Regulatory Update in Spain: Q3 2026

Spain';s regulatory environment has shifted considerably in recent months, with new obligations affecting corporate governance, data protection, employment, and environmental compliance. Businesses operating in Spain - whether domestic or foreign-owned - face a more demanding compliance calendar than in previous years. This guide covers the most material legislative and regulatory developments, explains their practical implications, and outlines the steps companies should take to remain compliant.

Several pieces of legislation have come into force or entered their implementation phase, touching nearly every sector of the Spanish economy.

The most structurally significant is the transposition of the EU Corporate Sustainability Reporting Directive (CSRD) into Spanish law. Spain has incorporated the directive through amendments to the Código de Comercio and the Ley de Sociedades de Capital, extending mandatory non-financial reporting to a broader category of companies. Large public-interest entities were already subject to reporting requirements under the earlier Non-Financial Information and Diversity Law (Ley 11/2018), but the current wave of rules pulls in medium-sized companies that meet two of three thresholds: more than 250 employees, net turnover above EUR 40 million, or total assets above EUR 20 million. Affected companies must now publish detailed sustainability statements covering environmental impact, social matters, and governance structures, verified by an independent auditor registered with the Instituto de Contabilidad y Auditoría de Cuentas (ICAC).

A second major development is the entry into force of the updated Ley Orgánica de Protección de Datos y Garantía de los Derechos Digitales (LOPDGDD) implementing guidance, which aligns more closely with the European Data Protection Board';s recent opinions on consent management and cookie compliance. The Agencia Española de Protección de Datos (AEPD) has issued binding resolutions clarifying that pre-ticked consent boxes, bundled consent, and consent obtained through dark patterns are non-compliant. Companies that rely on digital advertising or analytics tools must audit their consent management platforms and update their privacy notices accordingly.

Third, Spain has enacted implementing regulations under the EU Artificial Intelligence Act. The national supervisory authority for AI - provisionally housed within the Ministerio de Asuntos Económicos y Transformación Digital - has published guidance on the classification of high-risk AI systems and the conformity assessment procedures that Spanish-based deployers must follow. Companies using AI in recruitment, credit scoring, or access to essential services are now subject to registration and documentation obligations.

The Registro Mercantil Central and the Dirección General de Seguridad Jurídica y Fe Pública have jointly issued updated guidance on the beneficial ownership register maintained under the Ley 10/2010 de prevención del blanqueo de capitales y de la financiación del terrorismo. All Spanish companies, branches of foreign entities, and certain trusts must verify and update their beneficial ownership data. The deadline for the current verification cycle has passed, and companies that have not updated their records face administrative sanctions ranging from warnings to significant fines.

A common mistake among foreign-owned subsidiaries is assuming that the parent company';s group-level compliance programme satisfies Spanish local requirements. In practice, Spanish law requires a separate, locally documented compliance programme (programa de cumplimiento normativo) that addresses the specific risks of the Spanish entity. The Fiscalía General del Estado has reinforced this position in recent enforcement actions, making clear that a generic group policy does not shield a Spanish subsidiary from criminal liability under Article 31 bis of the Código Penal.

Directors of Spanish companies should also note that the Ley de Sociedades de Capital has been interpreted by the Tribunal Supremo in a series of recent rulings to impose a heightened duty of care on non-executive directors. Passive board members who fail to challenge management decisions in areas of known risk - including environmental compliance and data protection - may be held personally liable. This has practical implications for the composition and functioning of supervisory boards in Spain.

For companies considering restructuring, the Ley 16/2022 de reforma del texto refundido de la Ley Concursal, which transposed the EU Restructuring Directive, continues to generate case law. Spanish courts have now handled a meaningful number of pre-insolvency restructuring plans, and the jurisprudence is clarifying the rights of dissenting creditors and the conditions under which cross-class cram-down can be applied. Companies in financial difficulty should engage restructuring counsel early, as the procedural requirements are strict and the windows for action are narrow.

If your company is navigating governance updates or restructuring obligations in Spain, we can help structure the setup correctly the first time. Contact us at info@vlolawfirm.com.

Spain';s labour framework has seen significant activity. The Estatuto de los Trabajadores and the Ley Reguladora de la Jurisdicción Social continue to evolve through both legislative amendment and judicial interpretation, and employers must track both channels.

The most operationally demanding recent change is the expansion of mandatory digital time-recording obligations. Following the 2019 reform that introduced compulsory daily time-tracking, the Inspección de Trabajo y Seguridad Social has intensified enforcement and issued sector-specific guidance on what constitutes an adequate recording system. Remote and hybrid workers must be covered by the same system as on-site employees. Many employers underestimate the evidentiary standard required: a simple spreadsheet or honour-based system is unlikely to satisfy an inspector. Employers should implement a certified digital system that records start time, end time, and any interruptions, and retain records for at least four years.

The Ley de Igualdad (Ley Orgánica 3/2007) and its implementing regulations on pay transparency have also moved into active enforcement. Companies with 50 or more employees must maintain an equality plan (plan de igualdad) registered with the Registro de Planes de Igualdad de las Empresas. Recent inspections have focused on whether the pay audit (auditoría retributiva) embedded in the equality plan genuinely identifies and addresses unjustified gender pay gaps, rather than simply documenting existing structures. Inspectors are now requesting the underlying data and methodology, not just the final report.

A non-obvious requirement that catches many foreign employers is the obligation to register collective agreements (convenios colectivos) at the sector level. Even if a company has its own internal pay structure, it must apply the minimum conditions of the applicable sector convenio, including salary tables, working time limits, and classification categories. Failure to apply the correct convenio is one of the most common findings in labour inspections of foreign-owned businesses.

The Fondo de Garantía Salarial (FOGASA) contribution rates and the Social Security contribution bases have been updated. Employers should verify that their payroll systems reflect the current bases, as underpayment generates automatic surcharges and interest.

Spain has accelerated its environmental compliance agenda in line with EU Green Deal commitments. The Ley 7/2022 de residuos y suelos contaminados para una economía circular is now fully in force, and the implementing regulations covering extended producer responsibility (EPR) schemes are operational.

Companies that place packaged goods, electrical and electronic equipment, batteries, or vehicles on the Spanish market must register with the Registro de Productores de Productos and join an authorised collective compliance scheme (sistema colectivo de responsabilidad ampliada del productor). The registration obligation applies regardless of whether the company is established in Spain or sells into Spain from another EU member state through distance selling. A common mistake is assuming that registration in another EU country satisfies the Spanish obligation - it does not.

The Ministerio para la Transición Ecológica y el Reto Demográfico has also published updated guidance on the Emissions Trading System (ETS) obligations for Spanish installations. Operators must submit verified annual emissions reports and surrender the corresponding allowances by the statutory deadlines. Late surrender triggers automatic penalties calculated per tonne of excess emissions, and the amounts are material.

For the construction and real estate sector, the Código Técnico de la Edificación has been updated to incorporate stricter energy efficiency standards aligned with the EU Energy Performance of Buildings Directive. New builds and major renovations must meet near-zero energy building (NZEB) standards. Developers and contractors who have not updated their project specifications face the risk of permits being refused or construction being halted.

Environmental due diligence has also become a standard element of M&A transactions in Spain. Buyers are increasingly requiring Phase I and Phase II environmental assessments as a condition of signing, and representations and warranties insurance providers are excluding environmental liabilities that were not adequately disclosed. Sellers should prepare environmental disclosure schedules early in any transaction process.

The AEPD has maintained a high enforcement tempo. Recent decisions have resulted in significant sanctions against companies in the financial services, telecommunications, and retail sectors for failures in data subject rights management, inadequate data processing agreements with processors, and unlawful international data transfers.

The practical implication for businesses is that data protection compliance must be treated as an operational function, not a legal formality. The AEPD';s inspection methodology now includes technical audits of IT systems, not just document reviews. Companies should ensure that their Records of Processing Activities (RoPA) are current, that data processing agreements with all processors and sub-processors are in place and up to date, and that data subject request workflows are tested and functional.

Spain has also implemented the EU Digital Services Act (DSA) at the national level, designating the Comisión Nacional de los Mercados y la Competencia (CNMC) as the Digital Services Coordinator for intermediary services below the threshold of very large online platforms. Online marketplaces, hosting providers, and search engines operating in Spain must comply with transparency reporting obligations, notice-and-action mechanisms for illegal content, and point-of-contact requirements. The CNMC has begun issuing guidance and has signalled that it will prioritise enforcement against non-compliant intermediaries in the near term.

The EU AI Act';s risk classification framework is generating significant compliance work for Spanish companies in the financial sector. Credit institutions and insurance companies using automated decision-making tools must assess whether those tools fall within the high-risk category and, if so, implement the required technical documentation, human oversight mechanisms, and conformity assessments. The national supervisory authority has indicated that it will coordinate with the Banco de España and the Comisión Nacional del Mercado de Valores (CNMV) on sector-specific AI governance expectations.

For assistance with data protection audits, DSA compliance, or AI governance frameworks in Spain, contact our team at info@vlolawfirm.com.

Does the CSRD reporting obligation apply to non-EU parent companies with Spanish subsidiaries?

The obligation attaches at the entity level in Spain, not at the group level. A Spanish subsidiary that meets the relevant size thresholds must produce a sustainability statement under Spanish law, even if its non-EU parent is not subject to equivalent requirements in its home jurisdiction. In practice, many multinational groups are choosing to produce a consolidated group-level report and then extract the Spain-specific data for local filing. However, the local report must still be signed off by a Spanish-registered auditor and filed with the Registro Mercantil. Companies should not assume that a group report produced under another jurisdiction';s standards will satisfy the Spanish requirement without adaptation.

How quickly must a company respond to a data subject access request under Spanish law, and what are the consequences of missing the deadline?

Under the GDPR as applied in Spain, a data subject access request must be responded to within one calendar month of receipt. This period can be extended by a further two months where the request is complex or numerous, but the company must notify the data subject of the extension and the reasons within the first month. The AEPD treats missed deadlines as a serious infringement. Sanctions for failure to respond can reach several million euros for large companies, and the AEPD has shown willingness to impose fines at the upper end of the range in cases where the failure appears systemic rather than accidental. Companies should have a documented workflow for logging, tracking, and responding to requests.

What is the difference between a pre-insolvency restructuring plan and a formal insolvency proceeding in Spain, and when should a company choose the restructuring route?

A pre-insolvency restructuring plan under the reformed Ley Concursal allows a company to negotiate a binding restructuring with creditors outside formal insolvency, subject to court confirmation. The key advantage is speed and confidentiality: the process can be completed in weeks rather than the months or years typical of a formal concurso de acreedores. The restructuring route is appropriate when the company is viable as a going concern but has an unsustainable debt structure, and when it can secure support from a sufficient majority of creditors. Formal insolvency is more appropriate when the company needs the automatic stay on enforcement actions, when creditor negotiations have broken down, or when the company is not viable and an orderly wind-down is required. The choice has significant consequences for directors'; liability, so legal advice should be sought before any filing.

Spain';s regulatory landscape is evolving rapidly across corporate, employment, environmental, and digital domains. Companies that treat compliance as a periodic exercise rather than a continuous operational function face growing exposure to sanctions, reputational risk, and personal liability for directors. The practical priority for most businesses is to conduct a structured gap analysis against the current requirements, update internal policies and documentation, and ensure that compliance responsibilities are clearly assigned within the organisation.

VLO Law Firms advises international clients on regulatory compliance and corporate matters in Spain. We can assist with sustainability reporting obligations, data protection audits, employment law compliance, restructuring advice, and environmental due diligence. To request a consultation, contact: info@vlolawfirm.com