NIS2 in Spain Is Not Transposed, and RD-l 12/2018 Still Governs

Spain has not transposed NIS2. As of 10 August 2026 the transposing text is still an anteproyecto, the Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by the Consejo de Ministros on 14 January 2025 and not published in the BOE. The Commission issued a reasoned opinion on 7 May 2025 and referred Spain to the Court of Justice on 8 July 2026, with a request for a lump sum and daily penalties. That leaves a private company in a specific position. The directive’s obligations do not bind you directly. The Spanish cybersecurity rules from 2018 and 2021 do. Public bodies sit differently, and that difference is set out below.

Has Spain Implemented NIS2?

No. Directive (EU) 2022/2555 was adopted in December 2022 and set 17 October 2024 as the transposition deadline, and Spanish transposition is a separate legislative act that has not happened. That distinction matters because search results still treat October 2024 as a live compliance date for Spanish companies, and several pages state the Spanish law is already in force. It is not.

Three dated milestones describe the position. The draft was approved in first reading on 14 January 2025, with public consultation running from 16 January to 10 February 2025. The Commission moved from letter of formal notice on 28 November 2024 to reasoned opinion on 7 May 2025. On 8 July 2026 it referred Ireland, Spain, France and the Netherlands to the Court, seeking financial sanctions until complete transposition is notified.

One caution for anyone checking this independently. The Commission’s own country page for Spain was last updated on 7 July 2025 and stops at the reasoned opinion. It does not mention the July 2026 referral.

The Public Sector Cannot Rely on Non-Transposition

A directive that has passed its transposition deadline can be invoked against the state and its emanations, where the provision relied on is sufficiently clear, precise and unconditional, and national law has to be read in conformity with it wherever the wording allows. Public administration entities of central government fall inside NIS2 scope regardless of size under Article 2(2)(f).

A private manufacturer in Zaragoza can point to the absence of a Spanish law. A regional health service cannot make the same argument with the same confidence.

Spain’s Draft Cybersecurity Law Has Not Reached the Congreso

The bill sits at the pre-parliamentary stage. The Ministry of the Interior’s announcement records that the urgency procedure was applied so the text could be approved by the Government in a second reading, which is an intended step, not a completed one.

As of 10 August 2026 we found no expediente number in the Congreso database, no BOCG reference and no published dictamen from the Consejo de Estado. Several law firm notes describe the text as “en tramitación parlamentaria”, but none cites a file number, and in our assessment that phrasing is loose rather than accurate.

Spain applied the urgency procedure to this bill in January 2025. The Commission’s referral to the Court of Justice arrived in July 2026, still ahead of the law.

Spain Still Runs on RD-l 12/2018, and It Binds Only Two Categories

Under the law in force, Spanish obligations come from the NIS1 transposition: Real Decreto-ley 12/2018 of 7 September and Real Decreto 43/2021 of 26 January, which develops it. Two categories carry the duties, and both are narrower than a reader coming from the directive expects.

Operadores de servicios esenciales cover the strategic sectors listed in the annex to Ley 8/2011 on critical infrastructure protection, which is wider than NIS1 required. The point that changes a scoping exercise is that you do not classify yourself into this category. Under Article 6, essential service operators are identified by the bodies and procedures of Ley 8/2011, with the first lists drawn up by 9 November 2018 for energy, transport, health, the financial system, water and digital infrastructure, and by 9 November 2019 for the remaining strategic sectors. Absent designation, you are not an OES.

Proveedores de servicios digitales cover online marketplaces, online search engines and cloud computing services. Article 2.3(b) excludes digital service providers that are micro or small enterprises within the meaning of Recommendation 2003/361/EC, so the carve-out reaches further up than the NIS2 medium-size threshold does. Article 2.3(a) also excludes electronic communications operators and trust service providers unless they have been designated as operadores críticos under Ley 8/2011.

If your scoping is built on the directive’s Annexes rather than on Spanish law, the two lists diverge here, and it is worth checking whether NIS2 applies to your company separately from checking whether RD-l 12/2018 already does.

What Are the Tiers of NIS2, and Which One Applies in Spain?

NIS2 splits entities into essential and important, with heavier supervision and a higher penalty ceiling for essential entities. Neither label has legal force in Spain, because the labels arrive with the transposing law, and the categories that bite under the current regime are operadores de servicios esenciales and proveedores de servicios digitales.

Classifying yourself as an essential entity under the directive tells you what is coming. It does not tell you what a Spanish supervisor can act on. The NIS2 Applicability Checker places you against Annex I and Annex II, which is the floor the Spanish law will build on. Expect the Spanish text to sit above that floor rather than on it, since the draft extends coverage to small and micro-enterprises in digital infrastructure.

Incident Reports Go Through Your CSIRT de Referencia

Notification runs through the CSIRT de referencia rather than to a single national regulator, and which one you use depends on what you are, not on what happened. Private-sector essential service operators report to INCIBE-CERT, which is operated jointly with CNPIC for critical operators. Public-sector entities within Ley 40/2015 report to CCN-CERT. Operators with an impact on national defence report to ESPDEF-CERT. Digital service providers also report through INCIBE-CERT under Article 11.1(b), while their supervisory authority is the Secretaría de Estado de Digitalización e Inteligencia Artificial under Article 9.1(b). Those are two different bodies with two different roles, and treating the supervisor as the reporting channel sends the notification to the wrong desk during the hour it matters.

The trigger is an incident assessed at impact or dangerousness level crítico, muy alto or alto, and the structure is three notifications: inicial, intermedia and final. On timing, Article 22.1 of RD-l 12/2018 requires the initial notification without undue delay, and RD 43/2021 requires it as soon as the operator has enough information to determine that the thresholds are met. The reporting window table sits in the annex to RD 43/2021 and in the Guía Nacional de Notificación y Gestión de Ciberincidentes approved on 21 February 2020, at section 6.5, and we could not confirm specific hour figures in either primary text. Anything presenting 24 hours, 72 hours and one month as the Spanish rule in force is quoting NIS2, not RD 43/2021. INCIBE’s FAQ confirms the CSIRT de referencia route. A notification under RD 43/2021 does not replace an AEPD notification under Article 33 GDPR.

Fines Under the Law in Force Stop at €1 Million, Not €10 Million

Article 37 of RD-l 12/2018 sets three bands: infracciones muy graves attract €500,001 to €1,000,000, infracciones graves attract €100,001 to €500,000, and infracciones leves attract a warning or up to €100,000. Article 36 defines which conduct falls where, and repeated failure to notify significant incidents becomes a muy grave infringement from the second occurrence.

The €10 million ceiling most coverage quotes is in a draft. The ceiling a Spanish supervisor can apply is €1 million, under Article 37 of a law in force since September 2018.

Two features soften that. Article 39 lets the authority issue an apercibimiento instead of opening proceedings for leve and grave infringements, provided the entity has not been sanctioned or warned in the previous two years, with specified exceptions. Article 40 removes fines entirely for public administrations, replacing them with a corrective resolution and possible disciplinary proceedings. Article 18 also gives precedence to sector-specific rules that impose at least equivalent obligations, which is where regulated sectors find their real supervisor.

NIS2 Registration in Spain Waits for an Authority That Does Not Exist

There is no NIS2 registration obligation in Spain and no portal to register with. The self-registration duty for essential and important entities exists only in the draft, where transitional provisions set up a Registro de entidades run through the Centro Nacional de Ciberseguridad. That body is created by the law, so it cannot open a register before the law exists. Spain has also not established the NIS2 single point of contact through which Article 27 information would reach ENISA, which is the mechanic behind the ENISA registry rather than a scope rule.

One registration-shaped duty does exist, and it predates NIS2 entirely. Article 7 of RD-l 12/2018 requires digital service providers to communicate their activity to the competent authority within three months of starting it, for information purposes. That is not NIS2 registration, and it does not become NIS2 registration by being the only obligation of its shape on the books.

On scope by size, the directive treats DNS service providers, TLD name registries and trust service providers as covered regardless of size under Article 2(2)(a), entities providing domain name registration services under Article 2(4), and CER critical entities under Article 2(3). Cloud providers, data centres, CDNs and managed service providers stay subject to the Article 2(1) size test unless a member state pulls them in on the criteria in Article 2(2)(b) to (f). The Spanish draft does exactly that for digital infrastructure.

The Draft Would Raise the Ceiling Tenfold and Reach Directors Personally

The draft sets penalty ceilings at the NIS2 minimum in Article 34(4) of the directive: up to €10 million or 2% of worldwide annual turnover for entidades esenciales, whichever is higher, and up to €7 million or 1.4% for entidades importantes. Law firm analyses of the text put the practical range across leves, graves and muy graves at €10,000 to €10 million, and the per-article amounts are not confirmed in the published draft text.

The provision worth taking to your board is not the ceiling. Analyses of the draft report that members of governing bodies would answer jointly and severally for the entity’s infringements, with temporary disqualification from management functions also available. Article 20 of the directive requires management body accountability but does not expressly require joint and several liability, so this reads as Spanish gold-plating rather than a directive floor. Whether it survives to the BOE version is unsettled.

The draft also introduces state vetting of cybersecurity personnel modelled on private security regulation. Financial entities covered by DORA are excluded from the risk management, incident reporting and sanctions provisions, which matters less than it sounds. DORA has applied directly since 17 January 2025 and already carries its own incident reporting regime.

ENS Certification Would Become the Compliance Route for Essential Entities

The Esquema Nacional de Seguridad, Real Decreto 311/2022 of 3 May, is not a public-sector-only scheme, which is the assumption the name invites. It applies to the public sector and to private providers delivering services to it, with three categories, básica, media and alta, and certification for media and alta issued by bodies accredited with ENAC.

Under the draft, entidades esenciales would need ENS certification while entidades importantes could choose certification or self-assessment, and ENS compliance would evidence the adoption of the relevant measures. The CCN states that RD 311/2022 already includes all the requirements of the NIS2 Directive. Our read is that the claim carries an institutional interest, since the CCN runs ENS, and that the draft’s own wording is narrower than the claim. The presumption attaches to the measures, not to the directive as a whole.

Germany, the Netherlands and Estonia Have Transposed. Spain and France Have Not.

Both laggards were referred to the Court of Justice on 8 July 2026. Germany published NIS2UmsuCG in the Bundesgesetzblatt on 5 December 2025, with the law in force from 6 December 2025 and the BSI registration deadline passing on 6 March 2026. The Dutch Cyberbeveiligingswet cleared the Senate on 7 July 2026 and takes effect on 15 August 2026. Estonia’s transposing law has been in force since 1 January 2026, with self-registration closing on 1 April 2026. France’s projet de loi Résilience remains pending.

For a group operating across these markets the asymmetry is administrative rather than technical. A German subsidiary has been registered and supervised since March 2026 while the Spanish entity has no register to join. Our NIS2 transposition status for all 27 member states tracks where each one stands.

Classification Is the Work That Does Not Wait for the BOE

Everything that depends on the new law is blocked. Everything that depends on the directive’s Annexes, or on the law already in force, is not.

The first question is whether you have been designated an operador de servicios esenciales under Ley 8/2011 procedures, because designation, not self-assessment, is what puts you inside RD-l 12/2018. The second is whether you are a proveedor de servicios digitales above the micro and small threshold, in which case the Article 7 comunicación de actividad applies and the three-month clock started when you began the activity. The third is your Annex I and Annex II position under the directive, which is the classification the Spanish law will adopt as its floor. Run it through the NIS2 Applicability Checker and keep the output dated.

The fourth is operational rather than legal. Knowing whether your report goes to INCIBE-CERT or CCN-CERT, and that the trigger is a crítico, muy alto or alto assessment, is worth more during an incident than the full NIS2 requirements set will be afterwards.

When the law reaches the BOE, transitional registration windows will run from publication rather than from the dates written into the draft, since the 17 April 2025 milestone in the text has already expired. The entities that move fastest will be the ones holding a dated classification file and an ENS position before the clock starts. Our directory lists compliance providers covering NIS2 for anyone who needs external help with either.