We guide organizations of every size, especially SMEs, through NIS2, DORA, ISO 27001, ENS, the AI Act, CRA, TISAX and IEC 62443. Our four steps are gap analysis, internal audit, implementation and support through certification, a TISAX label or CE marking. We also bring security into the design and development of applications.
Request your free GAP analysis →NIS2, DORA, ISO 27001, ENS, the AI Act, CRA and TISAX each have their own scope, language and deadlines. SMEs may assume these rules do not apply or rush into certification under customer pressure. Suppliers to regulated companies may also face contractual requirements.
We determine what applies first, then build a realistic plan.
Covers critical and important sectors, generally companies with at least 50 employees or over €10 million in turnover, and can affect their suppliers. Spain has yet to complete transposition, but supply chains already request its measures. It includes secure development and maintenance; fines can reach €10 million or 2% of turnover.
Applies directly to financial entities since 17 January 2025 and can reach their ICT suppliers through contracts.
A voluntary information security management standard increasingly requested by major customers and tenders.
Spain’s security framework for public administrations and their suppliers, with basic, medium and high levels.
Can affect any company using AI. AI literacy duties began in February 2025 and transparency duties apply from 2 August 2026. Spain’s AESIA supervises its application.
Applies to manufacturers, importers and distributors of connected or software products. Reporting of exploited vulnerabilities and serious incidents began on 11 September 2026, including for products already sold. Cybersecurity CE marking applies from 11 December 2027.
For automotive suppliers. An ENX-accredited assessment produces a label valid for up to three years, not a certificate. VDA ISA2027 becomes the default catalogue for assessments contracted from 1 January 2027.
Technical foundation for industrial OT security, industrial NIS2 and CRA product requirements, particularly parts 4-1 and 4-2.
Security by design brings security into the earliest stages of an application or product, when preventing a flaw costs less than fixing one in production.
NIS2 covers secure development and maintenance, ISO 27001 includes a secure development life cycle, CRA requires security by design and default, and IEC 62443-4-1 defines secure development for industrial products.
Our secure application development consulting brings security into requirements, design, testing, deployment and maintenance.
Explore our secure development service →We help inventory AI tools, classify each use, set internal rules, train staff and review them regularly. ISO/IEC 42001 can provide a useful structure without requiring certification.
We work for you, so you can stay focused on your business without worries or disruption.
Start with a free GAP analysis →It means building security into an application or product from the start. It matters if you develop software, commission it or make products containing it. NIS2, ISO 27001 and CRA include secure development requirements.
Yes. A critical role or a contract with an obligated entity can bring requirements even below the general size thresholds of 50 employees or €10 million.
Direct obligations depend on the national law, which is still pending. The EU deadline passed in October 2024, customers already ask for these measures, and preparation takes time.
ISO 27001 is a voluntary international standard. ENS is mandatory for Spanish public administrations and many suppliers. Their shared principles make progress in one useful for the other.
Using AI can create obligations even if you do not develop it. Transparency duties apply from August 2026, including notice of AI interaction and labelling synthetic content where required.
Yes for reporting exploited vulnerabilities and serious incidents from 11 September 2026. Cybersecurity CE marking applies from 11 December 2027.
TISAX is an assessment resulting in a label valid for up to three years. ISO 27001 controls can be reused but do not replace it.
It becomes the default catalogue for assessments contracted from 1 January 2027. Earlier contracts or initial assessments before 1 April 2027 may continue under ISA 6.