On 8 July the European Commission decided to refer Spain to the Court of Justice of the European Union. The reason is the failure to notify the transposition of the NIS2 directive, the rule that sets the common cybersecurity level for eighteen critical sectors, among them health, energy, transport and the public sector. Spain is not alone, Ireland, France and the Netherlands go with it. The Commission is asking the Court to impose financial penalties, a lump sum and daily fines until transposition is complete.
The calendar leaves little room for interpretation. The deadline expired on 17 October 2024. The Commission sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025. In Spain, the draft Cybersecurity Coordination and Governance Act was approved in the Council of Ministers on 14 January 2025 and has been sitting there since, without reaching the official gazette. Almost two years past the deadline, the Spanish rule does not exist.
From there comes a comfortable and wrong conclusion, that with no law there is nothing to review. The mistake is to confuse who the rule binds with how far its effect reaches.
The obligation already travels through the contract
If your organisation sits in one of the covered sectors, supply chain risk management is a measure required by the directive itself, not good practice. And if it does not, your covered clients pass it on to you by contract. Either way the result for internal audit is the same, there is a new control that somebody has to evidence.
The shape it takes is always similar, a security questionnaire before signing and new clauses at every renewal. Answering it is not the problem. The problem is that the answer the business signed eight months ago has to still be true today, and almost nobody is checking.
Four things the auditor can test this cycle
- Who responds at each critical supplier. A name, a role and a channel, reviewed in the last twelve months. It is the first question on the questionnaire and the one most often answered with a shared mailbox nobody reads any more.
- Notification windows passed down. Covered entities report incidents in hours, not days. Check that this clock appears in the supplier contract, that the supplier knows it, and that there is evidence of the last time it was used.
- Measures you can show. The clause saying the supplier takes backups is not enough. Ask since when, how often, when the last restore was tested and who checked it. What is not recorded does not exist in a review.
- The supplier's own chain. If part of the service rests on a sub-processor, the question passes straight through. The fourth tier is where almost every inventory breaks.
Where to put the fines
For anyone in breach of the risk management measures or the duty to report, NIS2 requires member states to provide for maximum fines of at least ten million euros or 2% of the group's total worldwide annual turnover for essential entities, and at least seven million or 1.4% for important ones, whichever is higher. That number deserves its proper place in the report. For most organisations the immediate exposure is not the fine, it is the contract that does not get renewed and the client asking for evidence nobody has gathered yet.
The temptation to wait remains. In January 2026 the Commission proposed amendments to NIS2 itself to give legal clarity and ease compliance. What gets simpler is how you comply, not whether you have to, and your client's questionnaire does not depend on that. It depends on their next audit.
The useful question today is not when the Spanish law will arrive. It is how many of your critical suppliers could show that evidence tomorrow, and how long it would take you to gather it. If nobody knows, that is the finding, and it fits the capability gap the profession already measures.
Gathering that evidence, cross-checking it between systems and leaving every answer with its source is the work Prufy prepares so the auditor can decide.
