1. Introduction and context
Cybersecurity has become central to the stability of critical infrastructure and to data protection in Europe. Against this background, the NIS2 Directive, formally Directive (EU) 2022/2555 of the European Parliament and of the Council, updates the NIS1 Directive (Directive 2016/1148) with the aim of improving the resilience and security of Member States’ network and information systems. The update responds to the growing complexity and frequency of cyber threats affecting sectors that are essential to the European economy and society.
The NIS2 Directive was formally adopted in December 2022 and entered into force in January 2023, with Member States required to transpose it by 17 October 2024 and the rules applying from 18 October 2024.
This article examines the state of transposition of the Directive in Spain, the existing regulatory framework and the legislative procedure to be followed to ensure that it is implemented correctly.
2. Pre-existing legal framework in Spain:
Before the NIS2 Directive, Spain already had a cybersecurity regulatory framework adapted to the NIS1 Directive:
Royal Decree-Law 12/2018 of 7 September: transposed the NIS1 Directive into Spanish law, establishing a set of cybersecurity measures for operators of essential services and digital service providers. RDL 12/2018 defined the categories of services and the security and incident notification obligations.
Royal Decree 311/2022 of 3 May: regulates the National Security Framework (Esquema Nacional de Seguridad, ENS), an instrument that harmonises minimum security requirements in the public sector and which, in many respects, was already aligned with the new NIS2 requirements. The ENS is mandatory for all public sector entities and for the suppliers that provide services to them.
Why did the NIS1 Directive and the ENS coexist?
The ENS was created before the NIS1 Directive to unify and standardise security measures for Spanish public sector entities. It exists because public administrations needed to maintain a minimum level of cybersecurity and information protection. So while the NIS1 Directive focused on operators of essential services and digital service providers, the ENS covered only public sector entities and their suppliers.
When NIS1 was implemented in 2018, a specific framework had to be created to cover essential private operators that were not subject to the ENS. The obligations under the NIS1 Directive and the ENS therefore coexisted, but applied to different entities. With the arrival of NIS2, the ENS is being updated to harmonise its requirements and extend its reach to private entities in critical sectors, removing part of this segmentation.
The pre-existing framework therefore lays the groundwork for incorporating NIS2, which broadens and redefines the categories of entities subject to the rules, sets more rigorous security obligations and introduces a stricter penalty regime.
3. Objectives and scope of the NIS2 Directive:
NIS2 aims to achieve a high common level of cybersecurity across the European Union. To that end, it is built around the following principles:
Wider scope: it covers new sectors considered highly critical (energy, transport, health, digital infrastructure) and critically important (waste management, chemical and food manufacturing).
Classification of entities as essential or important: based on the criticality of the sector and the size of the entity. Security and notification obligations are stricter for essential entities.
Stronger obligations: it introduces more demanding obligations on risk management, governance and resilience, with specific requirements for supply chain security and crisis management.
A tougher penalty regime: fines for non-compliance can reach up to €10 million or 2% of annual turnover for essential entities, and €7 million or 1.4% of annual turnover for important entities.
4. The NIS2 transposition process in Spain:
Spain is transposing the NIS2 Directive by means of a Royal Decree-Law, which will allow the Government to meet the deadline set by the EU (17 October 2024). Use of an RDL is justified by the extraordinary and urgent need to adapt the legislation in good time, so as to avoid penalties from the European Commission and to ensure the security of critical infrastructure.
The Royal Decree-Law (RDL): allows the NIS2 measures to enter into force immediately, but must be ratified by Parliament within 30 days. This legislative tool is used to keep to the European timetable, ensuring formal transposition on time, but it does not amount to final approval of the text as a law.
Debate and approval by the Cortes Generales (Spanish Parliament): once ratified, the RDL will undergo a full parliamentary debate to become a definitive law, at which point adjustments and amendments may be made in light of the views of the parliamentary groups and the social partners concerned. This process allows for greater participation and transparency, although it leaves the content of the RDL open to change.
5. Current state of transposition:
Transposition of the NIS2 Directive is currently at an advanced stage, with the drafting of the Royal Decree-Law almost complete and its approval by the Council of Ministers expected before the deadline (17 October 2024). According to unofficial sources and an analysis of the regulatory framework, the main changes are expected to focus on:
Updated cybersecurity requirements for the public and private sectors. Extension of the ENS to cover new sectors and important entities under the NIS2 classification.
Coordination between authorities: the National Cryptologic Centre (CCN), together with the Ministry of Economic Affairs and Digital Transformation, will be responsible for supervising compliance and coordinating with the relevant CSIRTs (Computer Security Incident Response Teams).
6. Potential problems and challenges of transposition:
Parliamentary approval: although the RDL ensures that the NIS2 obligations enter into force, a lack of parliamentary consensus could delay final approval of the law, creating regulatory uncertainty.
Adaptation by the entities concerned: entities that were not previously subject to NIS1 (for example, waste management services and food manufacturing) will have to adapt quickly to the new requirements.
Effective enforcement of the penalty regime: ensuring that penalties are proportionate and effective will require close coordination between regulators and the competent authorities.
This analysis aims to provide a comprehensive overview of the current situation and of the implementation of the NIS2 Directive in the Spanish legislative context.
