Critical Infrastructure Interdependency: Banking, Energy and Telecommunications under Spanish Law

Detailed legal analysis | Spain and European Union law | Statutes, regulatory obligations, case law and national security

1. Executive overview

In Spain, banking, energy and telecommunications form an interdependent network of essential services whose disruption can affect national security, economic stability and public safety.

Spanish law does not treat these sectors as completely independent. Instead, it establishes overlapping obligations concerning critical-infrastructure protection, financial operational resilience, cybersecurity, continuity of essential services, incident reporting and national security.

The core legal framework includes:

Ley 8/2011, de 28 de abril, establishing measures for the protection of critical infrastructures.

Real Decreto 704/2011, de 20 de mayo, implementing Spain's critical-infrastructure protection regime.

Ley 36/2015, de 28 de septiembre, de Seguridad Nacional, establishing the broader national security framework.

Real Decreto-ley 12/2018 and Real Decreto 43/2021, governing the security of network and information systems within their applicable scope.

Regulation (EU) 2022/2554 — DORA, imposing digital operational resilience obligations on financial entities and regulating critical ICT third-party service providers.

Directive (EU) 2022/2557 — CER, addressing the resilience of critical entities.

Directive (EU) 2022/2555 — NIS2, establishing an EU cybersecurity framework across essential and important sectors.

Ley 24/2013, del Sector Eléctrico, governing the Spanish electricity sector.

Ley 11/2022, General de Telecomunicaciones, governing electronic communications networks and services.

The important distinction is that critical-infrastructure designation, critical-entity identification, financial systemic importance and designation as a critical ICT third-party provider are separate legal statuses. They can overlap, but one does not automatically establish another.

The interdependency model

Conceptual model showing how failures in one essential sector may cause cascading disruptions in the others.

For example, an electricity outage may interrupt mobile towers and data centres; loss of connectivity may disrupt banking authentication and payment processing; banking disruption may then impair commercial transactions across the energy and telecommunications sectors.

The legal significance is that the origin of a disruption and the entities legally responsible for managing its consequences may be different.

2. Spain's legal architecture for critical infrastructure

2.1 Ley 8/2011 — Protection of critical infrastructures

Spain's principal critical-infrastructure statute is Ley 8/2011, de 28 de abril.

Its principal objectives include identifying infrastructures whose disruption would seriously affect essential services, establishing protective measures, coordinating public authorities and operators, and creating planning obligations.

Article 2 contains important definitions, including:

Strategic infrastructure (infraestructura estratégica): facilities, networks, systems and equipment whose operation is indispensable and for which alternative solutions are not readily available or are inadequate.

Critical infrastructure (infraestructura crítica): strategic infrastructure whose operation is indispensable and which does not permit alternative solutions, so that its disturbance or destruction would seriously affect essential services.

Essential service (servicio esencial): a service necessary for maintaining basic societal functions, health, security, social and economic well-being, or the effective functioning of state institutions and public administrations.

These distinctions matter because an infrastructure can be commercially important without meeting the legal requirements for critical-infrastructure designation.

A banking headquarters, a substation, or a telecommunications exchange is not necessarily a formally designated critical infrastructure merely because it performs an important function.

2.2 Banking, energy and telecommunications as strategic sectors

Annex I to Ley 8/2011 identifies strategic sectors and subsectors, including the financial and tax system, energy, and information and communication technologies.

The inclusion of a sector in the statutory framework does not mean every operator or asset within it is automatically designated as critical.

2.3 Real Decreto 704/2011

Royal Decree 704/2011 develops the institutional and operational structure of the critical-infrastructure protection system.

Relevant elements include:

Identification and assessment of critical infrastructures.

The national catalogue of strategic infrastructures.

Designation of critical operators.

Strategic sector plans.

Operator Security Plans (Planes de Seguridad del Operador, PSO).

Specific Protection Plans (Planes de Protección Específicos, PPE).

Coordination with competent security authorities.

Spain's National Centre for Infrastructure Protection and Cybersecurity, commonly known as CNPIC, plays a central coordinating role.

A key legal distinction is that these plans concern the protection of designated infrastructure and operators, while the broader cyber-resilience obligations under DORA, NIS rules and sectoral legislation may apply independently.

2.4 National security legislation

Ley 36/2015 provides a broader national security framework, allowing serious cross-sector disruptions to be approached as matters affecting the stability and functioning of the state.

Its concept of national security extends beyond conventional military threats to include risks affecting essential services and strategic capabilities.

However, an ordinary outage does not automatically become a national-security crisis. Specific statutory conditions and the relevant governmental procedures must be satisfied before exceptional national-security mechanisms can be invoked.

3. Banking sector: criticality, financial resilience and dependencies

3.1 Why banking qualifies as an essential sector

Banks perform functions that are indispensable for economic continuity, including deposit-taking, credit provision, payment processing, liquidity management and access to financial markets.

The interruption of these services can have consequences extending beyond individual customers or institutions.

For example, a prolonged disruption affecting a significant payment processor could impede wages, merchant transactions, supplier payments and financial settlement obligations.

However, Spanish law distinguishes between:

A bank classified as a critical operator under the critical-infrastructure protection framework.

A bank identified as a systemically important institution under banking prudential rules.

A bank subject to DORA, regardless of any critical-infrastructure designation.

A payment system designated or overseen under applicable payment-system legislation.

These classifications have different legal tests, authorities and consequences.

3.2 DORA: Regulation (EU) 2022/2554

DORA became applicable on 17 January 2025 and is a central component of the banking sector's operational resilience framework.

It is especially relevant to the banking–energy–telecommunications relationship because it requires financial entities within its scope to understand and manage ICT dependencies that could interrupt critical or important functions.

Important provisions include:

Article 8 is particularly important for cross-sector interdependency.

It requires financial entities to identify, classify and adequately document ICT-supported business functions, information assets, ICT assets, and relevant dependencies.

Consider a Spanish bank whose core payment processing requires:

Electricity supply to two data centres.

Fibre-optic connections between processing locations.

A cloud service for transaction processing.

Telecommunications services for customer authentication.

External ICT suppliers providing network and security management.

The bank must examine the operational dependencies within the scope of its ICT risk management obligations.

An important qualification is that DORA does not automatically convert every electricity supplier into an ICT third-party provider. The contractual duties specifically governing ICT third-party services apply according to the legal nature of the services supplied.

3.3 Responsibility cannot simply be transferred to suppliers

Under DORA, a financial entity remains responsible for compliance with its obligations even when it relies upon external ICT service providers.

Therefore, a bank generally cannot establish that it met its operational-resilience duties merely by showing that the initial failure occurred at an outside telecommunications provider.

Regulators may examine whether the bank had:

Appropriately identified concentration and dependency risks.

Assessed foreseeable service failures.

Implemented proportionate continuity and recovery arrangements.

Tested its incident response capabilities.

Established appropriate contractual protections.

Classified and reported major ICT-related incidents as required.

This is a regulatory responsibility analysis, not an automatic rule that banks must compensate every customer affected by an external outage.

3.4 Banking case law

Case 1: Kotnik and Others v Državni zbor Republike Slovenije

CJEU, Case C-526/14, judgment of 19 July 2016

Facts: The case concerned European Commission rules on state aid to banks during the financial crisis and the conditions under which shareholders and subordinated creditors could be required to contribute to restructuring.

Legal questions: The referring court questioned the compatibility of burden-sharing requirements with EU law, including legitimate expectations and property rights.

Decision: The Court upheld the relevant state-aid framework subject to applicable legal safeguards and requirements, including proportionality.

Relevance to critical infrastructure: Although this was not an infrastructure-designation case, it demonstrates that protecting financial stability may justify substantial regulatory intervention affecting private financial interests.

Legal principle: Systemic financial concerns can support exceptional regulatory measures, but such measures remain subject to EU law and proportionality.

Case 2: Ledra Advertising Ltd and Others v European Commission and European Central Bank

CJEU, Joined Cases C-8/15 P to C-10/15 P, judgment of 20 September 2016

Facts: Depositors challenged measures adopted in connection with the restructuring of Cyprus's banking sector.

Decision: The Court recognised that EU institutions must respect fundamental rights when acting in connection with financial assistance arrangements. On the facts, the challenged measures did not establish the alleged disproportionate interference with the right to property.

Relevance: Public-interest measures intended to preserve financial-system stability do not operate outside the rule of law.

Application to Spain: Regulatory responses to major banking interruptions must remain consistent with applicable constitutional principles and EU fundamental-rights requirements.

Case 3: Berlusconi and Fininvest v Banca d'Italia and IVASS

CJEU, Case C-219/17, judgment of 19 December 2018

Issue: Judicial review of decisions concerning qualifying holdings in credit institutions within the Single Supervisory Mechanism.

Decision: The Court clarified the allocation of jurisdiction where national supervisory authorities participate in a procedure culminating in an ECB decision.

Relevance: Banking supervision in Spain may involve both national and EU authorities, but their powers must be analysed according to the particular legal mechanism involved.

The case does not confer ordinary banking supervisory authority on critical-infrastructure security bodies.

4. Electricity: an enabling infrastructure for banking and telecommunications

4.1 Spanish electricity legislation

Spain's principal electricity-sector statute is Ley 24/2013, de 26 de diciembre, del Sector Eléctrico.

This legislation establishes the regulatory framework for activities including electricity generation, transmission, distribution and supply.

For interdependency analysis, its importance lies in the organisation of the electricity system and the obligations imposed on regulated operators.

Other relevant instruments include:

Real Decreto 1955/2000, concerning electricity transport, distribution, commercialisation, supply and authorisation procedures, as subsequently amended.

EU Regulation 2019/943 on the internal market for electricity.

EU Directive 2019/944 on common rules for the internal market for electricity.

Relevant electricity network codes and system operation procedures.

EU Regulation 2019/941 on risk preparedness in the electricity sector.

4.2 Why electricity disruption creates cascading risk

Telecommunications networks require electrical power for their exchanges, transmission systems, mobile installations, network control facilities and data centres.

Banking systems depend on electricity not only at the bank's own premises but also at telecommunications providers, cloud facilities, payment processors and other suppliers.

The resulting dependency can be represented as:

Electricity network interruption

Power disruption at telecommunications or data-centre facilities

Connectivity loss or reduced ICT availability

Banking services and payments interrupted

Potential economic, public-safety and national-security consequences

Illustrative risk pathway, not a finding that any particular Spanish incident followed this sequence.

A single energy failure does not necessarily produce all these consequences. The outcome depends on alternative power, redundancy, network design, backup systems, restoration capability and the duration and geographical extent of the interruption.

4.3 Legal obligations of energy operators

Depending on the activity and the operator's status, relevant requirements may concern:

Reliability and quality of electricity supply.

System security and operational continuity.

Compliance with regulatory and technical standards.

Critical-infrastructure protection.

Cybersecurity and incident management.

Cooperation with relevant public authorities.

Emergency and restoration arrangements.

Designation as a critical operator adds specific duties under the critical-infrastructure regime, but it does not replace general electricity-sector obligations.

4.4 Electricity case law

Case 4: Campus Oil Ltd and Others v Minister for Industry and Energy

CJEU, Case 72/83, judgment of 10 July 1984

Facts: Ireland adopted measures intended to secure supplies of petroleum products from a domestic refinery.

Issue: Whether restrictions on imports could be justified on public-security grounds.

Decision: The Court recognised that petroleum products were fundamentally important to a state's existence and that an interruption in their supply could seriously affect public security. However, restrictive measures had to satisfy the requirements for justification under EU law.

Significance: Energy security can constitute an overriding public-security interest.

Application to Spain: This supports the proposition that protecting essential energy supplies may justify carefully limited intervention. It does not grant a general exemption from EU free-movement, competition or proportionality requirements.

Case 5: Commission v Belgium

CJEU, Case C-503/99, judgment of 4 June 2002

Facts: Belgium maintained special state rights concerning strategic energy undertakings.

Issue: Whether these rights infringed the free movement of capital.

Decision: The Court accepted the contested arrangements in the circumstances examined, with particular attention to their connection with safeguarding energy supplies and the legal constraints on governmental intervention.

Principle: Protecting energy supply can justify certain strategic controls where the measures are sufficiently defined, reviewable and proportionate.

Relevance: Public authorities may have legitimate interests in protecting infrastructure supporting banking and communications, but the regulatory mechanism must have a lawful and proportionate basis.

Case 6: Commission v Spain

CJEU, Case C-463/00, judgment of 13 May 2003

This case is especially relevant to Spanish strategic infrastructure.

Facts: Spain maintained a system of prior administrative approval for certain important corporate decisions involving undertakings in strategic sectors, including energy and telecommunications.

Issue: Whether the Spanish arrangements were compatible with the free movement of capital.

Decision: The Court found that the Spanish regime infringed EU law.

Legal significance: A government cannot rely on the strategic importance of a company to justify indiscriminate or disproportionate restrictions on investments and corporate decisions.

Implication for critical infrastructures: Designation and strategic importance may justify protective obligations, but they do not automatically authorise unlimited governmental control over corporate ownership or economic activity.

This is a particularly useful authority when analysing national-security intervention in Spanish banks, electricity companies and telecommunications operators.

5. Telecommunications: the connective infrastructure

5.1 Ley 11/2022, General de Telecomunicaciones

Spain's telecommunications regime is governed principally by Ley 11/2022, de 28 de junio, General de Telecomunicaciones.

The statute regulates electronic communications networks and services, the rights and obligations of market participants, certain aspects of network security, public intervention and regulatory supervision.

For the banking and energy sectors, the most relevant concerns are:

Security and integrity of public electronic communications networks.

Continuity and availability of communications.

Network resilience and incident handling.

Compliance with applicable security requirements.

Cooperation with competent authorities.

Emergency communications and relevant public-interest obligations.

These obligations operate alongside applicable cybersecurity law and, where relevant, critical-infrastructure protection requirements.

5.2 The operational importance of telecommunications

Banking systems rely on telecommunications for branch connectivity, digital banking access, payment authorisation, communications with service providers and interconnection with financial infrastructures.

Electricity systems rely on communications technologies for control, monitoring, coordination and data exchange.

This creates an important distinction between ordinary public communications infrastructure and dedicated operational communications systems.

The failure of a public telecommunications network does not necessarily disable an electricity grid. Some operational systems have independent or redundant communications mechanisms.

A legally defensible risk assessment must determine the actual dependencies rather than assume that all network failures have identical consequences.

5.3 Cybersecurity obligations

Real Decreto-ley 12/2018 and Real Decreto 43/2021 form part of Spain's earlier NIS-derived cybersecurity framework.

The EU's NIS2 Directive expands and reorganises cybersecurity requirements relating to essential and important entities.

The applicable regime must be determined by reference to the entity's activity, size where relevant, national implementing measures, sector-specific EU legislation and the relevant dates.

NIS2, CER and DORA must not be treated as three interchangeable sets of rules. They have different scopes and legislative mechanisms.

5.4 Telecommunications case law

Case 7: Ministerio Fiscal

CJEU, Case C-207/16, judgment of 2 October 2018

Facts: A Spanish criminal investigation raised questions about judicial access to telecommunications-related personal data.

Issue: The relationship between access to retained communications data and the seriousness of an interference with fundamental rights.

Decision: The Court distinguished between levels of interference with privacy and data-protection rights and examined the conditions applicable to accessing the relevant data.

Relevance: Telecommunications security and law-enforcement functions must be reconciled with fundamental rights.

Application to critical infrastructure: The protection of critical networks does not automatically justify indiscriminate access to personal communications data.

Case 8: Digital Rights Ireland and Seitlinger and Others

CJEU, Joined Cases C-293/12 and C-594/12, judgment of 8 April 2014

Facts: The validity of the EU Data Retention Directive was challenged.

Decision: The Court declared the directive invalid because its wide-ranging and particularly serious interference with privacy and data protection was not sufficiently limited by safeguards.

Principle: Even measures pursuing important public-security objectives must satisfy fundamental-rights and proportionality requirements.

Relevance to Spain: Protecting essential telecommunications networks does not eliminate legal constraints on surveillance and the handling of communications data.

Case 9: Tele2 Sverige and Watson and Others

CJEU, Joined Cases C-203/15 and C-698/15, judgment of 21 December 2016

Decision: The Court addressed the incompatibility of general and indiscriminate retention of traffic and location data with relevant EU requirements, subject to the distinctions and legal framework developed in the judgment and subsequent case law.

Relevance: National-security and public-safety arguments must be assessed within the applicable EU privacy and communications framework, including later case-law qualifications.

6. European Union framework governing cross-sector resilience

The following three EU instruments are particularly important when different critical sectors depend on one another.

DORA

Financial digital operational resilience

Regulation (EU) 2022/2554

Addresses ICT risk, operational continuity, ICT incidents, resilience testing and ICT third-party risks within the financial sector.

NIS2

Cybersecurity of essential and important entities

Directive (EU) 2022/2555

Establishes cybersecurity risk-management and incident-reporting requirements for covered entities across specified sectors.

CER

Resilience of critical entities

Directive (EU) 2022/2557

Addresses risks to essential services, critical-entity identification, resilience measures and cross-border cooperation.

6.1 DORA and NIS2 interaction

The NIS2 framework recognises the importance of sector-specific EU rules.

Where sector-specific legislation establishes cybersecurity requirements and incident-reporting obligations that meet the relevant conditions, those rules may apply instead of corresponding NIS2 provisions.

This is particularly significant for financial entities governed by DORA.

It would therefore be incorrect to assume that every Spanish bank must independently duplicate identical cybersecurity controls and incident reports under both regimes.

However, it would also be incorrect to assume that a banking group's telecommunications subsidiary, energy subsidiary, or another separate entity automatically falls within DORA's financial-sector arrangements.

The legal status of each entity and activity must be examined.

6.2 CER and interdependencies

The CER Directive explicitly addresses resilience of critical entities.

Article 5 concerns national risk assessments, including relevant dependencies between sectors and entities.

Article 12 establishes resilience obligations for critical entities, including appropriate and proportionate measures for preventing incidents, protecting relevant premises and infrastructure, responding to incidents, recovering from them and ensuring appropriate organisational security.

Article 13 concerns relevant background checks.

Article 15 addresses incident notification.

Of particular significance, CER's provisions concerning identification and resilience of critical entities do not generally apply to banking, financial market infrastructure and digital infrastructure in the same way as to sectors covered by the ordinary CER resilience regime; the Directive contains sector-specific exclusions and limitations that must be read carefully.

Therefore, the exact CER obligation for a Spanish bank, telecommunications operator or electricity company cannot be established simply by calling all three entities "critical".

6.3 NIS2 sector coverage

The NIS2 Directive identifies sectors in Annexes I and II.

Its higher-criticality sectors include energy, banking, financial market infrastructures and digital infrastructure, among others.

However, designation as an essential or important entity depends on the Directive's detailed provisions, relevant exclusions and the applicable national implementation.

For financial entities, DORA's sector-specific rules are especially important.

Current-law qualification: The EU measures and their original application or transposition deadlines are identifiable, but live verification of Spain's precise NIS2/CER transposition status and any subsequent amendments is unavailable in this conversation. Accordingly, the analysis does not assume that every Directive obligation has been implemented in Spain in a particular form as of 20 October 2026.

7. Cross-sector liability: who is legally responsible when one infrastructure fails?

The most complicated legal issue arises when a single event interrupts multiple sectors.

Consider a hypothetical case:

A major electricity failure in Spain interrupts a telecommunications provider's regional network. Several financial institutions then lose access to communications needed for payment processing, customer authentication or branch operations.

No single statute automatically assigns all responsibility to the electricity company.

Instead, there may be several parallel legal inquiries.

7.1 Electricity operator liability

Potential questions include whether:

The electricity operator breached an applicable statutory or regulatory obligation.

Required system security or continuity procedures were followed.

The event was reasonably foreseeable.

The operator failed to comply with applicable technical standards.

The operator's conduct legally caused the relevant harm.

An applicable statutory defence, contractual limitation or force-majeure argument is available.

Under Spain's general civil law, Article 1101 of the Civil Code addresses liability for damages arising from breach of obligations in the circumstances it specifies.

Article 1902 provides the basic extracontractual liability rule for damage caused by an act or omission involving fault or negligence.

Article 1105 governs circumstances involving unforeseeable or unavoidable events, subject to the applicable legal and contractual rules.

An interruption in electricity supply does not by itself prove negligence. The applicable regulatory obligations, evidence of fault where necessary, causation and available defences must be examined.

7.2 Telecommunications operator liability

A telecommunications operator may have independent obligations to protect network integrity and maintain appropriate resilience.

Consequently, a telecommunications operator could be subject to regulatory scrutiny even where the initiating event was an external power outage.

Relevant considerations may include:

Compliance with applicable network security obligations.

Contractual availability and continuity commitments.

Resilience appropriate to the service and infrastructure.

Whether alternative connectivity was required or reasonably practicable.

Incident handling and notification.

Whether any failure by the operator contributed to the resulting harm.

An operator is not automatically liable merely because an external electricity outage disrupted its network.

7.3 Banking liability and supervisory consequences

Financial entities may face independent questions under DORA and relevant banking and payment-services law.

These may include whether the bank had adequately assessed ICT dependencies, whether its continuity arrangements were proportionate, and whether its response and reporting complied with the law.

A bank's potential regulatory breach and its civil liability to customers are separate issues.

In particular, liability for unauthorised or incorrectly executed payment transactions must be assessed under the applicable payment-services framework, including Real Decreto-ley 19/2018, rather than assumed from critical-infrastructure legislation alone.

7.4 A comparison of legal responsibilities

Central legal principle: Each entity's obligations must be assessed independently, even when the failure originated elsewhere.

8. Additional case law concerning cybersecurity liability and interconnected risk

Case 10: Natsionalna agentsia za prihodite

CJEU, Case C-340/21, judgment of 14 December 2023

Facts: A cyberattack on Bulgaria's national revenue agency resulted in unauthorised disclosure of personal data. A data subject sought compensation, arguing that the agency had failed to provide adequate security.

Questions: The Court examined the requirements for demonstrating compliance with GDPR security duties, the consequences of an unauthorised cyberattack, and the conditions for non-material damages.

Decision: The Court held, among other things, that the mere occurrence of unauthorised access by a third party does not automatically establish that security measures were inappropriate. It also addressed evidential burdens and the possibility that fear of future misuse of personal data could constitute non-material damage when the relevant legal requirements are met.

Legal importance for Spanish banks and telecommunications operators:

A successful attack does not automatically prove a cybersecurity breach by the affected organisation.

Relevant security measures must be evaluated according to applicable legal standards.

The organisation's evidential position may be important.

Compensation requires the conditions prescribed by applicable law to be met.

This judgment concerns GDPR obligations, not a direct violation of DORA or Spain's Critical Infrastructure Protection Law.

Case 11: Österreichische Post AG

CJEU, Case C-300/21, judgment of 4 May 2023

Issue: Whether infringement of GDPR automatically creates a right to compensation.

Decision: The Court held that infringement alone is insufficient. Damage and a causal link are also required, although non-material damage is not subject to a minimum seriousness threshold.

Application: A cybersecurity or data-protection violation associated with an infrastructure incident does not automatically create unlimited compensation liability.

The claimant must meet the applicable legal conditions.

9. Scenario-based Spanish legal analysis

The following examples illustrate how different statutes may interact. They are hypothetical and are not presented as actual Spanish judgments.

Scenario A — Electricity disruption affects banking

Hypothetical

A transmission-network disruption causes power loss at a telecommunications facility. A Spanish bank experiences interrupted digital services.

Legal analysis: The electricity operator's obligations must be assessed under electricity and infrastructure law; the telecommunications operator's under the applicable communications regime; and the bank's under DORA and applicable financial legislation.

Possible outcome: Multiple investigations may occur, but liability depends on the evidence and the particular statutory or contractual obligations breached.

Scenario B — Telecommunications failure affects the electricity grid

Hypothetical

A communications service supporting electricity-system operations becomes unavailable.

Legal analysis: Authorities would examine the nature of the communications dependency, whether the electricity operator had appropriate operational safeguards, and whether the telecommunications provider complied with its obligations.

Possible outcome: Sector-specific compliance issues may arise for more than one operator.

Scenario C — Shared technology supplier affects multiple banks

Hypothetical

A technology service used by numerous Spanish financial institutions fails, simultaneously disrupting important banking functions.

Legal analysis: DORA's ICT concentration-risk rules, third-party risk obligations, business continuity requirements and major incident reporting provisions become especially relevant.

Possible outcome: Supervisory scrutiny may concern both the affected banks and, where legally applicable, the ICT third-party service provider.

10. National-security intervention and governmental powers

Spain's national-security framework becomes relevant when disruptions affect sufficiently important state or societal interests.

Relevant authorities may include the Ministry of the Interior and bodies involved in critical-infrastructure protection, sectoral ministries and regulators, the Bank of Spain, relevant EU financial supervisory institutions, and cybersecurity authorities.

The precise allocation of responsibility depends on the affected service, the nature of the event and the law conferring particular powers.

The distinction between three levels of intervention

A critical-infrastructure incident is not automatically a situation of interest for national security within the meaning of Ley 36/2015.

Likewise, national-security concerns do not suspend fundamental rights or displace the ordinary requirements of lawful competence and proportionality.

11. Can Spain designate an entire bank, energy group or telecommunications company as critical?

The correct legal analysis requires distinguishing the designation of an operator from the identification or designation of particular infrastructures.

An undertaking may operate both critical and non-critical infrastructure.

For example, a Spanish banking group may own or operate data centres, transaction-processing facilities, corporate offices and branches. The fact that the group supplies essential banking services does not automatically make every branch a critical infrastructure.

Similarly, an electricity company may have numerous generating facilities, control systems and administrative premises, but the legal status of each relevant infrastructure depends on the applicable identification and designation framework.

The same is true of telecommunications networks.

This is particularly important for large conglomerates operating in multiple strategic sectors.

Corporate ownership does not automatically determine critical status

Suppose a holding company owns:

A regulated Spanish bank.

An electricity distribution company.

A telecommunications network operator.

The holding company's ownership of these companies does not automatically make the holding company itself a critical operator under Ley 8/2011.

The competent authorities must apply the legal designation criteria to the relevant operators and infrastructures.

Nevertheless, common ownership, shared outsourcing arrangements and operational dependencies may be relevant to risk assessments or other regulatory requirements.

12. National security, foreign investment and strategic ownership

Critical-infrastructure interdependency also affects the legal treatment of foreign investments in strategic companies.

Spain's foreign direct investment screening framework includes Article 7 bis of Ley 19/2003, as amended, and its implementing regime, including Real Decreto 571/2023, concerning foreign investments.

Subject to the detailed conditions, thresholds, exemptions and procedural rules, investments relating to critical infrastructures and strategic sectors may be subject to prior authorisation.

Banking, energy and telecommunications investments can also raise questions under other applicable regulatory approval regimes.

A company operating critical energy, banking or communications infrastructure is not automatically prohibited from receiving foreign investment.

Rather, the legal analysis may consider the investor, the transaction, control or influence, the relevant strategic assets and the applicable public-order, public-security or public-health considerations.

The CJEU's judgment in Case C-463/00, Commission v Spain, discussed above, is particularly relevant: governmental restrictions affecting strategic undertakings must comply with applicable EU law and proportionality principles.

13. Consolidated case-law table

The decisions below provide a useful starting point for a legal memorandum or academic paper.

Important case-law limitation: These decisions establish relevant principles concerning energy security, financial stability, telecommunications, fundamental rights and cybersecurity. They do not collectively establish a single judicial doctrine making all three sectors jointly liable whenever a cross-sector outage occurs.

Nor should any of them be presented as a direct Spanish judicial determination that a particular bank, power station or telecommunications network has been designated critical under Ley 8/2011.

14. Primary legislation and judgments for further legal research

Official sources for a formal legal opinion include:

For a court submission, the consolidated law applicable on the relevant incident date and the full text of each cited judgment should be checked. The cited judgments are identifiable authorities, but their full texts and any developments after my available knowledge have not been live-verified here.

15. Final legal conclusions

Spanish critical-infrastructure law establishes a system in which banking, energy and telecommunications are legally distinct but operationally interconnected sectors.

Five propositions follow from the statutory framework and the case law discussed.

First, Ley 8/2011 and Real Decreto 704/2011 create a specific protection and planning regime for critical infrastructure and designated operators. Critical status is not automatically established by economic importance alone.

Second, electricity and telecommunications may be indispensable dependencies of banking operations. DORA requires financial entities within its scope to manage relevant ICT risks and dependencies, including those arising from external providers.

Third, cross-sector interdependency does not automatically create joint legal liability. Each operator's responsibility must be established under its applicable regulatory, contractual or civil-liability framework.

Fourth, national security and the continuity of essential services may justify significant regulatory intervention, but the CJEU's case law requires such intervention to respect applicable EU legal constraints, including proportionality and fundamental rights.

Fifth, the EU's DORA, NIS2 and CER frameworks reflect an approach to resilience that considers operational dependencies, incident preparedness and cooperation across critical sectors, although the detailed obligations differ significantly by sector and legal status.

Central legal proposition

Under Spanish and EU law, the criticality of banking, electricity and telecommunications cannot be assessed solely at the level of individual assets or companies. Their operational interdependencies must also be considered through the applicable sector-specific resilience, cybersecurity, infrastructure-protection and national-security frameworks. However, each designation, obligation, supervisory power and liability must be grounded in its own legal basis.

This is the central distinction for analysing Spain's interconnected critical infrastructure: operational interdependence does not eliminate legal separation, but it makes coordinated risk management and regulatory compliance necessary.