NIS 2 status in Spain
What the directive requires, where the Spanish transposition stands, and how CCN and INCIBE fit in the meantime.
Overview
The NIS 2 directive is the EU layer. It binds every member state, including Spain, with one cybersecurity floor for essential and important entities. Spain has to put that floor into Spanish law and run a supervision regime under it.
Spain missed the 17 October 2024 transposition deadline set in Article 41 of NIS 2. The Council of Ministers approved an Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad on 14 January 2025. In March 2026 the government said the text was still being processed by the ministries as an Anteproyecto (a government draft), and it has not been published in the Boletín Oficial del Estado.
Until the draft becomes law, the previous Real Decreto-ley 12/2018 (the NIS 1 transposition) keeps applying. Under it, supervision is split: the Interior Ministry (CNPIC) for operators designated as critical, the relevant ministry for other essential service operators, the Secretariat of State for Digitalisation for digital service providers, and the CCN for the public sector. INCIBE-CERT and CCN-CERT are the incident response teams, not supervisors. The Commission sent a reasoned opinion on 7 May 2025 and on 8 July 2026 referred Spain to the Court of Justice of the EU, asking for a lump sum and daily penalties until Spain notifies full transposition.
EU directive
Directive (EU) 2022/2555 (NIS 2)
The EU-wide cybersecurity directive. Sets the obligations every member state must transpose, including the size and sector tests for essential and important entities. The authoritative Spanish version is published on EUR-Lex.
EU implementation
Commission Implementing Regulation (EU) 2024/2690
Technical and methodological measures for digital infrastructure providers. Directly applicable in Spain without national transposition.
Spanish transposition (in process)
Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad
Approved by the Council of Ministers on 14 January 2025. The draft creates a Centro Nacional de Ciberseguridad, attached to the Secretaría General de Presidencia del Gobierno, as the single point of contact with the EU and the authority for cybersecurity crises. Supervision would sit with three control authorities: the Interior Ministry's Cybersecurity Coordination Office, the National Cryptologic Centre (Defence) and the Secretariat of State for Telecommunications and Digital Infrastructure. In March 2026 the text was still an Anteproyecto (a government draft), and it has not been published in the BOE; until it is enacted, the prior Real Decreto-ley 12/2018 (NIS 1 transposition) continues to apply.
Ley de Coordinación y Gobernanza de la Ciberseguridad (draft)
The draft carries the NIS 2 obligations into Spanish law, defines essential and important entities, sets supervision powers, incident reporting duties and sanctions. Until the law is published in the BOE, the directive binds the Spanish state, not Spanish companies; what applies to companies today is Real Decreto-ley 12/2018, for those designated under it.
Proposed Centro Nacional de Ciberseguridad and control authorities
The draft creates a Centro Nacional de Ciberseguridad, attached to the Secretaría General de Presidencia del Gobierno, as the single point of contact with the EU and the authority for cybersecurity crises. Supervision would sit with three control authorities: the Interior Ministry's Cybersecurity Coordination Office, the National Cryptologic Centre (Defence) and the Secretariat of State for Telecommunications and Digital Infrastructure. In the interim, the NIS 1 decree splits supervision between the Interior Ministry (CNPIC) for critical operators, the relevant ministry for other essential service operators, the Secretariat of State for Digitalisation for digital service providers and the CCN for the public sector. INCIBE-CERT and CCN-CERT are the incident response teams, not supervisors.
Article 41 deadline missed
Article 41 of NIS 2 set the transposition deadline at 17 October 2024. Spain has not met that deadline. The Commission sent a reasoned opinion on 7 May 2025 and on 8 July 2026 referred Spain to the Court of Justice of the EU, asking for a lump sum and daily penalties until Spain notifies full transposition.
Local law applies inside Spain
Entities established in Spain follow the Spanish transposition once it is enacted. A German Geschäftsführer running a Spanish subsidiary will read the eventual Ley de Coordinación y Gobernanza de la Ciberseguridad for that subsidiary, not the German BSIG. In the interim period, Real Decreto-ley 12/2018 applies to companies designated under it; the directive binds the Spanish state, not the subsidiary.
Spain cannot go below the EU floor
The directive is a minimum harmonisation instrument. The fact that the Spanish transposition is delayed does not lower the floor: once enacted, the Spanish law must carry at least the directive's essential and important entity duties, incident reporting deadlines and management body accountability. Until then the directive binds the Spanish state, not Spanish companies: EU case law is clear that a directive cannot by itself impose obligations on a company.
INCIBE and INCIBE-CERT
The Instituto Nacional de Ciberseguridad, attached to the Ministry of Digital Transformation. INCIBE-CERT is the reference incident response centre for citizens and private-law entities. For incidents affecting critical operators, INCIBE-CERT is operated jointly by INCIBE and the Interior Ministry's CNPIC.
CCN and CCN-CERT
The Centro Criptológico Nacional, attached to the Centro Nacional de Inteligencia (CNI). CCN-CERT, created in 2006, is the government CERT for the public sector. The CCN is governed by Law 11/2002 and Real Decreto 421/2004; Real Decreto 311/2022 regulates the Esquema Nacional de Seguridad (ENS).
ENISA
The EU cybersecurity agency. Publishes guidance, manages the European vulnerability database and supports cross-border coordination. Not a supervisor for Spanish entities. Under the NIS 1 decree the supervisors are the Interior Ministry (CNPIC), the sector ministries, the Secretariat of State for Digitalisation and the CCN; the draft law would give supervision to three control authorities, with the Centro Nacional de Ciberseguridad as the single point of contact with the EU.
If Germany has BSIG, Spain has a similar law in force.
Germany's NIS 2 law has applied since 6 December 2025. Spain has no enacted law yet: the Anteproyecto cleared the Council of Ministers on 14 January 2025, but nothing has been published in the BOE. Spanish subsidiaries cannot point to a finalised national law; what applies to them today is the previous Real Decreto-ley 12/2018, for those designated under it, while the directive shows what the Spanish law will have to contain.
There is no Spanish law in force, so nothing to do yet.
The directive has been in force since January 2023. Member States had to apply their national rules from 18 October 2024. Until Spain enacts its law, the directive binds the Spanish state, not Spanish companies: EU case law is clear that a directive cannot by itself impose obligations on a company. What applies to companies today is the NIS 1 decree (Real Decreto-ley 12/2018), for those designated under it. The 17 April 2025 deadline for Member States to be able to identify essential and important entities is binding on Spain regardless of the bill. Preparing scope checks, incident reporting processes and management body sign-off now is still sensible, because the draft follows the directive closely.
Our sector regulator will tell us what to do.
Some sectors have a clear regulator (finance with the Banco de España for credit institutions and DORA as lex specialis, energy with the Ministry for the Ecological Transition). Many do not have a single line of sight yet because the draft law has not finished defining the supervision architecture. Once the law is enacted, its obligations apply regardless of which national body ends up enforcing them.
Most Spanish mid-market operators we see treat NIS 2 as a problem they can postpone until the Boletín publishes the final law. That is an expensive bet. The directive's 17 October 2024 deadline has already passed, the Commission sent a reasoned opinion on 7 May 2025 and referred Spain to the Court of Justice of the EU on 8 July 2026, and the substantive obligations (management body approval of risk measures, 24h early warning, 72h notification, supply chain clauses) do not change between the draft and any plausible final text.
The practical move is the same as everywhere else in the EU: confirm scope under the directive, prepare for registration once Spain's law names the registration body and portal, set up the four continuous obligations (registration upkeep, incident reporting, supply chain risk management, management body oversight), and document the minimum. Existing CCN and INCIBE guidance plus Real Decreto-ley 12/2018 reporting channels remain usable while the new law is pending.
- Directive (EU) 2022/2555 (NIS 2), Article 41 transposition deadline. EUR-Lex.
- Commission Implementing Regulation (EU) 2024/2690.
- Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by the Council of Ministers on 14 January 2025. Departamento de Seguridad Nacional (dsn.gob.es).
- European Commission, reasoned opinion to Spain for failure to notify full transposition of NIS 2, 7 May 2025; referral of Spain to the Court of Justice of the EU, 8 July 2026 (IP/26/1499).
- Real Decreto-ley 12/2018, NIS 1 transposition, Boletín Oficial del Estado.
- CCN-CERT (created 2006): Centro Criptológico Nacional, governed by Ley 11/2002 and Real Decreto 421/2004; Real Decreto 311/2022 on the Esquema Nacional de Seguridad.
- INCIBE-CERT: Instituto Nacional de Ciberseguridad, Ministerio para la Transformación Digital.
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
