Cybersecurity in Spain 2026: NIS2, Sanctions, and the New EU Framework

Cybersecurity has ceased to be a purely technical priority to become a strategic risk for Spanish organizations. According to INCIBE's Cybersecurity Balance, more than 122,000 incidents were detected in 2025, representing a 26% increase compared to the previous year. This escalation is not anecdotal: 96% of Spanish companies have been targeted by cyberattacks in the last 12 months, according to the Hiscox Cyber Readiness 2024 report.

The profile of attacks has also changed. Ransomware is no longer limited to massive and random campaigns; it now consists of selective attacks directed at critical sectors such as healthcare, industry, or logistics. Furthermore, Spain remains among the most affected countries by spam and phishing campaigns, a trend that analysts predict will continue in 2026. For companies, this implies that the attack surface has expanded with remote work and the cloud, making prevention a business continuity necessity.

Directive (EU) 2022/2555, known as NIS2, was to be transposed in Spain before October 17, 2024. However, as of October 2026, the law closing the loop is still in parliamentary proceedings and has not been published in the BOE. This delay has caused the European Commission to bring Spain before the EU Court of Justice in July 2026 for failing to notify the complete transposition, a step prior to possible economic sanctions against the State.

Despite the lack of a definitive law, the obligations are already known, and experts warn that waiting for the official publication is a mistake. The draft Law on Cybersecurity Coordination and Governance, approved in January 2025, establishes the creation of a National Cybersecurity Coordination Center and defines the responsibilities of essential and important entities. Regulatory uncertainty does not exempt companies from preparing, as the technical and governance requirements are clear and applicable de facto.

NIS2 expands the scope of application to 18 sectors and establishes that cybersecurity responsibility lies directly with the executive management, not just the IT department. Affected companies must implement risk management measures, including supply chain protection, vulnerability management, and incident response. A critical aspect is the notification deadlines: authorities must be notified within a maximum of 24 hours after detecting a severe incident, and a detailed report must be submitted within 72 hours.

In addition to NIS2 obligations, companies must comply with the GDPR, which sets a 72-hour deadline to notify personal data breaches to the supervisory authority. The convergence of these regulations forces organizations to adopt reference frameworks such as ISO 27001 or the National Security Scheme (ENS) to turn vague obligations into auditable controls. Without an asset inventory and a solid risk analysis, any investment in security tools becomes a blind action.

In parallel with the NIS2 transposition, the European Commission presented a proposal for a new cybersecurity regulation in January 2026, informally known as Cybersecurity Act 2. This initiative aims to replace the current Cybersecurity Regulation (2019/881) with a broader and more operational framework. One of its main objectives is to introduce a horizontal framework for the security of the information and communication technology (ICT) supply chain, something completely new in European regulation.

The new regulation will also update the European Cybersecurity Certification Framework (ECCF) to certify not only products and services but the overall security posture of organizations. This will imply that companies must evaluate and secure their technological supply chain at the European level, identifying risks from high-risk components or suppliers. The expansion of ENISA's role, the EU's cybersecurity agency, will allow for greater coordination and technical assistance in the face of cross-border threats.

Non-compliance with cybersecurity regulations entails significant economic sanctions. In the case of NIS2, fines can reach 10 million euros or 2% of the group's global annual turnover, whichever is higher. These figures are not just a financial risk but a clear signal that cybersecurity is a matter of strict legal compliance. For medium and large companies, non-compliance can mean the loss of contracts with regulated clients or the inability to operate in certain sectors.

In addition to direct fines, companies face reputational and operational risks. The paralysis of operations due to a cyberattack, the loss of sensitive data, or the leakage of confidential information can have a devastating impact on customer trust and brand value. Therefore, investment in cybersecurity must be seen as a measure to protect the company's most valuable asset: its ability to operate and generate trust.

In this context, companies must adopt a proactive and resilience-based approach. KPMG highlights in its 2026 report that the challenge is no longer just protecting the organization but reinforcing its resilience while enabling innovation. This implies integrating cybersecurity into the business strategy, not as an additional cost, but as an enabler of digital transformation. Organizations must prioritize identity management, cloud protection, and continuous monitoring of their hybrid environments.

Collaboration with specialized providers is key to covering talent and technical capacity gaps. In 2026, many companies no longer buy cybersecurity in isolated pieces but seek providers that combine real technical capacity (pentesting, SOC) with governance, risk, and compliance (GRC) capabilities. This integration allows demonstrating controls, traceability, and evidence in frameworks such as NIS2, DORA, or ISO 27001, reducing technical exposure and administrative burden.