NIS2 for Spain’s Factories: The Annex II Test Behind SEAT, Airbus, and Renault’s Supply Chains — and Why the CIR Doesn’t Apply

Plain-language summary: if your factory in Spain has 50 or more employees or €10 million or more in annual turnover, and you manufacture medical devices, electronics, electrical equipment, machinery, motor vehicles, or other transport equipment, you are an Important entity under NIS2 — full stop, regardless of whether you supply automakers, airlines, or defence primes. What most guidance gets wrong is what governs your operational technology once you’re in scope: it isn’t the EU’s detailed CIR 2024/2690 technical annex, which doesn’t apply to manufacturers at all. It’s Article 21 directly, interpreted through Spain’s own INCIBE-CERT technical guidance. This article covers the scope test, what real Spanish industrial scale looks like, the routing correction most guides skip, and where automotive, aerospace, and defence supply chains actually create obligations.

Does NIS2 Apply to Your Spanish Manufacturing Operation?

NIS2 does not regulate manufacturing as a blanket category. Annex II, Section 5 of Directive (EU) 2022/2555 lists six manufacturing subsectors as “other critical sectors” [1] — and your obligations start only when three conditions are all true.

Subsector (Annex II, Section 5)	NACE Rev. 2	Typical Spanish example
Medical devices & in vitro diagnostics	Reg. (EU) 2017/745	Surgical instruments, diagnostic kits
Computer, electronic & optical products	Division 26	Semiconductors, telecom equipment
Electrical equipment	Division 27	Motors, transformers, batteries
Machinery & equipment n.e.c.	Division 28	Industrial and agricultural machinery
Motor vehicles, trailers & semi-trailers	Division 29	SEAT, Renault, and Tier 1/2 component plants
Other transport equipment	Division 30	Airbus aerostructures, rail rolling stock

Decision tree: your activity falls in one of the six divisions above, AND your business has 50+ employees or €10M+ annual turnover, AND you operate in Spain, where the directive’s obligations already apply directly from the missed transposition deadline regardless of domestic legislative delay [3] → you are an Important entity with full Article 21 obligations. Manufacturing sits in Annex II, not Annex I, so — unlike energy or banking — it cannot be classified as Essential unless Spain makes a specific national determination, which the draft law does not currently do for this sector.

Spain’s Factories Aren’t a Marginal Case

It’s easy to read a NACE code list and assume this is a compliance exercise for a handful of mid-sized parts suppliers. Spain’s actual manufacturing footprint says otherwise. SEAT’s Martorell plant near Barcelona employs more than 7,900 people and builds around 2,300 cars a day — one every 40 seconds — making it Volkswagen Group’s third-largest plant in Europe [7]. Airbus’s Getafe site outside Madrid, a roughly 51,200 square-metre complex built for 1,600 employees, assembles horizontal stabilisers for the A320, A330, and A350 families alongside space-systems structures, and ranks as Airbus’s third-largest industrial complex after Toulouse and Hamburg [8]. Renault’s Valladolid assembly plant, in operation since 1953, employed 2,895 people at the end of 2024 and produced over 200,000 Captur and Symbioz units that year across 100 hectares of grounds [9].

None of these are edge cases under Annex II’s Division 29 (motor vehicles) or Division 30 (other transport equipment) — they’re the plants the sector definition was written to capture. And each sits at the centre of a supplier network several times its own headcount, which is precisely why Article 21(2)(d) supply chain security turns into a flow-down obligation reaching far past the prime manufacturer itself.

Your Incident Line Is INCIBE-CERT — Not ESPDEF-CERT (Usually)

For compliance officers, the routing question matters as much as the scope test: notify the wrong CSIRT and your audit trail has a gap before the incident is even resolved. Spain runs three legally distinct CSIRTs, but the rule for manufacturing is simple in the overwhelming majority of cases — private companies in any NIS2 sector, including manufacturing, notify INCIBE-CERT, the CSIRT for private-sector entities under INCIBE and the Ministry of Economic Affairs and Digital Transformation. CCN-CERT handles public-sector bodies only, and ESPDEF-CERT’s mandate is narrower still: networks and systems belonging to the Spanish Armed Forces or specifically entrusted to it for National Defence purposes.

The genuine grey area is the defence supply chain. A private Tier 1 or Tier 2 supplier manufacturing components for a defence programme is not, by that fact alone, part of the Armed Forces’ own networks — but Spain’s published domestic guidance has not yet drawn a bright line for suppliers embedded deep enough into defence programmes to raise the question. Our full breakdown of Spain’s three-CSIRT structure, including this open boundary, is in Spain’s NIS2 reporting split. If your operation sits in that grey zone, treat INCIBE-CERT as your default channel and get jurisdiction-specific legal advice before assuming otherwise.

The CIR 2024/2690 Correction: What Actually Governs Your Factory’s OT Systems

Here is where most manufacturing guidance overreaches. Commission Implementing Regulation (EU) 2024/2690 sets detailed, binding technical requirements across 13 sections — logging, access control, cryptography, and more — but it applies to exactly eleven named categories of digital infrastructure and ICT service providers: DNS providers, TLD registries, cloud and data-centre operators, CDNs, managed service and security providers, online marketplaces, search engines, social networks, and trust services [4]. A car plant, an aerospace structures facility, or a machinery manufacturer is not on that list. If your factory isn’t one of those eleven provider types, the CIR’s specific technical mandates do not bind you directly — Article 21 of the directive itself does, in its general, outcome-based form [4].

That leaves a practical gap: what technical benchmark should a Spanish manufacturer actually build against? INCIBE-CERT already publishes two ICS-specific technical guides that predate NIS2’s Spanish transposition and don’t reference the directive by name, but map cleanly onto Article 21(2)’s risk-management measures. Its asset inventory guide for industrial control systems [5] sets out inventory methods, classification, and tooling — the practical starting point for the asset-management element of Article 21(2)(i). Its endpoint defense guide for industrial control systems [6] covers hardening, IDS, and SIEM deployment appropriate to networked industrial devices — feeding directly into the technical controls an auditor will expect under Article 21(2)(e). Neither guide is a legal compliance checklist, and neither should be cited as satisfying a specific Article 21 sub-clause on its own — but as a Spanish-sourced, national-CSIRT-published technical reference for OT environments, they carry more direct relevance to a Spanish factory floor than a generic international framework.

Automotive, Aerospace, and Defence Supply Chains Under Article 21(2)(d)

For SME owners supplying one of Spain’s large assembly or aerostructures plants, NIS2 exposure frequently arrives contractually before it arrives by direct regulatory letter. Article 21(2)(d) requires in-scope entities to address supply chain security, including vulnerabilities specific to each direct supplier — which in practice means prime manufacturers push security requirements down their supplier tiers well before any regulator asks a supplier directly. Our France manufacturing guide already documents this pattern with Airbus, Safran, and Thales pushing compliance requirements onto subcontractors who may not independently meet the sector-plus-size test; Spain’s own aerospace and automotive primes sit inside the same international supply chains and the same commercial pressure.

Defence-adjacent suppliers face a second layer worth naming honestly rather than glossing over: supplying a defence programme does not, on its own, make a private manufacturer a “defence entity” for CSIRT-routing purposes, and it does not exempt that supplier from Annex II manufacturing obligations if it independently meets the sector-plus-size test. The two questions — who you report an incident to, and whether NIS2 applies to you at all — are separate, and conflating them is one of the more common scoping mistakes in this cluster of suppliers.

Spain’s Penalty Exposure If You Get This Wrong

Article 34 of the directive sets the EU floor for Important entities — which is the default classification for manufacturing — at a maximum fine of at least €7 million or 1.4% of total worldwide annual turnover, whichever is higher [2]. Spain’s draft law structures domestic infractions into three tiers, with the standard “muy grave” ceiling landing at €2 million for most cases — though the worst violations can still escalate toward the full EU maximum, and Article 35 of the draft law adds personal, joint-and-several liability for management body members on a separate track from the organisational fine. For the complete tier breakdown and enforcement hierarchy, see Spain’s NIS2 penalty structure.

A short compliance checklist for manufacturing entities acting now, ahead of Spain’s law entering force: confirm your NACE division and headcount/turnover position against the table above; register with the relevant competent authority once Spain’s registration window opens; build (or adapt) an OT-specific risk register and asset inventory using INCIBE-CERT’s published methodology; classify direct suppliers by criticality under Article 21(2)(d); and get board-level sign-off on the resulting risk-management framework, since Article 20 places that approval obligation on management personally, not on IT alone.

Frequently Asked Questions

Does NIS2 apply to a Spanish auto-parts supplier with 80 employees? Yes, if the supplier’s activity falls within NACE Divisions 26-30 or medical device manufacturing and it exceeds 50 employees or €10 million in annual turnover, it is an Important entity regardless of whether Spain’s domestic law has formally entered force, since the directive’s obligations already apply from the missed transposition deadline.

Does CIR 2024/2690 apply to my factory’s OT network? No. The CIR binds only eleven named digital-infrastructure and ICT service-provider categories. Manufacturing entities remain governed by Article 21 of the directive directly, without the CIR’s specific technical mandates attaching.

Which CSIRT does a private manufacturer report to in Spain? INCIBE-CERT, in almost all cases — including manufacturers supplying defence programmes, unless the entity itself is specifically entrusted with Armed Forces networks or systems.

Can a manufacturing entity be classified as Essential rather than Important? Only if Spain makes a specific national determination for that entity; Annex II sectors default to Important status and manufacturing has received no such upgrade under the current draft law.

What if my company is too small to be in scope but supplies a company that is? You have no direct NIS2 obligation of your own, but Article 21(2)(d) requires your customer to assess and manage risk from its direct suppliers — in practice, expect security questionnaires, contractual clauses, or audit rights requested contractually rather than a regulatory letter. Treat it as a commercial requirement to satisfy, not a sign that NIS2 itself now covers you.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

1. NIS2 Directive Annex II — Other Critical Sectors (Manufacturing, Section 5) — Springlex
2. NIS2 Directive, Article 34: Penalties — nis-2-directive.com
3. NIS2 Directive, Transposition in Spain — nis-2-directive.com
4. Commission Implementing Regulation (EU) 2024/2690, scope of applicable entities — nisd2.eu
5. Guía para la gestión de un inventario de activos en sistemas de control industrial — INCIBE-CERT
6. Guía de defensa de endpoints en sistemas de control industrial — INCIBE-CERT
7. SEAT Martorell production figures 2019 — SEAT
8. Airbus Getafe plant expansion — Invest in Spain
9. Renault Valladolid Montaje Plant — Renault Group