NIS2 in Spain: is your company in scope, and what if it isn't?
Lee este artículo en español.
NIS2 applies to your company if it is one of the entity types listed in Annex I or II of Directive (EU) 2022/2555 and is at least a medium-sized enterprise. Some entities are covered whatever their size. In Spain, as of 23 October 2026, there is no law transposing the directive; Royal Decree-Law 12/2018 remains in force.
Most of what gets written about NIS2 ends with one question: is your company in scope or not? What gets said less often is that an SME left out because of its size can end up with NIS2 anyway, through a contract. Article 21 asks in-scope entities to manage the security of their direct suppliers, and that requirement travels down the chain to whoever sells to them.
Contents
- What NIS2 is and when it applies
- How to tell if NIS2 applies to your company: three tests
- Essential or important entity: what changes
- Where NIS2 stands in Spain on 23 October 2026
- What NIS2 requires from a company in scope
- If NIS2 doesn't apply to you, it can still reach you by contract
- What this test doesn't tell you
- What to do this week, in scope or not
- NIS2 scope: frequently asked questions
What NIS2 is and when it applies
NIS2 is Directive (EU) 2022/2555: it requires EU Member States to impose cybersecurity risk management, reporting of significant incidents and supervision on entities in 18 sectors, with senior management accountable.
It entered into force on 16 January 2023, and Member States had to transpose it by 17 October 2024 (Article 41). It is addressed to the Member States (Article 46): it reaches companies through national law.
How to tell if NIS2 applies to your company: three tests
The general rule in Articles 2 and 3 of the directive comes down to three questions: what you do, how big you are and whether an exception catches you. A fourth decides whether you are an essential or an important entity.
Original chart · Montevive, 2026. Source: Directive (EU) 2022/2555, Articles 2 and 3; Recommendation 2003/361/EC.
First test: what your company does, not which sector it is in
The annexes list specific entity types, not whole sectors. A manufacturer, for example, is only covered if it makes products listed in Annex II: medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles or other transport equipment.
| Annex | Sectors |
|---|---|
| I · Sectors of high criticality | Energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space |
| II · Other critical sectors | Postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers and research |
Second test: size, measured by headcount and financials
NIS2 applies to entities in those annexes that are not small or micro enterprises under Recommendation 2003/361/EC. Counting only employees leads you astray, because the definition combines headcount and financial figures.
| Category | Headcount | Financials (meeting one is enough) |
|---|---|---|
| Small enterprise | Fewer than 50 people | Annual turnover or annual balance sheet total of up to €10 million |
| Medium-sized enterprise | Fewer than 250 people | Turnover of up to €50 million or balance sheet total of up to €43 million |
An example. An independent company has 40 employees, €12 million in turnover and an €8 million balance sheet. It is small: it has fewer than 50 people and its balance sheet does not exceed €10 million, even though its turnover does. NIS2 does not cover it on size. With an €11 million balance sheet it would be medium-sized.
Two details can flip the result. A change of category only counts if it holds for two consecutive financial years. And in a group, you add the data of linked enterprises and a proportional share of partner enterprises (Articles 3, 4 and 6 of the Annex to the Recommendation).
Third test: the exceptions that ignore size
These are covered whatever their size (Article 2 of the directive):
- providers of public electronic communications networks or services;
- trust service providers;
- top-level domain name registries and DNS or domain name registration service providers;
- central government entities;
- entities designated as critical under Directive (EU) 2022/2557.
Others are covered if the Member State identifies them, such as the sole national provider of an essential service. Check these before assuming you are out.
Essential or important entity: what changes
Both categories carry the same risk-management and reporting obligations (Articles 21 and 23); supervision and fines are what change.
Under Article 3 of Directive (EU) 2022/2555, Annex I entities that exceed the medium-sized ceilings are essential: 250 people or more, or more than €50 million in turnover and more than €43 million on the balance sheet. The rest that are covered on size are important.
There are exceptions: qualified trust service providers, top-level domain name registries and DNS service providers are always essential, and providers of public electronic communications are essential from medium size upwards.
| Essential entity | Important entity | |
|---|---|---|
| Supervision | Without waiting for signs of trouble: inspections and regular audits (Art. 32) | Ex post, when there are indications of non-compliance (Art. 33) |
| Maximum fine national law must provide for | At least €10 million or 2% of worldwide annual turnover, whichever is higher (Art. 34(4)) | At least €7 million or 1.4%, whichever is higher (Art. 34(5)) |
These are the minimum ceilings each national law has to set, not automatic fines.
Where NIS2 stands in Spain on 23 October 2026
Spain has no law transposing NIS2. The Spanish Council of Ministers approved the draft Cybersecurity Coordination and Governance Act on 14 January 2025 under the urgent procedure, but as of 23 October 2026 no law has been passed.
On 8 July 2026, the European Commission referred Spain to the Court of Justice of the EU, together with Ireland, France and the Netherlands. It asked for a lump sum and daily penalty payments until transposition is complete.
Then Royal Decree 806/2026 dissolved the Spanish Parliament and called a general election for 29 November. Nobody can give you a date for the law today.
What does apply today:
- Royal Decree-Law 12/2018, for the operators of essential services and digital service providers it already covered. Its reference CSIRTs are INCIBE-CERT and, for the public sector, CCN-CERT.
- DORA, Regulation (EU) 2022/2554, applicable to financial entities since 17 January 2025. Where it covers the same ground as NIS2, DORA applies instead of NIS2 (Article 4 of NIS2 and Article 1(2) of DORA).
- Implementing Regulation (EU) 2024/2690, which sets out the technical measures for cloud, data centre, managed service and DNS providers, among others. As a regulation it needs no transposition, but it implements NIS2's Article 21, which has no Spanish law behind it yet. If you provide one of those services, have your legal adviser assess what can be required of you today.
The impact assessment of the Spanish draft bill (Ministry of the Interior, November 2024) estimated 1,819 essential and 3,941 important entities. It put the average cost of compliance at €179,562.50 per important entity and €2,153,250 per essential one, before deducting what each already had in place. Read it as an order of magnitude, not as a way to decide your own case.
What NIS2 requires from a company in scope
Article 20 makes the management body accountable: it approves the cybersecurity measures, oversees their implementation, answers for infringements, and its members must take training. Article 21 calls for measures proportionate to the risk and to the size of the entity, covering at least:
- (a) risk analysis and information system security policies;
- (b) incident handling;
- (c) business continuity, backups and crisis management;
- (d) supply chain security;
- (e) security in acquiring, developing and maintaining systems, including vulnerability handling;
- (f) assessing the effectiveness of the measures;
- (g) cyber hygiene and training;
- (h) cryptography and, where appropriate, encryption;
- (i) human resources security, access control and asset management;
- (j) multi-factor authentication and secured communications.
When to report an incident: 24 hours, 72 hours and one month
Article 23 requires reporting of significant incidents: those that cause, or could cause, severe operational disruption or financial loss to the entity, or considerable damage to others. The deadlines run from the moment the entity becomes aware of the incident:
| Deadline | What goes to the CSIRT or competent authority |
|---|---|
| 24 hours | Early warning: whether it looks malicious or could have a cross-border impact |
| 72 hours | Incident notification with an initial assessment of severity and impact |
| One month after the notification | Final report, or a progress report if the incident is still ongoing |
Original chart · Montevive, 2026. Source: Directive (EU) 2022/2555, Article 23; Regulation (EU) 2016/679, Article 33.
If personal data is involved, a second clock starts. Unless the breach is unlikely to result in a risk to people, Article 33 of the GDPR requires notifying the data protection authority without undue delay and, where feasible, within 72 hours. They are separate channels and can both be triggered at once.
If NIS2 doesn't apply to you, it can still reach you by contract
Being out of NIS2's scope does not shield you from its effects if you sell to someone in scope. Article 21(3) asks in-scope entities to take into account the vulnerabilities of each direct supplier and the quality of its cybersecurity practices.
To show they have done so, they need evidence from you, and the natural route is the contract: security questionnaires, incident notification clauses, audit rights or mandatory multi-factor authentication. None of that makes you an essential or important entity. But if your customer has 24 hours to send an early warning and the incident starts in your systems, it will ask you to tell it sooner.
And if you are the one in scope, the AI services you use in critical processes also count as direct suppliers under Article 21(3). They come with their own rules, which we cover in what the AI Act requires from your company and in the rest of our blog on safe AI and compliance.
What this test doesn't tell you
- It does not replace a reading of your own case. Many entity types in the annexes refer to definitions in other EU laws, and Spanish law may extend NIS2 to local government and educational institutions (Article 2(5)).
- Sector-specific regimes exist. An insurer is subject to DORA, but insurers do not appear in the NIS2 annexes.
- A certification helps, but does not decide. ISO 27001 or Spain's National Security Framework (ENS) cover ground shared with Article 21, but they do not tell you whether you are in scope, nor do they replace the NIS2 reporting deadlines.
What to do this week, in scope or not
- Run the three tests in writing, using the last two closed financial years and your group's figures. It is the first thing a customer or a supervisor will ask for.
- Separate legal from contractual: what binds you today (Royal Decree-Law 12/2018 or DORA, if they apply) and what your customers ask of you.
- Take the result to the board: under NIS2, the management body approves the measures, oversees their implementation and its members must be trained.
- Map what you already have. If you work with ISO 27001 or the ENS, compare their controls with the ten measures in Article 21 in a single map.
- Rehearse the clocks: who decides whether an incident is significant and who reports at 24 and at 72 hours, with a drill that triggers NIS2 and GDPR reporting at the same time.
- If you are out of scope but sell to in-scope entities, put together an evidence pack: policies, multi-factor authentication, backups, vulnerability handling and an incident contact.
If you would rather do it with us, start with a NIS2 scope review. In half a day it puts in writing whether you are in scope and as which type of entity, and which of your customers' demands are law and which are contract.
NIS2 scope: frequently asked questions
Is a company with 40 employees and €12 million in turnover covered by NIS2?
It depends on the balance sheet. If the company is independent and its balance sheet does not exceed €10 million, it is small under Recommendation 2003/361/EC and out of scope on size. If it exceeds that for two consecutive years, it is medium-sized and covered if its activity is listed in Annex I or II of NIS2.
If nobody has notified me, can I assume I am out of scope?
No. Except where the Member State identifies an entity, classification follows from the criteria in Articles 2 and 3 of Directive (EU) 2022/2555, not from a notice. The directive expects entities to submit their own details for the official list (Article 3(4)), so it pays to document your analysis even if you conclude you are out.
Sources
- Directive (EU) 2022/2555 (NIS2): Articles 2 to 4, 20, 21, 23, 32 to 34, 41, 46 and Annexes I and II.
- Recommendation 2003/361/EC, SME definition: Articles 2 to 6 of the Annex.
- Regulation (EU) 2022/2554 (DORA): Articles 1(2) and 64.
- Implementing Regulation (EU) 2024/2690.
- Regulation (EU) 2016/679 (GDPR): Article 33.
- Royal Decree-Law 12/2018, consolidated text (in Spanish).
- European Commission, 8 July 2026.
- Royal Decree 806/2026 (in Spanish).
- Spanish Council of Ministers, 14 January 2025 (in Spanish).
- Impact assessment of the draft bill, November 2024, section 4.1.8 (in Spanish).
This article reflects the status of NIS2 in Spain as of 23 October 2026. It is general information and does not replace legal advice.