Skip to main content
In legislatureNIS2

NIS2 in Spain

Spain has not completed transposition. The Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad was approved by the Council of Ministers in January 2025 but remains in parliament. The NIS1 regime under Royal Decree 43/2021 still governs, and the Commission referred Spain to the CJEU on 8 July 2026.

Transposition law
Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad (not yet adopted)
In force since
Pending
Competent authority
CCN-CERT / INCIBE
Max fine (Essential)
€10 million or 2% of global annual turnover
Max fine (Important)
€7 million or 1.4% of global annual turnover
Law adopted
Not adopted

Key Deadlines

Council of Ministers approves the draft
14 January 2025
Referred to the Court of Justice of the EU
8 July 2026
Law adopted and published in the BOE
Pending

Competent Authority

CCN-CERT / INCIBE
CCN-CERT oversees public sectors; INCIBE coordinates private entities
https://www.ccn-cert.cni.es ↗

Spain distributes duties: CCN-CERT manages national security systems (ENS), while INCIBE handles commercial incident response and security support.

Registration Process

Registration portals will launch on INCIBE and CCN-CERT websites post-enactment.

📊 Quick Test

Find out if your company is in scope

Does your organisation fall under Annex I (Essential) or Annex II (Important) entities?

Check NIS2 Scope →

Key Requirements

  • 1Register with the competent authority for your sector
  • 2Implement risk remediation metrics based on Esquema Nacional de Seguridad (ENS)
  • 324-hour warning message for major network anomalies

National Additions

★Spain maps NIS2 requirements closely to its existing Esquema Nacional de Seguridad (ENS) certification levels

FAQ: NIS2 in Spain

Which rules apply in Spain until the new law passes?
The NIS1 regime under Real Decreto-ley 12/2018 and Real Decreto 43/2021 continues to apply, with CCN-CERT, INCIBE-CERT and ESPDEF-CERT handling incident routing by entity type. The draft law would create a new National Cybersecurity Centre (CNC) to coordinate policy and act as the single point of contact with ENISA, but that body does not exist until the law is adopted.
What is the role of ENS in Spain?
The Esquema Nacional de Seguridad (ENS) is Spain's established security framework, providing direct templates for NIS2 compliance.

Ready to assess your NIS2 compliance?

Use our free tools to check your NIS2 scope and run a gap assessment.

🎯 Scope Checker📊 Gap Assessment

Currency and sources

The legal details on this page were last checked on 25 July 2026.