NIS2: what it requires and how to comply
NIS2 is the EU cybersecurity directive that binds far more companies than its predecessor. If you operate in one of its 18 sectors and have 50 or more employees or more than €10 million in turnover, it applies to you. In Spain the transposing law is still pending and the European Commission has already taken the delay to the CJEU; meanwhile its requirements reach you through contracts and public tenders. Atalaya GRC helps you comply service by service and meet every deadline.
No commitment. We’ll walk you through the platform with a real case.
- Reference
- Dir. (EU) 2022/2555
- Applies from
- 18 Oct 2024 (EU) · Spain: law pending
- Who
- 18 essential and important sectors
- If you don’t comply
- Maximum of at least €10M or 2% (essential) and €7M or 1.4% (important)
What is the NIS2 directive?
The NIS2 directive is formally Directive (EU) 2022/2555, in force since January 2023. It replaces the old NIS directive and raises the cybersecurity bar across the whole European economy. In addition, it widens the range of regulated sectors, toughens penalties and introduces personal accountability for management.
Who does the NIS2 directive affect in Spain?
The NIS2 directive applies to entities in the 18 sectors of Annexes I and II —energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, public administration, space, postal services, waste management, chemicals, food, manufacturing, digital providers and research— that are medium or large: 50 or more employees, or more than €10M in turnover.
However, there is a surprising nuance: size does not always save you. For example, an SME can still be bound if it provides a critical or unique service, if the authority designates it, or through the supply chain (a regulated customer will require measures by contract). Under the NIS2 directive, entities are classified as essential or important, with equivalent obligations but a different supervisory regime. You can also check whether NIS2 applies to your company step by step.
What does the NIS2 directive require of you?
Three areas you have to cover:
Risk-management measures (art. 21)
Security policies, access control and MFA, backups and continuity, incident management, encryption, training and supply-chain security: verifying your suppliers, not just making them sign a clause.
Notification within strict deadlines
Early warning within 24 hours, notification within 72 hours and a final report within one month of detecting the incident.
Management accountability
Management bodies must approve and oversee the measures. They must also receive risk-management training, and they are personally liable for non-compliance.
What happens if you don’t comply?
Under the NIS2 directive, the penalty regime is no longer nominal. The directive requires maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important ones, whichever is higher. On top of that, management can be penalised personally and even temporarily disqualified for serious breaches. Finally, there is a little-known risk: if the incident also involves a personal-data breach, you can face two parallel proceedings —one under NIS2 and another under the GDPR before the data protection authority—.
Situation in Spain: law pending and the State before the CJEU
Spain did not transpose NIS2 on time (17 October 2024). The Council of Ministers approved the draft Cybersecurity Coordination and Governance Act on 14 January 2025 under the urgent procedure, but as of September 2026 it has still not been published in the Official State Gazette (BOE). Then, on 8 July 2026, the European Commission referred Spain —together with Ireland, France and the Netherlands— to the Court of Justice of the EU, requesting a lump sum plus a daily penalty until transposition is notified (case INFR(2024)0270).
In the meantime the first NIS framework remains in force (Royal Decree-Law 12/2018 and Royal Decree 43/2021). Since an untransposed directive creates no direct obligations for private companies, nobody can fine you under NIS2 in Spain today. However, that does not mean you can wait: NIS2 already reaches you through contracts (customers in countries that have transposed it pass their supply-chain requirements on to you), through public tenders and the ENS, and, if you provide digital services (cloud, DNS, CDN, managed services, marketplaces…), through Implementing Regulation (EU) 2024/2690, directly applicable without any national law.
Waiting for the law does not protect you. What it demands —the article 21 measures, 24/72-hour notification and management accountability— is already fixed in the NIS2 directive, so Spanish law cannot lower it; and once published, no long transition period is expected. So whoever starts on publication day will be late. Reviewed September 2026.
Atalaya GRC
How Atalaya GRC helps you with the NIS2 directive
Atalaya GRC turns NIS2 from a chaos of spreadsheets into something you control:
- Service-by-service compliance: you know what each service complies with and what it’s missing, not a vague company-wide average.
- The article 21 measures, centralised, with their evidence and audit traceability.
- The regulatory clock also watches the notification deadlines (24h/72h) and reviews, and warns you in advance.
- One control, several regulations: reuse what you already have from ISO 27001 or ENS, so you avoid duplicating work.
Want to see it with your own services?
Request a demoFAQ
Frequently asked questions
Does NIS2 affect me?
If you’re in one of the 18 sectors and have 50+ employees or more than €10M in turnover, yes. And you can be even as an SME if you provide a critical service or a customer requires it through their supply chain.
What penalties does NIS2 carry?
Maximum fines of at least €10 million or 2% of worldwide annual turnover (essential entities) and at least €7 million or 1.4% (important entities), whichever is higher, plus the possible personal liability and disqualification of management.
What notification deadlines does it require?
Early warning within 24 hours, notification within 72 hours and a final report within one month.
Is it already in force in Spain?
Not yet as national law: the Cybersecurity Coordination and Governance Act was not passed before Parliament was dissolved (Royal Decree 806/2026, general election on 29 November 2026), and the European Commission referred Spain to the CJEU (July 2026) over the delay. The NIS1 framework (RD-Law 12/2018) remains in force, and NIS2 requirements already reach you through contracts, public tenders and, for digital providers, Implementing Regulation 2024/2690.
Does ISO 27001 help me with NIS2?
A great deal: it covers much of article 21, though you still need to complete incident notification, management accountability and supply-chain security.
