Spain NIS2 Transposition (Ley de Coordinación y Gobernanza de la Ciberseguridad)
Spanish draft law transposing NIS2 and creating a National Cybersecurity Centre; still in legislative procedure as of August 2026.
| Jurisdiction | Spain |
|---|---|
| Category | Cybersecurity |
| Status | Proposed |
| Latest development |
Analysis
Spain is still in the process of transposing NIS2 through the Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by the Council of Ministers on 14 January 2025 but not yet enacted as of mid‑2026.Anteproyecto DSN note (EN) DSN press release (ES) Spanish Interior Ministry draft text (PDF)
Below is a structured analysis based primarily on the official draft law, Spanish government communications, and EU NIS2 sources. Since the law is not yet final, all requirements are subject to change during the parliamentary process.
Key Requirements
Basis: Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad (draft law) and Directive (EU) 2022/2555 (NIS2).
- Scope of entities (essential and important entities)
- The draft law transposes the NIS2 categories of essential and important entities (e.g., energy, transport, health, digital infrastructure, public administration, ICT service management) into Spanish law.Draft law PDF – Interior Ministry DSN note on NIS2 objectives Directive (EU) 2022/2555 on NIS2
- It explicitly states that its objective is to incorporate NIS2 into the Spanish legal order, aligning sectoral coverage and risk‑based thresholds.DSN press release (ES) RISI NIS2 Spain status
- Creation of the Centro Nacional de Ciberseguridad (CNC)
- A National Cybersecurity Centre (Centro Nacional de Ciberseguridad) attached to the Presidencia del Gobierno is created as the single national competent authority, single point of contact for cross‑border cooperation, and national cyber‑crisis management authority.DSN press release (ES) DSN note (EN) NIS2 timeline – Spain description
- The CNC is tasked with the direction, promotion and coordination of all activities in the law and acts as the single point of contact for EU‑level cooperation.DSN press release (ES) BOE – Order PJC/522/2025 referencing CNC
- Governance and distribution of supervisory competences by sector
- The draft law sets up a distribution of supervisory and enforcement competences across sectoral authorities (e.g., energy, financial, health, transport), coordinated by the CNC, in line with NIS2 requirements for national authorities.A3Sec article on NIS2 in Spain DSN press release (ES) NIS2 Directive – national authorities framework
- Risk management and technical–organizational cybersecurity measures
- Organizations in scope must implement risk‑management measures and technical and organizational controls in line with NIS2 Article 21 (e.g., incident handling, supply chain security, policies for cryptography and access control, secure development practices).Directive (EU) 2022/2555 Article 21 Angel Ortega – overview of obligations PwC – NIS2 implementation in Spain (PDF)
- The Spanish draft law is designed to integrate national elements such as the Esquema Nacional de Seguridad (ENS), leveraging existing security baselines for public sector and connected providers.Inza blog on NIS2 & DORA BOE – ENS (Royal Decree 311/2022)
- Incident reporting obligations and timelines
- NIS2 requires a three‑stage reporting regime: early warning within 24 hours, incident notification within 72 hours, and final report at latest one month after.Directive (EU) 2022/2555 Articles 23–24 European Commission NIS2 overview PwC Spain NIS2 status (PDF)
- The Spanish draft law mirrors and operationalizes these reporting obligations through the national CSIRT network and the CNC as the central coordinator.Draft law PDF – Interior Ministry DSN note (EN)
- Supervision, enforcement and sanctions
- NIS2 obliges Member States to establish administrative sanctions, including fines that can reach up to 10 million EUR or 2% of global turnover for essential entities, and 7 million EUR or 1.4% for important entities.Directive (EU) 2022/2555 Article 34 European Commission Q&A on NIS2
- The Spanish draft law sets out a graduated sanction regime, classifying infringements and aligning fine levels with NIS2 parameters, with enforcement executed by sectoral authorities under the coordination of the CNC.Draft law PDF – Interior Ministry A3Sec NIS2 in Spain
- National strategies and crisis management framework
- The law supports a national cybersecurity strategy and crisis management plans, integrating NIS2 requirements on cyber crisis management and EU‑level coordination (e.g., CyCLONe).DSN note (EN) Inza blog – governance and national strategies Directive (EU) 2022/2555 Chapter III
Compliance Challenges
Many challenges are already visible even though the law is not yet in force.
- Legal uncertainty due to delayed transposition
- Spain missed the NIS2 transposition deadline of 17 October 2024, and as of mid‑2026 the main transposition law has not been enacted, leaving organizations in a transitional and uncertain compliance scenario.Directive (EU) 2022/2555 Article 41 Angel Ortega – status and deadlines NIS2 transposition status – Spain
- Analyses note that the draft law approved in January 2025 “is still awaiting parliamentary approval” in 2026, complicating planning for organizations.PwC Spain NIS2 status (PDF) RISI NIS2 Spain overview
- Complexity of scoping and sector classification
- Organizations struggle to determine whether they qualify as essential or important entities and under which sectoral authority they will fall, especially in cross‑sector and digital services contexts.Directive (EU) 2022/2555 Annexes I and II A3Sec NIS2 obligations in Spain NIS2 Spain – RISI industry note
- Integration with existing frameworks (ENS, ISO 27001, sectoral rules)
- Spain already has the Esquema Nacional de Seguridad (ENS) for public sector and certain connected operators, creating overlap and the need to harmonize ENS controls with NIS2 obligations.BOE – ENS Royal Decree 311/2022 Inza blog – ENS integration PwC Spain NIS2 status (PDF)
- Organizations that already follow ISO/IEC 27001 or sector‑specific cyber norms must reconcile overlapping requirements and reporting lines.ISO/IEC 27001:2022 overview – ISO European Union Agency for Cybersecurity (ENISA) NIS2 guidance
- Operationalizing incident reporting (24h/72h regime)
- Many entities find it challenging to implement the early‑warning and phased incident reporting regime (24h ‑ 72h ‑ one‑month) required by NIS2 and expected in the Spanish law.Directive (EU) 2022/2555 Articles 23–24 European Commission NIS2 overview PwC Spain NIS2 status (PDF)
- Resource constraints, especially for medium‑sized “important entities”
- Analyses of NIS2 implementation emphasize that important entities, including medium‑sized providers in sectors like digital services and manufacturing, may face significant costs in upgrading security, reporting and governance capabilities.ENISA NIS2 impact analysis European Commission NIS2 factsheet A3Sec NIS2 obligations in Spain
- Example: delayed national framework complicating industry preparation
- Professional analyses highlight that many Spanish organizations have started NIS2 readiness projects based on the draft law, ENS and EU‑level guidance, but lack of definitive national rules complicates concrete implementation and investment decisions.PwC Spain NIS2 status (PDF) Angel Ortega – Q&A on NIS2 law status NIS2 Spain status – external tracker
Implementation Best Practices
These practices align with NIS2 core obligations and what the Spanish draft law is expected to require. They are not yet codified in final Spanish statutory text.
- Conduct a formal NIS2/Spain scoping assessment
- Map your services and operations against NIS2 Annex I & II sectors and entity types to determine whether you are likely to be an essential or important entity under the future Spanish law.Directive (EU) 2022/2555 Annexes I & II European Commission NIS2 overview PwC Spain NIS2 status (PDF)
- Align with ENS and recognized cybersecurity frameworks
- For entities interacting with the public sector or critical services, align controls with the Esquema Nacional de Seguridad (ENS) (categorization, measures, continuous improvement), which the draft law is expected to leverage.BOE – ENS Royal Decree 311/2022 Inza blog – ENS and NIS2 in Spain DSN note – role of national strategies and governance
- Use mature frameworks such as ISO/IEC 27001 and ENISA’s NIS2 implementation guidance to structure your Information Security Management System (ISMS) and risk controls.ISO/IEC 27001:2022 overview – ISO ENISA NIS2 implementation guidance European Commission NIS2 toolbox
- Establish incident reporting processes aligned with NIS2 timings
- Build internal playbooks that support 24‑hour early warnings, 72‑hour incident notifications and one‑month final reports, even before the Spanish law is finalized, to avoid later operational gaps.Directive (EU) 2022/2555 Articles 23–24 European Commission NIS2 factsheet ENISA incident reporting best practices
- Integrate governance: board oversight and accountability
- NIS2 requires management body responsibility for cybersecurity risk‑management and may include personal liability in some contexts; the Spanish law mirrors this governance emphasis.[Directive (EU) 2022/2555 Article 20](https://eur-lex.europa.eu
Recent developments
- — Guía de obligaciones de ciberseguridad para empresas en 2026 que explica que la Ley de Coordinación y Gobernanza de la Ciberseguridad sigue en tramitación a 11 de agosto de 2026 y detalla el régimen NIS2 previsto (sectores afectados, obligaciones de gestión de riesgos, notificación y sanciones), subrayando el impacto esperado para entidades esenciales e importantes.[7] (source)
- — Análisis actualizado que señala que, a 4 de agosto de 2026, la Ley de Coordinación y Gobernanza de la Ciberseguridad aún no se ha publicado en el BOE y que España ha sido remitida al Tribunal de Justicia por el retraso en la transposición, describiendo además que siguen vigentes el régimen NIS1 (RDL 12/2018 y RD 43/2021) y las implicaciones prácticas para las organizaciones.[5] (source)
- — Resumen de la situación de la transposición NIS2 en España a 6 de agosto de 2026, indicando que la Ley de Coordinación y Gobernanza de la Ciberseguridad, aprobada como proyecto por el Consejo de Ministros el 14 de enero de 2025, continúa su tramitación parlamentaria sin haber sido aún promulgada, y describiendo su papel como norma principal de implementación de la Directiva (UE) 2022/2555.[4] (source)
- — Artículo sobre el impacto de NIS2 en la empresa valenciana que destaca que el anteproyecto de la Ley de Coordinación y Gobernanza de la Ciberseguridad, concebido para transponer NIS2, sigue pendiente de aprobación parlamentaria en julio de 2026 y analiza cómo las futuras obligaciones de ciberseguridad obligatoria afectarán a empresas de distintos tamaños y sectores.[2] (source)
- — Artículo actualizado a 20 de julio de 2026 que explica que el plazo de transposición venció el 17 de octubre de 2024 y que España aún no ha adaptado la norma, describe el estado del anteproyecto de la Ley de Coordinación y Gobernanza de la Ciberseguridad y recoge que el 8 de julio de 2026 la Comisión Europea llevó a España ante el Tribunal de Justicia por no transponer las normas de ciberseguridad, ofreciendo además recomendaciones prácticas para las empresas mientras llega la ley.[1] (source)
- — Actualización de cumplimiento NIS2 junio–julio 2026 que menciona que se espera que la transposición española, mediante la Ley de Coordinación y Gobernanza de la Ciberseguridad, se complete a finales de 2026, y comenta la necesidad de que las organizaciones aceleren la preparación de sus controles y procesos de seguridad ante el previsible cierre del calendario regulatorio.[10] (source)
- — Informe sobre las obligaciones NIS2 que llegan en 2026 en España, resaltando la presión de la Comisión Europea que evaluará en septiembre de 2026 los progresos de la transposición y detallando las nuevas exigencias para entidades esenciales e importantes, incluida responsabilidad del órgano de dirección, gestión de riesgos y requisitos de reporte de incidentes.[3] (source)
- — Guía práctica de adaptación a NIS2 para pymes que indica que España ha realizado una transposición parcial mediante el Real Decreto-ley 7/2025 mientras la Ley de Coordinación y Gobernanza de la Ciberseguridad se tramita, y expone medidas de cumplimiento recomendadas y el impacto específico para pequeñas y medianas empresas.[12] (source)
- — Artículo dirigido a pymes que señala que, a marzo de 2026, la Ley de Coordinación y Gobernanza de la Ciberseguridad todavía no se ha publicado en el BOE y que su aprobación definitiva se prevé a lo largo de 2026, analizando las futuras obligaciones NIS2 y el impacto operativo y de inversión para pequeñas empresas.[9] (source)
- — Entrada de blog que revisa “qué está pasando en España con la Directiva NIS2”, incluyendo estimaciones de fechas más optimistas para la aprobación de la Ley de Coordinación y Gobernanza de la Ciberseguridad (mayo o junio de 2026) y comentando las tensiones entre plazos europeos, fondos comunitarios y preparación del tejido empresarial.[14] (source)
Related regulations
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
- Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
Put it into practice
- Generate the policy: NIS2 policy generator (generatepolicy.com)
- Buy the policy pack: NIS2 Compliance Policy (cyberpolicy.shop)
- Build it yourself: DORA + NIS2 EU Compliance Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates