NIS2 in Spain: law still pending, the State before the CJEU and what to do meanwhile
NIS2 in Spain still has no transposition law, and it will not get one in 2026. On 6 October, Royal Decree 806/2026 dissolved Parliament and called a general election for 29 November. Meanwhile, the European Commission keeps Spain before the Court of Justice of the EU. Here is what applies today, what the election changes and what to do this quarter.
In 30 seconds: the deadline to transpose Directive (EU) 2022/2555 passed on 17 October 2024. The January 2025 draft bill never reached Parliament and, with its dissolution, it is now on hold, so the law will not pass this year. Today nobody can fine you under NIS2 in Spain, although Royal Decree-Law 12/2018 remains in force. Its requirements also reach you through contracts, public tenders and Implementing Regulation (EU) 2024/2690.
Timeline of NIS2 in Spain
These are the official milestones of NIS2 in Spain, from the directive’s entry into force to the first sitting of the new chambers:
| Date | Milestone |
|---|---|
| 16/01/2023 | Directive (EU) 2022/2555 enters into force. |
| 17/10/2024 | The transposition deadline passes without a Spanish law. |
| 28/11/2024 | The Commission sends a letter of formal notice. |
| 14/01/2025 | The Council of Ministers approves the draft Cybersecurity Coordination and Governance Act under the urgent procedure. |
| 07/05/2025 | Brussels issues a reasoned opinion. |
| 08/07/2026 | The Commission refers Spain to the CJEU and asks for financial penalties. |
| 06/10/2026 | Royal Decree 806/2026 dissolves Parliament and calls elections for 29/11/2026. |
| 23/12/2026 | First sitting of the new Congress and Senate. |
What happened: from draft bill to dissolution
First, on 14 January 2025, the Council of Ministers approved the draft bill at first reading and fast-tracked it. According to the Ministry of the Interior, the text created a National Cybersecurity Centre and split supervision between Interior, Defence and Digital Transformation. However, that NIS2 law in Spain never reached the Official State Gazette (BOE).
The case before the CJEU
The Commission followed the steps of infringement procedure INFR(2024)0270: a letter of formal notice in November 2024 and a reasoned opinion in May 2025. Then, on 8 July 2026, it decided to refer Spain to the Court of Justice, together with Ireland, France and the Netherlands. It also asked for a lump sum and daily penalties until Spain notifies full transposition. For now there is no judgment, and the Court will set the amount.
The election on 29 November
Royal Decree 806/2026, published in the BOE on 6 October 2026, dissolved the Congress and the Senate. While the chambers stand dissolved, no bill can go through Parliament, and the new chambers will not sit until 23 December. That is why the draft bill is on hold: whichever government emerges from the polls will decide whether to take it up and send it to Parliament for the first time.
In practice, the NIS2 law in Spain will not arrive in 2026. Only a royal decree-law, the route Spain used in 2018 for the first NIS directive, could shorten the timeline. But there is no official announcement to that effect. Our estimate is that the law is unlikely before well into 2027.
What NIS2 in Spain means for your company today
A directive does not bind companies directly, but Member States. So it needs a national law with concrete obligations, a supervising authority and a penalty regime. Therefore, until that law exists, no authority can open proceedings against you under NIS2 in Spain. Moreover, the State would pay the CJEU fine, not companies.
What does remain in force is the framework of the first NIS directive: Royal Decree-Law 12/2018 and Royal Decree 43/2021. If you are an operator of essential services or a digital service provider, those obligations have not gone away. In addition, the public sector and its suppliers must meet the National Security Framework (ENS). That framework overlaps with much of the directive, as we explain in what ENS and NIS2 have in common.
Three routes by which NIS2 in Spain already reaches you
The legislative delay does not isolate you. In fact, NIS2 in Spain is already entering many companies through three doors that do not depend on the BOE:
- Through contracts. Your customers in countries that have transposed the directive must manage their supply chain. So they pass on questionnaires, notification clauses and audit rights.
- Through public procurement. Tender specifications already include security requirements, and much of what the law will demand overlaps with the ENS.
- Through the EU regulation. Implementing Regulation (EU) 2024/2690 details the measures for cloud, data centres, DNS, managed services, platforms and trust services.
That regulation applies directly, although without a national law there is no authority to supervise it. Even so, customers and auditors already use it as their technical benchmark.
What will not change when the law arrives
The directive sets minimum harmonisation: the legislator may tighten it but not water it down. So everything already in the EU text is safe ground for preparing for NIS2 in Spain:
- The ten risk-management measures of Article 21, from incident handling to multi-factor authentication.
- Reporting deadlines: early warning within 24 hours, notification within 72 hours and a final report within one month.
- The criteria for being an essential or important entity, which come from the annexes and size thresholds.
- Management accountability, since the board approves and oversees the measures and answers for non-compliance.
By contrast, the national register of entities, the final split of supervision and the exact penalty regime remain open. Identify and budget for them, but do not commit until there is a final text.
What to do this quarter about NIS2 in Spain
Waiting for the law is the worst strategy for NIS2 in Spain, because implementing Article 21 with evidence takes months. This is the order we suggest:
- Confirm whether you fall in scope and as which type of entity; our guide to checking whether your company is in scope settles it in minutes.
- Run a risk analysis per service, not a company-wide average.
- Define the incident-reporting procedure with owners, templates and the 24/72-hour clock.
- Inventory your critical suppliers and get their security commitments in writing.
- Take cybersecurity to the board with minutes, budget and a named owner.
- Reuse what you already have, because ISO 27001 or ENS controls serve NIS2 too.
If you need a calendar, follow our phased 90-day implementation plan. And to make the most of existing certifications, see why ISO 27001 works as a shortcut.
Frequently asked questions
When will the NIS2 law in Spain pass?
There is no official date. With Parliament dissolved and an election on 29 November 2026, the law will not pass this year. After that, the new government will have to take up the text again, so the prudent view is not to expect it before well into 2027.
Can anyone fine me today under NIS2 in Spain?
No, because the law that would set authorities and penalties is missing. However, authorities can still fine you under Royal Decree-Law 12/2018 if it covers you, or under the GDPR after a personal data breach. A customer may also require the measures by contract.
Who will pay the CJEU fine?
The State. The case pits the Commission against Spain, not against companies. So any lump sum and daily penalties do not pass to any business.
Does the ENS help with NIS2 in Spain?
It helps a lot, although it does not cover everything. For example, the ENS already requires risk analysis, incident management and similar technical measures. Even so, you will need to review 24- and 72-hour reporting, the supply chain and the role of management.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
At Atalaya GRC we manage NIS2 in Spain service by service, with the Article 21 measures and their evidence in one place. Thanks to the “one control, many regulations” principle, what you already hold for ENS or ISO 27001 counts here too. Moreover, the regulatory clock tracks deadlines and alerts you to every official development. When Spain publishes its law, we will update the requirements in the platform so you do not start from scratch. You will find the details on our NIS2 page.
