The European NIS2 directive should have been incorporated into Spanish law in October 2024. Two years later, the law has still not been published in the Official State Gazette (BOE), but its obligations are already known and many companies are receiving them through contracts with their customers.
Where the law stands
- The Council of Ministers approved the draft Cybersecurity Coordination and Governance Law on 14 January 2025.
- The European Commission sent Spain a reasoned opinion in May 2025 and in July 2026 referred the case to the Court of Justice of the EU.
- The Spanish parliament (Cortes) was dissolved on 6 October 2026, with general elections called for 29 November, before the law had been published. Its approval is now in the hands of the next legislature.
In the meantime, Royal Decree-Law 12/2018, which transposed the first NIS directive, remains in force.
What it will require
The core obligations come from the directive and are not expected to change much in the final text:
- The company's management approves the cybersecurity measures and is accountable for them.
- Documented risk management: access control, backups, patching, encryption, continuity.
- Early warning of serious incidents within 24 hours and full notification within 72 hours.
- Control of supply chain security, including IT suppliers.
Who it affects, even if they are not on the list
NIS2 applies directly to medium-sized and large entities in sectors such as energy, transport, health, water, manufacturing of certain products and digital services. But because of the supply chain requirements, their suppliers, many of them industrial SMEs, are already receiving security questionnaires and contract clauses.
What you can do now
- Check whether your activity and size place you within the scope of the directive, or whether your main customers are.
- Carry out a gap analysis against the risk management measures.
- Write an incident response procedure that allows you to meet the 24-hour deadline.
- Close off the basics any auditor will ask for: two-factor authentication, patching, immutable backups and access logging.
How we can help
We carry out the initial assessment against NIS2 and the ENS, give you a phased and costed compliance plan, and help you answer your customers' security questionnaires.