CRA for Spanish Manufacturers: INCIBE-CERT, CCN and ENAC

Spanish manufacturers face the same CRA obligations as every other EU manufacturer. This page is a country brief for Spain: how vulnerability and incident reports route through INCIBE-CERT, how conformity-assessment bodies get designated under the Spanish split (CCN notifies, ENAC accredits), what the Spanish-language obligations actually require, and what is still available from national funding programmes as the Recovery and Resilience window closes. For the full manufacturer obligation set, see the manufacturer cluster guide.

When this guide applies to you

You are the target reader if your manufacturer "main establishment in the Union" is in Spain. That means the place where decisions related to the cybersecurity of your products with digital elements are predominantly taken. A Spanish-registered sales subsidiary with engineering offshore is not the main establishment. If your engineering team, your SDLC governance, and the people approving security-update releases sit in Spain, this guide is for you.

If your main establishment is elsewhere in the EU and you only ship into Spain, your CRA reports route through the CSIRT of your main-establishment Member State, not INCIBE-CERT. The Spanish-language obligation for user-facing information still applies for any product placed on the Spanish market.

INCIBE-CERT: the Spanish CSIRT route

CRA notifications route through the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the Union. For a manufacturer whose main establishment is in Spain, that CSIRT is INCIBE-CERT.

INCIBE-CERT publishes Spanish-language vulnerability advisories and operates the consumer-product incident response stream. CCN-CERT covers public-sector and classified systems and is not the CRA route for commercial manufacturers placing products on the open market.

The technical channel for the 24h / 72h / 14d reporting cadence is the ENISA single reporting platform, which goes operational on 11 September 2026. A Spanish manufacturer files via that platform with INCIBE-CERT as the receiving coordinator. The CSIRT designation is the routing. The platform is the transport.

Notified bodies: CCN designates, ENAC accredits

Important Class I products need a notified body (Module B+C or Module H) only where harmonised standards, common specifications, or a certification scheme do not fully cover them. Important Class II products use a notified body (Module B+C or Module H) or an available and applicable certification scheme. Critical products (Annex IV) follow Article 32(4): the Article 8(1) certification route where the Commission has triggered it, otherwise the same Article 32(3) routes.

The Spanish institutional split is:

• CCN (Centro Criptológico Nacional) acts as the notifying authority that formally designates Spanish notified bodies to the European Commission under the CRA.
• ENAC (Entidad Nacional de Acreditación) is the Spanish national accreditation body and assesses the technical competence of a candidate before CCN notifies it.

The CRA framework for notified bodies applies from 11 June 2026, after which designated bodies can begin issuing CRA conformity-assessment certificates. Until then, the Spanish chain is being stood up.

A Spanish manufacturer can use any EU-notified body, not only Spanish-designated ones. Choosing a Spanish-designated one is a procurement preference (Spanish-language assessment, in-country audit logistics) and not a CRA requirement.

Market surveillance: SETID within MTDFP

The draft Spanish Real Decreto designates Secretaría de Estado de Telecomunicaciones e Infraestructuras Digitales (SETID), within Ministerio para la Transformación Digital y de la Función Pública (MTDFP), as the market-surveillance authority for CRA products in Spain. Treat this as provisional until the final BOE text is published.

INCIBE supports the technical side as a preferred laboratory, but the draft does not give INCIBE public decision-making powers for CRA market surveillance. The practical filing point for manufacturers remains: verify the final BOE designation before sending any formal submission.

Spanish-language requirements in practice

The CRA requires user-facing product information to be in a language easily understood by users and the local market-surveillance authority. For products placed on the Spanish market, that is Spanish (Castilian).

Must be in Spanish:

• The user instructions and product information shipping with the product.
• The manufacturer contact details (name, address, email or other digital contact) wherever they appear, including on the product itself, packaging, or accompanying document.
• The end-of-support date disclosure shown at the point of purchase.

Can be multilingual:

• The product label and CE marking.
• Packaging text.
• Online documentation, provided a Spanish version is reachable.

English is normally accepted for:

• Internal technical documentation. Market-surveillance authorities can request a Spanish translation if they make a reasoned request, so plan for that contingency even if you do not translate proactively.

Catalan, Galician, and Basque are co-official in their respective autonomous communities. The CRA does not require translation into co-official languages. Specific regional procurement contracts or sector regulators (for example, certain public-sector tenders) may add their own language clauses, separately from the CRA.

Selling cross-border from Spain

Spanish manufacturers selling into Portugal, France, Italy, or any other EU Member State carry the same single-routing rule: your reports still go to INCIBE-CERT, because routing follows main establishment, not per-shipment destination. You do not file with the Portuguese, French, or Italian CSIRT.

The language obligation does fan out per market. A product shipped into the French market needs French user-facing content. A product shipped into the Portuguese market needs Portuguese content. The single Spanish-language pack does not cover those markets.

Each receiving Member State's market-surveillance authority can also request your technical documentation in a language easily understood by that authority. If your supply runs broadly across the EU, expect requests in at least one widely-used working language, and treat early translation of the most-requested technical-documentation sections as a practical hedge.

National funding programmes

The funding picture has shifted as the Recovery and Resilience window closes. Be precise about what is open before you plan a line item against any of these.

• CDTI (Centro para el Desarrollo Tecnológico Industrial) has live 2026 lines: NEOTEC (early-stage tech startups), Línea Directa de Innovación (LIC), and Misiones Ciencia e Innovación (large collaborative R&D consortia). CRA-driven work fits where the angle is genuine R&D and innovation, not pure implementation or compliance. CDTI plans to mobilise over 1.8 billion euros across its 2026 lines.
• Activa Ciberseguridad is a small voucher programme (around 2,140 euros per beneficiary) for industrial SMEs, run by SGIPYME with the autonomous communities and EOI. Useful for an initial cybersecurity diagnosis or a plan-de-ciberseguridad, not for the full CRA tooling investment.
• Kit Digital is in a transition phase. All Kit Digital convocatorias closed in October 2025. Orden TDF/39/2026 (BOE, 28 January 2026) allows redistribution of remnant funds, but there is no open application window as of 25 May 2026. Check kitdigital.red.es/convocatorias before banking on it.
• Plan de Recuperación, Transformación y Resiliencia (PRTR) is in its closing window. All Recovery and Resilience projects must be executed by 31 August 2026, with Spain's final payment requests to the Commission due 30 September 2026. PRTR is therefore not a viable planning vehicle for the 11 December 2027 CRA compliance deadline. The 162 million euro RETECH initiative through INCIBE is in its final disbursement phase.

For new compliance investment dated against the 11 December 2027 obligation deadline, the realistic public funding picture in Spain is CDTI innovation lines plus any sector-specific programmes via the autonomous communities. Recovery-and-Resilience-funded programmes are not part of that picture from 2027 onward.

This article is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel for specific CRA compliance guidance.