The introduction of new criteria for identifying critical sectors in Spain could change the way many companies operate and impact national security. The government’s decision to expand the list of strategic industries is driven by the need to strengthen protections for infrastructures vital to millions of residents. Now, not only traditional sectors but also those previously overlooked by lawmakers will come under special scrutiny.
Changes to the law
The Spanish Council of Ministers has approved a draft law that, for the first time, includes urban heating and cooling systems, firms involved in hydrogen production and transportation, and companies dealing with wastewater treatment and disposal among the critical sectors. According to El Pais, these changes reflect new challenges arising from technological progress and growing societal dependence on complex infrastructures.
The document, prepared by the Ministry of the Interior, outlines three key criteria for designating a sector as critical: provision of essential services, the infrastructure’s location within Spain, and the potential for significant consequences for the population in the event of an incident. The assessment also considers the number of users, the duration and scale of possible disruptions, and the availability of alternative solutions to maintain services.
New authorities and exceptions
To implement the new regulations, a special body is set to be created — the Comisión Nacional para la Protección y Resiliencia de las Entidades Críticas (CNPREC), which will replace the current National Center for Critical Infrastructure Protection. This commission will be responsible for identifying and monitoring companies subject to the law. At the same time, the banking sector (except Banco de España), financial markets, digital infrastructure, and facilities managed by the Ministry of Defense and security forces are excluded from regulation, as separate regulations already apply to them.
The updated list now includes 11 main sectors and an equal number of subsectors. Specifically, regarding hydrogen, the rules apply not only to producers but also to companies that manage the transport, storage, and distribution of this resource. For urban heating and cooling systems, operators ensuring the functioning of these networks are subject to regulation. Companies involved in the collection, treatment, and disposal of wastewater are also, for the first time, classified as strategic.
Regulation specifics
The draft law singles out research laboratories working with hazardous or critically important materials. However, not all private security companies fall under the new requirements—only those directly responsible for ensuring vital services. This approach focuses efforts on the most vulnerable points of infrastructure.
According to russpain.com, such changes could lead to a review of security standards and additional investment in site protection. Notably, the law takes European directives into account, allowing Spain to align its regulations with EU requirements. This is particularly relevant amid recent discussions about the role of national regulators in ensuring the resilience of key sectors.
Context and consequences
The introduction of new criteria for critical sectors comes amid growing attention to security and infrastructure resilience. In recent years, Spain has already taken steps to strengthen oversight of strategic facilities, but the current bill covers a wider range of companies. As El Pais reports, the changes will affect both public and private entities, which could prompt debate over the distribution of responsibility and funding for security measures.
It is worth noting that similar issues are being discussed in other areas as part of the reform. For example, a recent debate erupted in the country over legal costs following a case involving the disclosure of tax data, which also influenced the regulatory approach to key processes. More details about notable rulings in this area can be found in the article on legal expenses between the Ayuso couple and former prosecutors — details of the legal costs dispute.
In recent years, Spain has faced the need to revise its approach to protecting critical infrastructure. In 2024, measures to strengthen oversight of energy networks were discussed following a series of outages in major cities. Attention was also given to cybersecurity and the protection of water supply systems. In 2025, several regional initiatives were adopted to modernize wastewater treatment systems, reducing health risks for the population. These developments highlight the importance of continually updating legislation and adapting to new threats.
