Spain NIS2 Implementation Guide: draft law status, authorities, duties and sanctions

Spain has not yet transposed NIS2, so Spanish organisations are preparing for obligations that exist only in a government draft while the older NIS1 regime still applies. The vehicle is the Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved as a preliminary draft by the Council of Ministers on 14 January 2025. This guide explains what the draft says about scope, authorities, registration, incident notification and sanctions, what remains in force today under Real Decreto-ley 12/2018 and Real Decreto 43/2021, and how security and identity teams can prepare without over-building for a text that may change. It is written for CISOs, compliance leads and identity teams in organisations with Spanish operations. For the directive itself read the NIS2 Directive Guide, and for the public sector security scheme read the Spain ENS Guide: this page covers the Spanish NIS2 layer only.

Status checked 14 November 2026: no NIS2 transposition law has been published in the Boletín Oficial del Estado (BOE). The text remains an anteproyecto (preliminary draft), notified to the European Commission under the TRIS procedure as 2025/0104/ES on 21 February 2025. On 8 July 2026 the Commission referred Spain to the Court of Justice of the EU for failing to notify transposition measures. A Cuatrecasas commentary dated 26 October 2026 reports that the draft was never approved as a bill or sent to the Cortes, and that processing has stalled following the call of a general election. Article numbers and figures below come from the draft and its official impact memorandum and can still change.

Key takeaways

• Nothing new is in force yet: Spain missed the 17 October 2024 transposition deadline, and until a law is published the NIS1 framework of Real Decreto-ley 12/2018 and Real Decreto 43/2021 keeps applying to designated operators of essential services and digital service providers.
• The draft creates a Centro Nacional de Ciberseguridad: it would direct and coordinate the national system and act as the cyber crisis management authority, with supervision split between the CCN, the Oficina de Coordinación de Ciberseguridad and the digital and telecoms secretariats of state.
• Thresholds follow the directive: medium and large enterprises (50 or more staff, or EUR 10 million turnover or balance sheet) in the annex sectors, plus some entities of any size, with an official estimate of 1,819 essential and 3,941 important entities.
• A named security officer becomes mandatory: essential and important entities must designate a responsable de seguridad de la información, and for essential entities that person must hold official accreditation.
• Machine identities sit inside the risk measures: the draft ties risk management to the ENS, which already requires access control and authenticator management, so service accounts, API keys and AI agent credentials need inventory, ownership and logging now.

Scope: who and what is covered

The Moncloa summary of the 14 January 2025 Council of Ministers says the draft applies to public and private entities with tax residence in Spain, and to entities resident in another EU Member State that operate or offer services in Spain. The official impact memorandum notified through TRIS describes the size rule: medium or large enterprises, employing 50 or more people, with annual turnover or balance sheet reaching EUR 10 million, in the sectors of the annexes.

• Essential or important: the TRIS summary says the draft sets uniform criteria for classifying entities as essential or important. The directive split (large entities in Annex I sectors are essential, the rest important) is explained in the NIS2 Directive Guide.
• Foreign groups: the tax residence wording means a subsidiary or branch serving Spain from another Member State should check both its home law and Spain's draft. The NIS2 Transposition Tracker shows which home laws are already in force.
• Financial entities: banks and market infrastructures already under DORA should map the overlap before duplicating controls. See the DORA and NIS2 Overlap Mapping Guide.

What applies today: the NIS1 regime

Real Decreto-ley 12/2018 of 7 September (BOE no. 218, in force 9 September 2018) covers operators of essential services established in Spain and digital service providers offering online marketplaces, search engines or cloud computing. Real Decreto 43/2021 of 26 January develops it. If your organisation is already designated under this regime, its duties continue until the new law replaces it.

Key obligations

The draft builds on the NIS1 machinery rather than replacing it, which is why organisations already designated under Real Decreto 43/2021 are better placed than newcomers.

Authorities and the national system

• Centro Nacional de Ciberseguridad: created to direct, drive and coordinate the system, act as single point of contact with the EU and serve as the cyber crisis management authority. finreg360 reports that it would sit within the Secretaría General de la Presidencia del Gobierno.
• Control authorities: the Oficina de Coordinación de Ciberseguridad (Secretaría de Estado de Seguridad), the Centro Criptológico Nacional (CNI), the Secretaría de Estado de Telecomunicaciones e Infraestructuras Digitales and the Secretaría de Estado de Digitalización e Inteligencia Artificial. They supervise compliance with standards, guides and technical instructions and can carry out checks, inspections, tests and reviews.
• Reference CSIRTs (draft Art. 9): CCN-CERT for entities within Ley 40/2015, INCIBE-CERT for important entities outside it, and ESPDEF-CERT of the Mando Conjunto del Ciberespacio, cooperating with the others.

Registration and the security officer

• Entity registry (draft Art. 26): the memorandum refers to a registry of entities, and Art. 27 to a domain name registration database. Collect legal entity data, sectors, Member States served, contact points and public IP ranges now so the submission is quick once the form exists.
• Responsable de seguridad (draft Art. 15): a person, unit or collegiate body acting as point of contact and technical coordinator. Essential entities designate within three months of acquiring that status and report later appointments or departures within one month.
• Accreditation: for essential entities the officer must obtain accredited personnel status under the private security legislation (Ley Orgánica 2/1986 and Ley 5/2014), under a regime still to be developed.

Risk management measures

• Individual risk assessment: each entity assesses its own risk and applies measures to protect its networks and systems and prevent incidents.
• ENS as the frame: the memorandum says measures apply "en el marco del Esquema Nacional de Seguridad" and equivalent European and international technical standards. The ENS measure set, including its access control and authentication measures, is the best current indication of what supervisors will expect. See the Spain ENS Guide.
• Management bodies: Cuatrecasas reads the draft as requiring management bodies to approve risk measures, oversee implementation and receive periodic training, with joint liability of management members for infringements. See the NIS2 Management Liability Executive Briefing.
• Customer communication: entities must tell recipients of their services about cyber threats that affect them and the measures they can take.
• Supply chain: significant incidents affecting the entity's own operations or those of external providers must be notified, which makes supplier incident clauses a practical necessity. See the NIS2 Supply Chain Security Guide.

Incident notification

The draft keeps the national notification platform and, according to Cuatrecasas, adopts the directive's staged deadlines.

Timeline and current status

• Entry into force: the draft says the law enters into force one month after publication in the BOE, shorter than usual because of the missed deadline. Plan on little lead time.
• Possible shortcut: Cuatrecasas notes that a royal decree-law could transpose NIS2 in the meantime, subject to validation by the Diputación Permanente within 30 days. Treat this as one scenario, not a forecast.
• Watch list: the BOE, Consejo de Ministros summaries on lamoncloa.gob.es, and the Court of Justice case.

Enforcement and penalties

Until the new law applies, enforcement runs under Articles 36 and 37 of Real Decreto-ley 12/2018, where failing to notify a significant incident is a serious infringement and repeated failure is very serious.

What it means for AI agents and non-human identities

Neither the draft summaries nor Real Decreto 43/2021 mention service accounts or AI agents by name. They do not need to: the ENS measures the draft points to already govern identification, authentication and access rights for any user of a system, and the directive's Article 21 measures include access control and asset management.

• Inventory as evidence: a supervisor checking risk measures will ask which accounts can reach essential service systems. Keep a reconciled inventory of service accounts, API keys, certificates and agent identities with a named owner each. See the NHI Discovery Guide.
• Agents as change actors: an AI agent that can change configuration or move data is a privileged identity. Scope its credentials narrowly, issue them short-lived and log every action against the agent's own identity, not a shared account.
• Incident triage: the 24-hour early warning clock starts at awareness. A leaked API key or abused token needs a fast path to "is this significant?", so define criteria for machine credential incidents in advance.
• Supplier tokens: OAuth grants and integration tokens held by providers are part of the supply chain the draft asks you to manage. See the Service Account Security Guide.
• Officer remit: include machine identity governance explicitly in the responsable de seguridad's terms of reference so it is not left between IAM and platform teams.

Compliance steps

1. Confirm current status: check the BOE and lamoncloa.gob.es before acting; if a law or royal decree-law has appeared, the article numbers on this page may have moved.
2. Check NIS1 obligations first: if you are a designated operator under Real Decreto-ley 12/2018, keep your Declaración de Aplicabilidad, officer designation and platform access current. These are enforceable today.
3. Self-classify each legal entity: map Spanish entities to the annex sectors and the 50 staff / EUR 10 million test, then flag any-size cases (public control of 25% or more, sole provider).
4. Prepare registration data: legal names, tax identifiers, sectors, Member States served, contact points and IP ranges, kept in one owned record.
5. Name the responsable de seguridad: choose someone who could meet the accreditation route for essential entities and give them a written mandate covering incident notification and supplier oversight.
6. Gap assess against the ENS: use the ENS measures as the control baseline, starting with access control, authentication and logging for human and machine identities.
7. Rehearse the 24/72/30 cycle: run a tabletop that starts with a compromised service account and ends with a final report draft. Keep the Incident Response Plan Template aligned.
8. Brief the board: record approval of risk measures and attendance at training, since the draft makes management members jointly liable.

Framework mapping

Measuring readiness

• Entity classification coverage: share of Spanish legal entities with a recorded essential, important or out-of-scope decision and its rationale.
• Owned machine identities: share of service accounts, keys and agent identities in scope systems with a named owner and last review date.
• Time to significance decision: median time from detection to a documented decision on whether an incident is significant, measured in exercises.
• Supplier notification clauses: share of critical suppliers with contractual incident notification within a defined number of hours.
• Board training record: share of management body members with completed cybersecurity training in the last 12 months.

Common failure patterns

• Waiting for the BOE: with one month between publication and entry into force, teams that start late will not finish registration, officer designation and gap work in time.
• Forgetting NIS1: designated operators sometimes treat the old regime as dead while it is still the enforceable law.
• Group-level classification: classifying the group instead of each Spanish legal entity misses entities that cross thresholds on their own.
• Human-only access reviews: ENS-style access reviews that skip service accounts and agent credentials leave the most powerful accounts unexamined.
• Treating figures as final: building budgets or contracts on draft sanction ranges that may change in parliament.

Practitioner checklist

• Status of the Spanish NIS2 law re-checked on the BOE within the last month.
• Existing NIS1 designations, officer and Declaración de Aplicabilidad confirmed current.
• Every Spanish legal entity classified against sectors and size, with rationale.
• Registration data set (contacts, sectors, Member States, IP ranges) held in one owned record.
• Responsable de seguridad named with a written mandate covering machine identities and suppliers.
• ENS-based gap assessment done for access control, authentication and logging.
• Inventory of service accounts, API keys and AI agent identities with owners for in-scope systems.
• 24-hour, 72-hour and one-month notification steps rehearsed, including a credential compromise scenario.
• Supplier contracts carry incident notification and token revocation duties.
• Board approval of risk measures and training attendance recorded.

Standards and references

• European Commission TRIS: Notification 2025/0104/ES, Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad
• La Moncloa: Rueda de prensa posterior al Consejo de Ministros
• European Commission: referral of Ireland, Spain, France and the Netherlands to the Court of Justice
• BOE: Real Decreto-ley 12/2018 de seguridad de las redes y sistemas de información
• BOE: Real Decreto 43/2021 por el que se desarrolla el Real Decreto-ley 12/2018
• EUR-Lex: Directive (EU) 2022/2555 (NIS2)
• Cuatrecasas: Ciberataques en sectores críticos, a la espera de NIS2
• finreg360: El Gobierno aprueba el anteproyecto de ley que traspone la directiva sobre ciberseguridad

Related NHI Mgmt Group resources: NIS2 Directive Guide · Spain ENS Guide · NIS2 Transposition Tracker · NIS2 Readiness Checklist · France NIS2 Implementation Guide. This guide summarises Spain's draft NIS2 transposition law and the NIS1 regime as of 14 November 2026 and is not legal advice.