NIS2 and digital infrastructure: new obligations for critical sectors

The NIS2 directive was due to be transposed in Spain by 17 October 2024. More than twenty months on, no national law has appeared in the BOE. The draft Law on Cybersecurity Coordination and Governance was presented in January 2025 and remains stuck in parliamentary proceedings without the majority needed to move forward. On 8 July 2026, the European Commission referred Spain, together with France, Ireland and the Netherlands, to the Court of Justice of the European Union for failing to notify complete transposition, seeking a lump sum fine plus daily penalties for as long as the national law stays unpublished. For any organisation running digital infrastructure in Spain, the practical question is not whether NIS2 is “law yet”, but which obligations already reach its operations regardless.

NIS2 (Directive (EU) 2022/2555) sorts affected organisations into two annexes. Annex I covers the high criticality sectors: energy, transport, banking and financial market infrastructure, health, drinking water and waste water, digital infrastructure, ICT service management between businesses, public administration and the space sector. Annex II covers other critical sectors: postal and courier services, waste management, chemical manufacturing and distribution, and food production, processing and distribution, among others.

Within those sectors, the directive separates essential from important entities by size (medium or large enterprise, per Recommendation 2003/361/EC) and by how critical the service is. Some entities fall under NIS2 regardless of size, such as qualified trust service providers, DNS services and top level domain registries; for these, the size threshold that protects smaller organisations simply does not apply.

The absence of a transposition law does not leave Spanish digital infrastructure without any point of reference. Three routes already exert compliance pressure equivalent to NIS2.

First, the contractual route. Clients based in countries that have already transposed the directive, such as Germany, whose law has been in force since December 2025, or the Netherlands, which passed its own on 7 July 2026, are already sending suppliers security questionnaires based on Article 21 of NIS2, regardless of where the infrastructure providing the service is incorporated. Second, sectoral regulation already in force. The National Security Framework, DORA for the financial sector and critical infrastructure rules cover obligations substantially equivalent to those in Article 21, and their supervisors are not waiting for the NIS2 national law to enforce them. Third, Royal Decree Law 12/2018 and Royal Decree 43/2021, the transposition of the original NIS directive, remain in force and apply to many of the same operators.

In practice, this means that digital infrastructure serving Annex I or Annex II sectors should already be implementing the technical measures in Article 21. Among them: documented risk management, including an asset inventory, threat analysis and an up to date treatment plan; an incident notification procedure that meets the directive’s deadlines (an early warning within 24 hours, a formal notification within 72 hours, a final report within one month); supply chain security, including a review of contracts with critical ICT suppliers; and staff training, including senior management.

NIS2 is not solved by technology. It is, first and foremost, a framework for risk management and notification processes. But two of its specific requirements, auditable traceability of the ICT supply chain and the ability to demonstrate to a supervisor exactly when an incident was detected and how it was handled, map directly onto what a register built on permissioned blockchain infrastructure such as ISBE can provide.

First, incident evidence with a verifiable timestamp. Recording the moment an incident was detected, the 24 hour alert and the 72 hour report in a register anchored to a network with identified participants makes it possible to demonstrate compliance with the deadline to a supervisor without relying solely on the entity’s own internal log, which could be altered after the fact. Second, ICT supply chain traceability with identified third parties. NIS2 requires assessing the risk posed by critical suppliers; a shared register in which each ICT supplier is identified, rather than an anonymous address, makes it possible to audit which supplier had access to which system and when, something an unidentified internal database cannot sustain in front of an external auditor. Third, distributed governance of the compliance register. Keeping the history of compliance evidence from depending on a single server under the exclusive control of the audited entity gives the supervisor an added layer of trust, since they can independently verify the integrity of the register rather than relying solely on the word of the party being audited.

None of this replaces the risk management obligation that NIS2 sets out; it is a layer of evidence that makes that management verifiable by a third party, which is exactly what a supervisor needs to check.

Article 34 of NIS2 sets the minimum maximum penalties that each national law must establish. At least ten million euros or 2 per cent of worldwide annual turnover, whichever is higher, for essential entities, and at least seven million euros or 1.4 per cent for important entities. These are minimum ceilings that national law must set as the maximum possible, not automatic fines. The actual amount in any given case will depend on the infringement, the competent authority and any aggravating or mitigating circumstances. As things stand, there is no documented NIS2 penalty against a company in Spain, partly because the law that would apply one does not yet exist.

Does NIS2 already apply in Spain without a transposition law? The directive itself has no automatic direct effect on national penalties without a law to set them, but much of its substance, risk management, incident notification and supply chain security, already reaches many entities through existing sectoral regulation (the National Security Framework, DORA, RD 43/2021) and through contractual pressure from clients in countries that have transposed the directive.

What happened with Spain and the CJEU in July 2026? On 8 July 2026 the European Commission referred Spain, together with France, Ireland and the Netherlands, to the Court of Justice of the EU for failing to complete the transposition of NIS2, seeking a lump sum fine plus daily penalties until the national law is published. As things stand, the Spanish law remains stuck in parliamentary proceedings.

How do I know if my organisation is an essential or important entity under NIS2? It depends on the sector you operate in (Annex I or Annex II of Directive (EU) 2022/2555) and your size under Recommendation 2003/361/EC, unless you fall into a category covered regardless of size, such as qualified trust service providers. It is worth checking Article 3 of the directive case by case rather than relying on this general guidance alone.

What incident notification deadlines does NIS2 require? An early warning within the first 24 hours of detecting a significant incident, a formal notification with an initial assessment within 72 hours, and a final report within one month of that notification, or a status report if the incident is still ongoing, followed by the final report one month after it is resolved.

What does an infrastructure such as ISBE bring to NIS2 obligations? It does not replace the risk management the directive requires, but it allows compliance evidence, incident detection, adherence to notification deadlines, ICT supplier traceability, to be recorded in a register with identified participants and distributed governance, verifiable by an external supervisor without relying solely on the audited entity’s own internal records.