Security, resilience and scam measures – Spain’s telecom regulatory priorities for 2026

As we enter 2026, Spain’s regulatory agenda is firmly focused on strengthening the security and resilience of telecommunications networks, services and digital infrastructures, while continuing to tackle scam traffic. 

Key developments for 2026 include the long-delayed transposition of NIS2 into Spanish law, expected to finally take place later this year, and the adoption of a Royal Decree on the Security and Resilience of Electronic Communications Networks and Services and Digital Infrastructures. This Royal Decree seeks to enhance the protection of digital infrastructures in emergency situations by establishing a regulatory framework that classifies telecommunications networks and digital infrastructures—including submarine cables and data centres—as essential services. Its objective is to prevent disruptions to critical services, mitigate the impact of incidents, and ensure the continuity of essential services at all times.

In parallel, measures to combat scam traffic will reach operational maturity. The CNMC’s alias (sender ID) registry is expected to become fully operational in June 2026, requiring providers to register all sender IDs and to block traffic originating from unregistered identifiers or providers. Alongside this, the Customer Service Act introduces Spain’s first dedicated legal framework for customer service operations, requiring providers to assign specific numbering ranges for customer services, distinct from commercial communications, and to implement technical systems and procedures to identify and block unauthorized commercial calls. 

Overall, 2026 will be defined by operationalisation and enforcement, requiring telecoms providers and operators to proactively adapt their technical, operational and compliance frameworks to meet evolving regulatory obligations.