidents.

Trust service providers have 24 hours for the notification. The 24 and 72 hours run from the moment you know of the incident.

Measures and proof

Essential: Hold and maintain a certificate of conformity. Control authorities can order periodic and targeted security audits by an accredited certification body. Send a statement of applicability to the authority within 6 months.
Important: Choose between the certificate and a self-assessment of your security posture. The authority checks after the fact when it has signs of a breach, and can order audits.

Duties of management

Management bodies must apply the risk measures, oversee them and answer for breaches. Members must take regular training. Management members are jointly liable for the entity's breaches. Each entity names an information security officer.

Fines

Under the bill, the ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, Art. 42 of the draft. The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class	Ceiling	At EUR 20m	At EUR 500m	At EUR 2bn
Essential	EUR 10m or 2%	EUR 10m	EUR 10m	EUR 40m
Important	EUR 7m or 1.4%	EUR 7m	EUR 7m	EUR 28m

The top fines apply to very serious breaches under art. 39(a) and (b), which are failure to apply the measures after an incident and repeated failure to report. Other very serious breaches cost EUR 500,001-2,000,000. Serious breaches cost EUR 100,001-500,000. Minor breaches cost EUR 10,000-100,000.