NIS2 and Spanish food companies: the law is late, the risk is not

NIS2 is the EU’s cyber security directive. It sets requirements for organisations in 18 critical sectors, from energy, transport and health to the production, processing and distribution of food,¹ and it makes the board answerable for security.¹ Spain should have transposed it by 17 October 2024.⁴ It has not, and its Parliament has been dissolved for a general election.¹¹ This article explains who the directive covers in food, what it asks, where Spain stands and what to do while the law is late.

Who NIS2 covers in food

The food entry in the directive’s Annex II covers “food businesses as defined in Article 3, point (2), of Regulation (EC) No 178/2002 ... which are engaged in wholesale distribution and industrial production and processing”.¹ EU food law defines a food business broadly, as any undertaking “carrying out any of the activities related to any stage of production, processing and distribution of food”.² NIS2 keeps two of those activities: industrial production and processing, and wholesale distribution.

Size decides the rest. The directive applies to companies that are medium-sized or larger.¹ Under the EU’s definition, a company is small, and so below that line, only if it has fewer than 50 staff and a turnover or balance sheet of no more than €10 million.³ In practice, a food manufacturer, processor or wholesaler is in scope with 50 or more staff, or with more than €10 million in both turnover and balance sheet. A company that is part of a group may have to include the group’s figures.³

Three details matter:

• A smaller company can still be designated where a disruption “could have a significant impact on public safety, public security or public health”.¹
• Food companies are important entities unless the state designates them essential, and important entities are supervised after the event, when there is evidence or indication that they are not complying.¹
• Some activities are not named. The food entry mentions neither retail nor primary production, nor storage and transport, although these two are stages of distribution in EU food law.¹² Finland’s food authority, for example, lists “primary production, feed production, retail trade, storage, transport” among the activities outside the scope.⁶ In Spain, the national law will settle it.

Being outside is not the end of it. Companies in scope must manage the security of their supply chain, “including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”.¹ A cold store or haulier that is not covered itself can still sit inside a covered customer’s supply chain risk.

Brussels may still adjust the details. On 20 January 2026 the Commission proposed targeted amendments, including a “small mid-cap” category (fewer than 750 staff, with a turnover of up to €150 million or a balance sheet of up to €129 million) that would mainly be treated as important. The change “does not alter the existing minimum thresholds”, and the proposal adds more detailed reporting for ransomware. It now goes to the European Parliament and the Council, with no timeline yet.⁷

Where Spain stands, as checked on 3 November 2026

Spain has not yet passed its NIS2 law. The European Commission took Spain to the EU Court of Justice in July 2026 over the delay; most other EU countries have already transposed it.⁴

No NIS2 bill ever reached Parliament. Congress’s open data lists every government bill of the current legislature, and none deals with cyber security; its list of approved laws and decree-laws, up to Real Decreto‑ley 31/2026 of 20 October 2026, contains no cyber security law.¹²

What applies today is the old law. Real Decreto‑ley 12/2018 transposed the first NIS directive and covers operators of essential services in the strategic sectors of Ley 8/2011, among them food (Alimentación).¹³¹⁴ It reaches only companies formally identified as operators of essential services.¹³

What comes next has no date. After the election, the outgoing government stays on in a caretaker role until the new one takes office, and a caretaker government cannot present bills to Congress.¹⁵ A decree-law remains possible: the first NIS directive was itself transposed by decree-law,¹³ and the government issued Real Decreto‑ley 31/2026 on 20 October 2026, after the dissolution.¹² We put no date on the Spanish law.

The draft shows the direction, but it is only a draft and may change. As law firms summarised it after its approval, it would:

• count the food industry among the important sectors;⁹
• have companies assess their own category and report it;¹⁰
• require certification under the National Security Framework (ENS) for essential entities, and let important ones choose between that certification and a self-assessment;¹⁰
• require a named information security officer, the Responsable de Seguridad de la Información;¹⁰
• set 24 hours to notify a significant incident;¹⁰
• make members of the management body jointly liable for the entity’s infringements, with fines for essential entities of up to €10 million or 2% of worldwide turnover, whichever is higher.¹⁰

What the directive asks

Once it applies, NIS2 asks four things of a company in scope.

Risk measures. At least: risk analysis and security policies; incident handling; business continuity, backups, disaster recovery and crisis management; supply chain security; security in buying, developing and maintaining systems, including handling vulnerabilities; ways to assess whether the measures work; basic cyber hygiene and training; cryptography; staff security, access control and asset management; and multi-factor authentication and secured communications.¹

Accountability at the top. The management body must approve the measures and oversee them, “can be held liable” for infringements, and its members must follow training.¹

Fast reporting. A significant incident needs an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report within one month.¹

Fines. For important entities, the maximum must be at least €7 million or 1.4% of worldwide annual turnover, whichever is higher; for essential entities, €10 million or 2%.¹

Why the 2026 refrigeration attacks matter

In the early hours of 2 November 2026, store refrigeration in at least nine European countries was taken over remotely and switched to defrost, and shops threw away chilled and frozen food. The EU’s agriculture commissioner, Christophe Hansen, called it “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”. Nobody has claimed it, and Spain was not among the countries reported hit.¹⁶ It came three weeks after the first wave, in France, which our account of the French attack sets out with its sources.

Food safety schemes are moving in the same direction. IFS Logistics version 3 asks for the product defence plan to include “IT (cyberattack)”, and IFS’s 2024 guideline adds a cyber security chapter that cites NIS2 and, drawing on published research, says the risk of cyber incidents affecting food safety “can no longer be entirely ruled out”.¹⁷

Three things to do before the law arrives

You do not need the Spanish law to start on what it will ask. Three steps follow from the directive’s own text:

1. Know what you expose. Asset management is one of the required measures,¹ and IFS recommends an asset list “including details on device connections, used protocols, and ports”.¹⁷ Start with everything reachable from the internet: portals, remote access, management pages and controllers.
2. Know who has access. Supply chain security covers your relationships with your “direct suppliers or service providers”.¹ List every outside firm that can connect to your systems, how it connects and with whose credentials.
3. Keep evidence of testing and fixing. The directive asks for ways to assess whether your measures work, and for vulnerability handling.¹ Keep a dated record of what was tested, what was found and what was fixed.

What Cantic gives your auditor