NIS2: what it is, who it applies to and where Spain stands

For a while now, many software companies have been receiving security questionnaires from their customers that ask about NIS2. The question we get next is almost always the same: “is this already mandatory in Spain?”. The short answer is that there is still no Spanish law transposing it, but that doesn’t mean you can ignore it. In this article we explain what the directive is, who it applies to and where Spain stands, with a link to the official source for every fact.

What NIS2 is

Directive (EU) 2022/2555 replaces the first NIS Directive of 2016. It is a directive, not a regulation: it doesn’t apply to companies directly; each Member State has to transpose it into national law. The deadline for doing so was 17 October 2024 (Article 41).

What it asks of the entities within its scope comes down to three blocks:

• Governance (Article 20). Management bodies approve the cybersecurity measures, oversee their implementation and can be held liable for non-compliance. They must also receive training.
• Risk-management measures (Article 21). A minimum list of ten elements: security policies and risk analysis, incident handling, business continuity (backup management, disaster recovery and crisis management), supply chain security, security in the acquisition, development and maintenance of systems (including vulnerability handling), assessing the effectiveness of the measures, cyber hygiene and training, cryptography, human resources security and access control, and multi-factor authentication.
• Incident reporting (Article 23). For a significant incident: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.

Who it applies to

Article 2 applies the directive to entities in the sectors listed in Annexes I and II that are medium-sized or large enterprises under Recommendation 2003/361/EC. Broadly speaking, from 50 employees, or above 10 million euros in both annual turnover and balance sheet total. Some types of entity are in scope regardless of size (for example, DNS service providers or trust service providers).

For a software company, these are the parts of the annexes most worth checking:

Annex I entities above the medium-sized enterprise threshold are generally essential; the rest are important (Article 3). The difference lies mainly in supervision and in the maximum fines that the directive requires each Member State to provide for (Article 34).

And there’s an effect that reaches smaller companies too: Article 21 requires in-scope entities to look after the security of their supply chain. If your customer is within the scope of NIS2, they will ask you for evidence of how you manage security, even if you aren’t in scope yourselves. That’s where the questionnaires come from.

Where Spain stands (November 2026)

We checked the official sources today, 2 November 2026:

1. Preliminary draft bill, January 2025. On 14 January 2025 the Council of Ministers approved, at first reading, the Preliminary Draft Law on Cybersecurity Coordination and Governance (in Spanish), the text the Government intended to use to transpose NIS2. It never became law.
2. EU Court of Justice, July 2026. On 8 July 2026 the European Commission decided to refer Spain, together with Ireland, France and the Netherlands, to the Court of Justice for failing to notify full transposition, and asked for financial penalties until it happens.
3. Parliament dissolved, October 2026. Royal Decree 806/2026 dissolved the Congress and the Senate and called elections for 29 November 2026. Passing a transposition law is therefore in the hands of the new Parliament.
4. Law in force. In the meantime, Royal Decree-Law 12/2018 on the security of network and information systems remains in force. It transposed the first NIS Directive and applies to the operators of essential services and digital service providers it defines.

On top of that, on 20 January 2026 the Commission proposed targeted amendments to the directive itself to provide more legal clarity, as part of a package that also revises the Cybersecurity Act. In other words, the European text may change too.

The practical conclusion: today in Spain there are no NIS2 obligations enforceable under national law and no Spanish NIS2 penalty regime. Anyone who tells you otherwise, or offers to make you “NIS2 compliant” with a seal, is selling you something that doesn’t exist yet.

Why prepare now

No law doesn’t mean no pressure:

• Transposition will come. Spain is before the Court of Justice precisely for not having done it. When it’s passed, it’s reasonable to expect the content to closely follow the directive, because that’s what the directive requires.
• Your customers already apply it. In other Member States the directive has already been transposed, and in-scope companies pass the requirements on to their suppliers through contracts.
• The Article 21 measures are good practice anyway. Backups that actually get restored, vulnerability management, multi-factor authentication, an incident procedure someone has rehearsed. None of that is exclusive to NIS2.
• If you already work with the ENS or ISO 27001, you’ve done a lot of it. The measures overlap considerably, although each framework has its own particulars. We explain this in the articles on the ENS for public sector suppliers and on what changed in ISO 27001:2022.

Where we would start

1. Check whether you’re in scope: sector (Annexes I and II) and size (Recommendation 2003/361/EC). If you aren’t, check whether your main customers are.
2. Compare what you have against the ten points in Article 21. A table with three columns is enough to start: done, partly done, pending.
3. Prepare the incident procedure with the 24-hour, 72-hour and one-month deadlines. It’s the hardest thing to improvise.
4. Document the technical work you already do. Many companies have good practices without a single piece of written evidence.

In ENS and ISO 27001 compliance we explain how we also prepare you for NIS2, and in the reliability and security audit, how we review the technical side of an existing platform. If you want to know where to start in your case, send us an email.

Frequently asked questions

Is NIS2 already mandatory in Spain?

Not as national law. As of 2 November 2026 no rule transposing it has been published in the BOE, and Royal Decree-Law 12/2018 remains in force. Contracts are another matter: a customer can require NIS2 measures from its suppliers.

Is a 20-person software company affected?

By size, generally not, unless it is one of the types of entity that are in scope regardless of size or exceeds 10 million euros in both turnover and balance sheet total. But if it sells to in-scope entities, it will most likely be asked to demonstrate similar measures through the supply chain.

Is there a NIS2 certificate?

The directive doesn’t create a certificate of its own for companies. What can be demonstrated through certification are frameworks such as the ENS or ISO 27001, which cover a good part of the Article 21 measures.

What fines does it provide for?

The directive requires each Member State to provide for maximum fines of at least 10 million euros or 2% of worldwide turnover for essential entities, and 7 million or 1.4% for important ones (Article 34). Spain hasn’t set its own yet.

References

• Directive (EU) 2022/2555 (NIS2), EUR-Lex: Articles 2, 3, 20, 21, 23, 34 and 41, and Annexes I and II (Spanish version; EUR-Lex lets you switch language).
• Recommendation 2003/361/EC, EUR-Lex: definition of small and medium-sized enterprises.
• European Commission: NIS2 Directive, policy page.
• European Commission, IP/26/1499, 8 July 2026: referral of Spain to the Court of Justice.
• European Commission: proposal for a directive amending NIS2, 20 January 2026.
• La Moncloa: Council of Ministers report of 14 January 2025: preliminary draft bill (in Spanish).
• BOE: Royal Decree 806/2026, dissolution of Parliament (in Spanish).
• BOE: Royal Decree-Law 12/2018, law in force (in Spanish).