Spain dissolved its parliament, and the NIS2 bill that never reached it now has nowhere to go
· Cryptaguard · 6 min read
Real Decreto 806/2026, in the BOE of 6 October, dissolves both chambers of the Cortes Generales and calls elections for 29 November. Spain has been the only member state whose NIS2 transposition never left the administrative stage, and the chamber it was meant to reach has now been abolished until 23 December. Nothing lapsed, because nothing had been introduced. What closed is the route.
What happened
On Monday 5 October the Spanish Council of Ministers approved a royal decree dissolving both chambers of the Cortes Generales and calling general elections. It was published the next morning and took effect the same day.
Quedan disueltos el Congreso de los Diputados y el Senado elegidos el dia 23 de julio de 2023. Se convocan elecciones a ambas Camaras, que se celebraran el domingo 29 de noviembre de 2026.Real Decreto 806/2026, de 5 de octubre, articles 1 and 2, BOE no. 248 of 6 October 2026
The same decree sets the campaign from 13 to 27 November and the constitutive sessions of the new chambers for 23 December at ten in the morning. That is the date worth writing down, because it is the first moment at which a Spanish parliament exists again.
None of this is about cybersecurity. It is about Spanish politics, and we take no view on that. It matters here for one reason: Spain is the member state whose NIS2 transposition had the furthest left to travel, and the institution it had to travel through has just been dissolved.
Where the Spanish NIS2 law actually was
Not in Parliament. This is the part that most trackers get wrong, and the distinction now carries weight.
The transposing vehicle is the Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad. The Council of Ministers approved it on 14 January 2025 and agreed to handle it under an urgent administrative procedure so that it could come back for a second reading quickly. It never came back. Twenty-one months later it had still not been approved in second reading, had never been registered in the Congreso, and had no expediente number, because an anteproyecto is a government draft and not yet a bill. It was in the ministries, not the chamber.
The distinction that decides what follows
An anteproyecto is not a proyecto de ley. The first is a draft inside the executive; the second is a bill before Parliament, with a number you can look up. Spain has only ever had the first. Any tracker that showed the Spanish law as "in parliamentary procedure" was describing something that did not exist.
So nothing lapsed. That is not good news
Article 207 of the Congress rules of procedure is blunt: once the Congress is dissolved, every matter pending examination and resolution by the Chamber lapses, bar what its standing deputation must constitutionally handle. Hundreds of bills died on 6 October.
The NIS2 draft was not among them, for the only reason available: it was never there to die. The file sits where it sat, inside the executive, untouched by the dissolution.
What the dissolution removed is not the text but the destination. Until 23 December there is no Congreso to receive a bill. And once the election has been held, a second lock engages that is easy to confuse with the first: under the Government Act of 1997 the Government ceases after general elections are held, continues in a caretaker capacity until a new Government takes office, and in that capacity may not present bills to either chamber.
Two locks, not one
The two locks have different dates. The dissolution bites now, on 6 October. The caretaker restriction bites only after the election is held on 29 November, because that is when the Government ceases. Today Spain has a full Government and no Parliament. From 29 November it will have a new Parliament and a caretaker Government. Only when a new Government takes office are both locks clear.
Put the sequence together and the floor is this: the earliest a Spanish NIS2 bill can be presented is after a government is formed following the November election. Then it still has to be approved in second reading by the Council of Ministers, registered, amended in committee and voted in both chambers. We give no date for any of that, and nobody honestly can.
The sibling directive did lapse, and it shows the cost
NIS2 has a twin, the CER directive on the resilience of critical entities. Spain transposed neither, but it got further with CER: that text had reached the Congreso as a proper bill and was at the committee amendment stage.
It lapses. The register of texts falling with the dissolution carries it by its expediente number, and the published bill is on the Congress site where it has been since March. For the next Spanish government, transposing CER now means starting the parliamentary stage again from the beginning.
That is the practical demonstration of what dissolution costs, applied to the directive next door. NIS2 escaped it only by being further behind.
What an entity in Spain owes today
Under Spanish law, nothing new. That has been true since 17 October 2024 and the dissolution does not change it. A directive that has not been transposed does not by itself impose duties on private entities, and there is no Spanish article number to plan against. Real Decreto-ley 12/2018, the NIS1 transposition, still applies to those it covered.
Which is a worse position than it sounds, not a better one. Two years of standing still have produced no lead-in period, no registration portal, no national assessment framework for private entities and no published supervisory expectations. The ENS binds the public sector and its suppliers and is the natural reference point, but it is not a NIS2 scheme. Supervision remains split between INCIBE and the CCN. When the law does arrive, it will arrive into a market that has had no practice.
And the Commission is not waiting on Spanish electoral arithmetic. A letter of formal notice went out in November 2024, a reasoned opinion in May 2025, and in July 2026 Spain was referred to the Court of Justice alongside Ireland, France and the Netherlands, with a request for a lump sum and daily penalties. Those fall on the state, not on companies, so they are not a reason for a Spanish firm to act. They are a reason to expect that whatever text finally lands will not be gentle about timetables.
What to do instead
Plan against article 21(2) of the directive. Ten measures. The member states that have transposed have overwhelmingly carried them across in the directive order without inventing an eleventh: Austria in section 32(4), Romania in article 13, Luxembourg in article 12(2), each a list of ten in the same sequence. Work built against the directive is not work built against the wrong thing, and it will not have to be restarted when the Spanish text appears.
Then separate where you are headquartered from where you operate. Lateness is national; scope is not. A Spanish group with a subsidiary, a plant or a service in Germany, Italy, Belgium, the Netherlands, Austria, Poland or any of the two dozen states where transposition is in force owes those obligations now, under those laws, with those reporting clocks and those supervisors. The Spanish delay suspends none of it, and the Spanish group is the one most likely to have assumed it did.
Where the next real signal will appear
If you track this yourself, watch for one specific event and ignore the rest: a second approval by the Council of Ministers followed by registration in the Congreso, which produces an expediente number and a BOCG reference. Until those exist there is no bill, whatever is announced. Spain has spent twenty-one months demonstrating exactly that.
- Real Decreto 806/2026, in the BOE of 6 October 2026, dissolves the Congreso and the Senado and calls general elections for 29 November 2026. The new chambers are constituted on 23 December 2026.
- Spain has no NIS2 transposition law. Its draft, approved by the Council of Ministers on 14 January 2025, was never introduced in Parliament and has no expediente number.
- Nothing lapsed for NIS2, because nothing was pending. Article 207 of the Congress rules kills matters before the Chamber, and the draft was never there. What closed is the route, not the text.
- Two separate locks, two dates. The dissolution removes the recipient chamber now; the caretaker restriction on presenting bills applies only after the election is held on 29 November. Both clear only when a new Government takes office.
- The sibling CER bill on critical entities had reached the Congreso and does lapse. Its parliamentary stage starts again from zero.
- Nothing new is owed under Spanish law today, and that is the problem: no portal, no national framework for private entities, no practice, and a Court of Justice referral running since July 2026.
- Plan against article 21(2) of the directive, and treat every member state where you operate as owing its own obligations now. Spanish delay suspends nothing outside Spain.