Spain has not yet transposed NIS2. The Council of Ministers approved the draft Ley de Coordinación y Gobernanza de la Ciberseguridad on 14 January 2025, but we found no publication of the law in the Official State Gazette (BOE) by 7 November 2026. On 8 July 2026 the European Commission referred Spain, together with Ireland, France and the Netherlands, to the Court of Justice of the EU for failing to notify its transposition measures. Until the new law applies, Royal Decree-Law 12/2018, the transposition of the first NIS directive, remains in force.
TriStiX S.L., the company behind NetSenX, is based in Alicante, so this is our own regulatory landscape as much as our customers'.
What applies today
Royal Decree-Law 12/2018 covers operators of essential services and providers of certain digital services: online marketplaces, online search engines and cloud computing services. It already requires them to manage security risks and to notify significant incidents. For private entities, INCIBE-CERT is the reference CSIRT.
What NIS2 will add
Once transposed, NIS2 reaches far more Spanish companies. In general it covers medium-sized and larger companies (50 or more staff, or an annual turnover and a balance sheet total both above EUR 10 million) in the sectors of its Annexes I and II, and some entities regardless of size. Article 21 sets the risk-management measures, from incident handling and business continuity to supply-chain security, and Article 23 sets the reporting chain: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after the notification. The Spanish law may add detail, such as the authority and the form to use.
Why it is worth preparing now
The directive's deadlines will not be longer in Spain than elsewhere, and the hardest part of meeting them is not the paperwork: it is noticing a significant incident within hours. Most intrusions that end in a reportable incident cross the network long before they cause damage: a workstation checking in with an outside server, one host scanning others, new administrator sessions, a large upload at night. Watching that traffic continuously is one of the few ways a small team notices in time. Our NIS2 deadline calculator shows what the 24-hour clock means in practice.
What NetSenX does, and what it does not
NetSenX watches how every host behaves on the network and flags command-and-control beaconing, scanning, lateral movement and unusual outbound data volume, on every plan, Free included. It explains every alert in plain language, writes alerts, analyst decisions and configuration changes to an audit log, and tracks each incident against the NIS2 Article 23 deadlines. Customer data is stored in the EU.
NetSenX does not decide whether your company is in scope, and it does not notify INCIBE-CERT or any authority on your behalf: those duties stay with you. The Free plan monitors up to 3 devices with no time limit; see pricing and NIS2 network monitoring.
FAQ
Has Spain transposed NIS2?
Not as of 7 November 2026. The draft Ley de Coordinación y Gobernanza de la Ciberseguridad was approved by the Council of Ministers on 14 January 2025 and we found no publication of the law in the BOE. The Commission referred Spain to the Court of Justice of the EU on 8 July 2026 for failing to notify transposition measures.
Which law applies in Spain in the meantime?
Royal Decree-Law 12/2018 on the security of network and information systems, which transposed the first NIS directive. It applies to operators of essential services and to certain digital service providers.
Where are incidents reported in Spain today?
Private entities covered by Royal Decree-Law 12/2018 report to INCIBE-CERT, the reference CSIRT for the private sector. The NIS2 law may change the details once it is in force.
Does NetSenX report incidents to INCIBE-CERT for us?
No. NetSenX detects suspicious network behaviour, keeps the alerts and the audit log a report draws on and tracks the reporting deadlines. Notification stays with your company.
Sources
All accessed on 7 November 2026.
- European Commission — Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity, 8 July 2026 (IP/26/1499)
- Ministry of the Interior — the Council of Ministers approves the draft Ley de Coordinación y Gobernanza de la Ciberseguridad, 14 January 2025
- BOE — Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información
- Directive (EU) 2022/2555 (NIS2) — EUR-Lex
- European Commission — NIS2 transposition status by Member State
Written by the NetSenX Team at TriStiX S.L. This article is general information, not legal advice; check your obligations with INCIBE or your legal counsel. Questions: info@netsenx.com.