Spain
Current Status: Not implemented
Expected or actual implementation date or timeline
A draft Law on the Protection and Resilience of Critical Entities has been approved by the Council of Ministers and is currently under parliamentary procedure (2025).
If implemented, whether a transition period applies and, if so, its duration
Not yet defined. This will depend on the final law approved by Parliament. The current draft has not yet been made available for public consultation, so no transition period is known at this stage.
Other important remarks/notes
The draft law will implement the CER Directive and publish a national framework for the protection and resilience of critical entities. The Secretary of State for Security (Ministry of Interior) is designated as the national competent authority, acting through the National Centre for the Protection and Resilience of Critical Entities (CNPREC) (formerly CNPIC).
Spain maintains a sector-based approach, with competent authorities distributed across ministries depending on the sector.
The law introduces a national catalogue of critical entities, to be developed based on the National Strategy and a National Risk Assessment.
The scope includes traditional sectors (energy, transport, health, water, public administration, food, nuclear) and expands to new ones such as hydrogen, district heating and cooling, private security, research facilities and wastewater.
Certain sectors are excluded where specific EU regulation already applies (e.g. banking, financial markets and digital infrastructure), as well as defence and law enforcement bodies.
Key obligations for critical entities include: (i) adoption of a resilience plan, (ii) designation of a security and resilience officer, (iii) implementation of incident notification mechanisms, and (iv) personnel vetting measures for sensitive roles.
The institutional framework is reinforced through the creation of a National Commission for the Protection and Resilience of Critical Entities and an inter-ministerial coordination group.
Until the new framework is fully developed, existing instruments remain in force (National Plan, sectoral strategic plans and operational support plans).
Key contact
Pedro Manresa Junior lawyer
© Eversheds Sutherland. All rights reserved. Eversheds Sutherland is a global provider of legal and other services operating through various separate and distinct legal entities. Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.
Connect with us
