By Antonio Tejeda Encinas, President of the Euro-American Committee of Digital Law (CEA Digital Law) and CEO of META Channel Corporation
1. A turning point: NIS2 and cybersecurity in the EU
Cybersecurity in Europe is at a crucial juncture. The European Union Agency for Cybersecurity (ENISA) has published its “NIS Investments 2024” report, which analyses the impact of the transition to the NIS2 Directive, legislation that tightens companies’ obligations on digital security. This is not a minor regulatory adjustment but a profound change in the way companies must deal with cyber risk.
The study, based on a wide-ranging survey of more than 1,350 organisations across all 27 Member States, shows that investment in cybersecurity has risen, reaching 9% of the IT budget in many companies, but it also highlights a series of challenges that go far beyond money. The shortage of specialist talent is becoming a structural problem: despite growing demand, the number of employees dedicated to cybersecurity has fallen for the fourth year running, which shows that companies’ ability to comply with NIS2 depends not only on their financial resources but also on their ability to attract and retain qualified talent.
Even so, awareness of this legislation is high. Almost all the organisations surveyed know that they must comply with the Directive, but the question remains whether they are really prepared to do so. This is where the Canary Islands come into the picture, because the challenges the rest of Europe already faces are magnified in an island setting such as theirs.
2. The Canary Islands and NIS2: a challenge that puts their competitiveness at risk
Not all regions approach digitalisation with the same tools, and in the case of the Canary Islands, adapting to NIS2 brings additional difficulties that make cybersecurity not only a technological issue but also a reflection of the structural problems weighing on the archipelago’s economy.
Digital talent on the islands remains scarce, not only because cybersecurity training is still not widespread enough, but because some of those who acquire these skills end up seeking opportunities elsewhere.
The brain drain, a recurring problem in the Canary Islands, becomes a real obstacle when it comes to digital security, because without trained professionals local companies have little chance of meeting the requirements of the new legislation.
But beyond the lack of specialists, the real challenge is how Canarian companies perceive cybersecurity. In a business landscape dominated by small and medium-sized enterprises, many of them operating on tight margins, digital security is still seen as an additional cost rather than a strategic investment. The problem is that this mindset collides head-on with NIS2, which makes cybersecurity an inescapable legal obligation.
Added to this is another factor that complicates the transition: digital infrastructure in the Canary Islands still depends heavily on external operators and on connectivity that does not always meet today’s demands. In a global economy where a cyberattack can cripple any company within minutes, the lack of robust infrastructure can make NIS2 compliance even harder for many local organisations.
3. The problem is not just cybersecurity: it is the economic model
Cybersecurity is only one piece of the puzzle. NIS2 exposes an even bigger problem: the Canary Islands’ lack of competitiveness in the digital economy. For decades, the archipelago has relied on an economic model based on tourism and on traditional sectors that have resisted digital transformation. And although this strategy has worked up to a point, the world has changed, and the Canary Islands cannot afford to keep operating under a model that is already showing clear signs of exhaustion.
The problem is not only dependence on tourism, but companies’ inability to innovate and adapt to the new digital reality. While other regions have promoted sectors such as artificial intelligence, biotechnology and automation, in the Canary Islands the debate still revolves around the same old problems: the lack of economic diversification, the red tape that holds back business growth and the difficulty of attracting high-value-added investment.
And then, of course, there is the labour market. The gap between what employers ask for and what workers demand keeps widening. On the one hand, companies argue that labour costs are too high for them to be competitive; on the other, employees insist that wages do not cover the cost of living. Caught in this clash of interests, productivity remains low and the perception that “nobody wants to work” becomes a constant refrain, although in many cases the problem is not a lack of will but the absence of real incentives to improve performance and efficiency.
4. Reinventing the Canary Islands: the need for structural change
If the Canary Islands want not only to comply with NIS2 but also to become a benchmark in the digital economy, they need a clear strategy. The key is not to keep doing the same thing and expect different results, but to transform the archipelago’s productive and labour structure.
To achieve this, companies and institutions must begin to see the Canary Islands Economic and Tax Regime (REF) as more than a simple tax-reduction mechanism for traditional sectors. If applied strategically to attracting technology companies, it could turn the islands into an Atlantic hub for innovation and cybersecurity, drawing on their geographical location and their links with Europe and Latin America.
But attracting companies is not enough. Local talent also needs to be trained, because without specialists in cybersecurity and technology, any attempt at digitalisation will be superficial. Creating advanced digital-security training centres and introducing hybrid working models can help persuade more qualified professionals to stay on the islands instead of seeking opportunities elsewhere.
The labour market, for its part, urgently needs modernising. It is not a question of cutting wages or taxing companies more heavily, but of adopting models that reward productivity and efficiency, rather than remaining anchored in a system that measures work in hours rather than results.
Finally, the public sector must play a key role. Imposing regulations such as NIS2 is not enough; the digital transition has to be eased through incentives, advice and a business ecosystem that encourages investment in innovation. If the Canary Islands do not take this transformation seriously, they will keep losing competitiveness in a world where the digital economy is no longer the future but the present.
5. Conclusion: adapt or fall behind
The real challenge of NIS2 is not just complying with the rules, but understanding that digitalisation and cybersecurity are the foundation of any modern economy. The Canary Islands have two paths: they can carry on operating under a model that has run its course, or they can seize this opportunity to redesign their future.
The time for diagnosis is over. Now is the time to decide whether the archipelago wants to become a benchmark for innovation or remain trapped in the inertia of its own problems. Because the future will not wait. Either we adapt, or we fall behind.
