NIS2 is the European directive that raises the cybersecurity bar for medium-sized and large companies in relevant sectors. In Spain it does not yet bind companies, because the transposing law has not been published. Using official sources and as of 15 October 2026, this guide for SMEs sets out who would be in scope, what will be required, how it reaches your supply chain and what you can do in 90 days without waiting for the Spanish official gazette.
General information, not legal advice. This text does not determine whether your company is subject to NIS2 and does not replace the judgement of a lawyer or your compliance officer. Each section links its source and shows the date it was last verified; if anything has changed since, the official text prevails.
Transposition status in Spain
Directive (EU) 2022/2555 required Member States to adopt and publish their transposition measures by 17 October 2024 (Article 41). This is what official sources show:
| Date | Milestone | Source |
|---|---|---|
| 17-10-2024 | Transposition deadline | Directive, Art. 41 |
| 28-11-2024 | The Commission sends letters of formal notice to Member States without full transposition, Spain included | Commission, IP/26/1499 |
| 14-01-2025 | Spain's Council of Ministers approves the draft Law on Cybersecurity Coordination and Governance | National Security Department (DSN) (in Spanish) |
| 21-02-2025 | Spain notifies the draft to the Commission (TRIS 2025/0104/ES) | TRIS database |
| 07-05-2025 | The Commission issues a reasoned opinion | Commission, IP/26/1499 |
| 08-07-2026 | The Commission decides to refer Spain to the EU Court of Justice and asks for financial penalties | Commission, IP/26/1499 |
| 06-10-2026 | The BOE publishes Royal Decree 806/2026: the Cortes are dissolved and elections set for 29-11-2026; the new chambers will convene on 23-12-2026 | BOE-A-2026-20742 (in Spanish) |
The list of government bills of the XV Legislature in the Congress open data, checked on 15-10-2026, contains no cybersecurity or NIS2 bill, and the consolidated-legislation database of the BOE returns no cybersecurity law published since 17-10-2024. In practice the text remains a government draft and, with the Cortes dissolved, cannot be processed as a bill until the new chambers are constituted. No approval date can be predicted.
Last verified: 15-10-2026.
Which rules apply today
Until then, Royal Decree-Law 12/2018 (the NIS1 transposition) and its implementing regulation apply (both in Spanish). Their scope (Art. 2) is essential services in the strategic sectors of Law 8/2011 and certain digital services (online marketplaces, search engines and cloud computing); most SMEs were outside it. If you supply the public sector, the ENS may apply to the systems you use to deliver the service (Art. 2(3) of Royal Decree 311/2022), as explained in our guide to ENS and ISO 27001.
Last verified: 15-10-2026.
Why prepare anyway
- The content is already known. The Article 21 measures are set out in the directive and will only bind companies once the national law exists; in addition, Spain told the Commission that its law will include a catalogue of risk-management measures, stronger incident notification and the role of an information security officer (TRIS).
- Contractual pressure does not wait. A customer can ask for security evidence before the law exists.
- Details may change. In January 2026 the Commission proposed targeted amendments to NIS2, including a new category of small mid-cap companies (IP/26/105). At 15-10-2026 the file is awaiting a committee decision in the European Parliament (2026/0012(COD)); it is not law. It also proposes simplifying the jurisdiction rules, so what we say about the applicable Member State may change.
If you also operate in Portugal
Portugal has transposed the directive: Decree-Law 125/2025, published on 4-12-2025, approves the cybersecurity legal regime and enters into force 120 days after publication (Art. 11), that is, in early April 2026; the National Cybersecurity Centre (CNCS) is the national cybersecurity authority. The CNCS's Regulation 756/2026, published on 22-06-2026 and in force the next day, sets out the electronic platform, the self-identification and qualification of entities, incident notification and the minimum measures. Entities already operating had to self-identify on that platform within 60 days of it becoming available, and entities starting activity within 30 days (Art. 8(1) of the regime); confirm with the CNCS when the platform opened and what your deadline is. As a general rule, each entity falls under the jurisdiction of the Member State where it is established (Article 26(1) of the directive), with exceptions: managed service providers, cloud and data-centre providers, among others, fall under the Member State of their main establishment in the Union (Article 26(1)(b) and 26(2)). If your company operates in several countries, confirm with your legal adviser which regime applies. Some specific obligations (cybersecurity measures, supply chain, residual risk and the annual report) take effect only 24 months after their implementing regulation is published (Art. 10(2) of the decree-law); in our reading that period runs from the publication of Regulation 756/2026. If your company is established in Portugal, confirm the timetable with the CNCS or your legal adviser.
Last verified: 15-10-2026.
Is your SME in scope?
The directive applies to public or private entities of the types listed in Annexes I and II that are medium-sized or larger and provide services or carry out activities in the Union (Art. 2(1)). Check in three steps.
Step 1: sector. Annex I (sectors of high criticality) includes, among others, energy, transport, banking, financial markets, health, water, digital infrastructure (cloud, data centres, DNS, electronic communications), ICT service management between businesses, public administration and space. Annex II includes postal services, waste, chemicals, food, certain manufacturing, digital providers and research. Your type of entity must appear in the official text.
Step 2: size. Under the Commission's SME definition, a medium-sized enterprise has fewer than 250 people and turnover of up to EUR 50 million or a balance sheet of up to EUR 43 million; a small one has fewer than 50 people and up to EUR 10 million. So from 50 people, or with both turnover and balance sheet above EUR 10 million, you are no longer "small". Figures can include those of partner or linked enterprises in the group.
Step 3: exceptions regardless of size. The directive also reaches, among others, providers of public electronic communications, trust services, DNS and top-level domain registries, the sole provider of an essential service in a Member State, and entities identified as critical (Art. 2(2) to 2(4)).
| Essential entities | Important entities | |
|---|---|---|
| Who | Annex I entities above the medium-sized threshold, plus the cases in Art. 3(1) | The remaining entities of Annexes I and II |
| Core obligations (Arts. 21 and 23) | The same | The same |
| Supervision | Ex ante and ex post | In general, ex post |
Source: Directive (EU) 2022/2555, Arts. 2, 3, 32 and 33. Last verified: 15-10-2026.
A special case: managed service providers. Annex I (sector 9, ICT service management between businesses) lists managed service providers and managed security service providers. For them, Implementing Regulation (EU) 2024/2690 details the technical requirements for the Article 21 measures and when an incident is significant. If you depend on an external IT provider, ask it in writing where it stands.
If you are outside scope, you may still receive requirements as a supplier to a covered entity, because that entity must manage its supply-chain security (see “Supply chain”).
What NIS2 requires
Governance and management accountability
Management bodies must approve the cybersecurity risk-management measures, oversee their implementation and receive training; they can also be held liable for non-compliance (Art. 20). This cannot be delegated entirely to IT.
Risk-management measures
Article 21(2) requires proportionate technical, operational and organisational measures, based on an all-hazards approach, covering at least:
| Article 21(2) element | What it usually means in an SME |
|---|---|
| (a) Security policies and risk analysis | Policy approved by management and a risk matrix |
| (b) Incident handling | Procedure, roles and a log |
| (c) Continuity, backups and crisis management | Backups with an immutable copy, restore tests, continuity plan |
| (d) Supply-chain security | Inventory of critical suppliers and clauses |
| (e) Acquisition, development, maintenance and vulnerabilities | Patch management |
| (f) Assessing effectiveness | Audits, tests and regular metrics |
| (g) Cyber hygiene and training | Training and phishing simulations |
| (h) Cryptography and encryption | Encryption policy for devices and data |
| (i) HR security, access control and assets | Joiners and leavers, least privilege, inventory |
| (j) Multi-factor authentication and secure communications | MFA on email, VPN and admin accounts |
Reporting significant incidents
An incident is significant if it has caused or can cause severe operational disruption or financial loss, or considerable damage to others. Under Article 23(4) you must submit to the CSIRT or competent authority:
- an early warning within 24 hours of becoming aware;
- an incident notification with an initial assessment within 72 hours;
- an intermediate report if requested;
- a final report no later than one month after the 72-hour notification.
Where personal data is involved, the GDPR (Art. 33) adds a notification to the data protection authority, where feasible within 72 hours. The recipients differ, so prepare both channels.
Supervision and penalties
The directive sets floors for the maximum fines: at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, for essential entities, and at least EUR 7 million or 1.4%, whichever is higher, for important ones (Art. 34), for breaches of Articles 21 or 23. The final amounts will be set by national law, which Spain does not yet have.
Source: Directive (EU) 2022/2555, Arts. 20, 21, 23 and 34. Last verified: 15-10-2026.
Supply chain: what you will be asked and what you should ask
Article 21(2)(d) requires addressing security in the relationship with direct suppliers, and Article 21(3) requires taking into account each supplier's specific vulnerabilities and the quality of its practices. It works in both directions.
As a customer of critical suppliers (IT, cloud, telecoms, business software):
- inventory those that touch critical data or systems and rank them by impact;
- put security requirements in the contract, plus incident-notice periods that let you meet your own 24 and 72 hours, and information about subcontractors;
- ask for evidence proportionate to the risk (policies, relevant certifications such as ISO 27001 or ENS, test results);
- define what you do if the supplier fails: alternative, data exit and continuity.
As a supplier to a covered entity, expect questionnaires, notification clauses and evidence requests. A ready dossier (policies, MFA, backups, incidents, training) can ease conversations with corporate customers who ask for evidence.
A 90-day plan for an SME
It does not depend on the date of the law: it is based on Article 21 and common cyber-hygiene practice. Adjust the order to your risk.
| Period | Actions | Evidence |
|---|---|---|
| Days 1 to 30: understand and assign | Decide with your legal adviser whether sector, size and countries of establishment place you in scope. Name an owner and a management sponsor. Inventory assets, data and critical suppliers. Enable MFA on email, VPN and admin accounts. Check there is a copy outside the reach of the production network and test a restore. | Scope memo, management minutes, inventory, restore report |
| Days 31 to 60: measure and decide | Analyse risks and gaps against the ten elements. Write or update security, access, incident and continuity policies. Define what a significant incident is, who decides and a template for 24 and 72 hours. Map critical suppliers. | Risk matrix, approved policies, incident procedure |
| Days 61 to 90: implement and evidence | Prioritised remediation plan. Training for management and staff, with a phishing simulation. A crisis exercise including a simulated 24-hour notification. Quarterly review calendar. | Plan with owners and dates, training records, exercise minutes |
Our guides to an IT security plan and a security audit detail the technical steps.
What Impulso Tecnológico does and does not do
What we do, through the cybersecurity service: diagnosis, technical controls and training. Impulso Tecnológico, as a managed service provider, assesses its own NIS2 position and will share what applies.
What we do not do: we do not give legal advice or decide whether a company is legally in scope (that is for your legal adviser or compliance officer); we do not issue certifications or declarations of conformity; we do not guarantee the outcome of an inspection or audit; and we do not file notifications on behalf of the obliged entity.
Want to see how this fits your case? Tell us about your situation. For a short definition, see the NIS2 glossary entry.
Sources and verification date
All consulted on 15-10-2026: Directive (EU) 2022/2555 · Implementing Regulation (EU) 2024/2690 · GDPR · Commission, IP/26/1499 · Commission, IP/26/105 · European Parliament, 2026/0012(COD) · SME definition · DSN · TRIS 2025/0104/ES · RDL 12/2018 · RD 43/2021 · RD 806/2026 · Congress open data · Decree-Law 125/2025.