NIS2 in Spain
What binds you in Spain is the national law transposing NIS2 — not the directive itself. Here is who supervises you, where you register, and where you report.
Reviewed . Verify against the national official journal before relying on this for a filing.
National transposition
Referred to the Court of Justice
The European Commission referred this member state to the Court of Justice of the European Union in its July 2026 infringement package for failing to fully transpose NIS2, asking the Court to impose a lump sum and daily penalty payments.
This does not suspend your obligations. The directive still binds the member state, and entities are expected to be working to article 21(2) regardless of how late the national text is.
Status of the national text · Draft — not yet in parliamentary procedure
Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad
Approved by the Council of Ministers on 14 January 2025 and still not introduced in Parliament as of early 2026; nothing published in the BOE by mid-2026. Spain missed the 17 October 2024 deadline and the European Commission issued a reasoned opinion in May 2025 — a step further along the infringement procedure than a letter of formal notice.
This is not the article you read in the directive
Because no law is in force, there is no national article to plan against. Entities operating in Spain are working directly from the directive and from sector guidance, which is the least comfortable position in the Union.
Who supervises you
INCIBE / CCN is the competent authority designated by Spain. It holds the article 32 and 33 supervisory powers: inspections and audits, requests for information and evidence, binding instructions, orders to remedy deficiencies, and administrative fines. For essential entities those powers are exercised ex ante — without needing any indication of non-compliance.
Incident notifications under article 23 normally go to INCIBE-CERT, though some member states route them through the competent authority instead. Confirm the channel before you need it: the 24-hour clock is not the moment to discover which portal applies.
What differs from the directive
Because NIS2 is a directive, Spain legislated its own version of it. The security baseline in article 21 is common across the Union and will not differ. What does differ:
- Registration. The portal, the information required and the deadline are national.
- Scope. Several member states extended coverage below the directive's size thresholds, or added sectors of national importance.
- Penalty calibration. The article 34 ceilings are common; how the authority calibrates within them is not.
- Reporting format. Deadlines are fixed by the directive; the form and the language are national.
Transposition is not complete here
That is not a reason to wait. The article 21 measures are fixed and will not change; only the procedural detail is pending. Organisations that waited are now compressing an 18-month programme into whatever time the national law leaves them. The European Commission opened infringement procedures in 2025 against member states that missed the 17 October 2024 deadline.
If you operate in several member states
You have one security programme and several compliance relationships. Registration, supervision and reporting are per-jurisdiction, and a cross-border incident can require filings in each affected member state. Article 26 sets jurisdiction rules — generally the member state of establishment, with specific rules for digital providers.