Critical Infrastructure Designation Compliance Gap

1. Introduction

A Critical Infrastructure Designation Compliance Gap arises when an institution, facility, network, system, or service that is legally designated—or potentially subject to designation—as critical infrastructure fails to satisfy the legal, regulatory, operational, cybersecurity, or governance requirements associated with that status.

Such gaps are particularly significant in the banking, financial services, payments, telecommunications, energy, transport, healthcare, and digital infrastructure sectors, where disruptions may affect national security, economic stability, public safety, or essential services.

In the banking sector, a compliance gap may arise when a bank is subject to enhanced cybersecurity, continuity, incident-reporting, or operational-resilience requirements but fails to implement the relevant controls.

However, an important legal distinction must be maintained:

A bank's importance to the financial system does not automatically mean that every banking system or facility is formally designated as critical infrastructure.

Formal designation depends on the applicable statutory framework, competent authority, criteria, and designation procedure.

This distinction is particularly important under Spanish and European Union law.

2. Meaning and legal characteristics

A critical infrastructure designation compliance gap may involve five separate legal problems.

2.1 Designation gap versus compliance gap

These concepts should not be confused.

A designation gap concerns the legal classification of an entity or infrastructure.

A compliance gap concerns whether obligations that actually apply to an entity are satisfied.

For example, a Spanish bank might not have a particular data centre formally designated as critical infrastructure under Spanish critical infrastructure legislation. Nevertheless, the bank can still be subject to the EU Digital Operational Resilience Act (DORA) and other applicable banking and cybersecurity rules.

Conversely, a facility formally designated as critical infrastructure may satisfy its designation-related administrative obligations while failing to implement adequate cyber-resilience or business-continuity controls.

Thus, designation status and regulatory compliance must be assessed independently.

3. Spanish statutory framework

Spain has a multilayered system involving national critical infrastructure law, cybersecurity legislation, financial regulation, and directly applicable EU regulations.

3.1 Law 8/2011 on the Protection of Critical Infrastructures

Ley 8/2011, de 28 de abril, por la que se establecen medidas para la protección de las infraestructuras críticas is the foundational Spanish law governing critical infrastructure protection.

Its objectives include identifying and protecting critical infrastructure and establishing cooperation between competent public authorities and critical infrastructure operators.

The legislation distinguishes between strategic infrastructures and those whose criticality justifies additional protection.

The designation and protection framework involves the Ministry of the Interior and the National Centre for Critical Infrastructure Protection (CNPIC).

Where applicable, operator obligations may include:

Designating appropriate security representatives and liaison arrangements.

Preparing an Operator Security Plan (Plan de Seguridad del Operador).

Preparing Specific Protection Plans (Planes de Protección Específicos) for designated critical infrastructure.

Coordinating with competent authorities.

Maintaining and updating approved protective measures.

These obligations must be read alongside the implementing legislation and the particular operator's formal status.

3.2 Royal Decree 704/2011

Real Decreto 704/2011, de 20 de mayo, implements Law 8/2011.

It establishes important administrative and operational arrangements, including procedures concerning critical infrastructure identification and designation, the responsibilities of critical operators, and the preparation and assessment of relevant security plans.

For banks, an important question is whether an identified financial service, facility, or supporting infrastructure falls within the applicable critical-infrastructure framework.

A potential compliance gap exists when an operator fails to satisfy obligations arising from its formal designation, such as preparing required security plans or maintaining effective liaison arrangements.

Nevertheless, the mere omission of an asset from a critical-infrastructure list does not automatically establish an infringement by its owner. The allocation of identification, proposal, designation, and cooperation duties must first be established.

3.3 Spanish cybersecurity legislation

Spain also regulates the security of network and information systems through, among other instruments:

Royal Decree-Law 12/2018 on the security of network and information systems.

Royal Decree 43/2021, implementing that legislative framework.

These instruments emerged from the EU's original Network and Information Security Directive (NIS1).

They must be read with the subsequent NIS2 framework and Spain's applicable national implementation rules, including any amendments or replacements.

Because current implementation status can affect the precise obligations and enforcement powers in October 2026, the latest consolidated national legislation would need to be checked before reaching a definitive current-compliance conclusion.

3.4 Digital Operational Resilience Act

Regulation (EU) 2022/2554 — DORA has applied since 17 January 2025.

It establishes harmonised digital operational resilience requirements for covered financial entities, including credit institutions.

Important compliance areas include:

ICT risk management.

ICT-related incident management, classification, and reporting.

Digital operational resilience testing.

ICT third-party risk management.

Information-sharing arrangements, where applicable.

DORA also addresses the oversight of critical ICT third-party service providers designated under its own regulatory framework.

A critical ICT third-party service provider under DORA is not necessarily a critical infrastructure operator under Spain's Law 8/2011. The concepts have different legal purposes, definitions, and procedures.

3.5 Critical Entities Resilience Directive

Directive (EU) 2022/2557, commonly called the Critical Entities Resilience Directive (CER), establishes a European framework for resilience of critical entities.

It covers several sectors, including banking and financial market infrastructures, but the regime provides sector-specific treatment and exceptions, especially in relation to financial entities covered by established EU financial-sector resilience legislation.

A precise analysis must therefore distinguish among national critical-infrastructure designation, CER critical-entity identification, DORA financial-entity coverage, and DORA critical ICT third-party designation.

They are not interchangeable categories.

4. Principal categories of compliance gaps

4.1 Incorrect infrastructure identification

A compliance concern arises where the relevant authorities or operators fail to adequately identify infrastructure whose disruption could have significant consequences.

Consider a bank operating payment-processing systems serving millions of customers.

If those systems become unavailable, the resulting disruption may affect payment execution, business transactions, and public confidence.

The correct legal assessment would examine:

The system's role in providing essential services.

The availability of alternative infrastructure.

The geographical and economic consequences of disruption.

Interdependencies with other essential operators.

The legally prescribed criticality criteria.

Criticality cannot be presumed solely from the size of the institution.

4.2 Failure to implement protective measures

Once legally applicable requirements are identified, a compliance gap can arise through inadequate security or operational safeguards.

Examples include insufficient access controls, inadequate physical protection, ineffective incident-response arrangements, obsolete infrastructure, or inadequate continuity planning.

Where specific legal obligations apply, these omissions may result in supervisory or administrative consequences.

4.3 Inadequate cybersecurity risk management

Cybersecurity gaps commonly involve insufficient ICT asset inventories, weak vulnerability management, inadequate resilience testing, deficient incident classification, or ineffective risk assessments.

Under DORA, financial entities are expected to maintain an appropriate ICT risk management framework proportionate to the applicable requirements.

A bank cannot ordinarily avoid responsibility for its own regulatory obligations merely because a service has been outsourced.

4.4 Outsourcing and concentration-risk gaps

Banks increasingly depend on cloud infrastructure, payment processors, software vendors, telecommunications providers, and other ICT suppliers.

A single shared service provider may support multiple financial institutions.

This can create concentration risk, where disruption affecting one provider can simultaneously impair numerous banks.

For example, if several banks rely upon the same cloud environment for important functions, a major outage may create sector-wide consequences.

The relevant assessment should consider contractual safeguards, exit strategies, subcontracting arrangements, operational testing, and continuity arrangements.

4.5 Deficient incident reporting

Incident reporting is an important part of operational resilience.

A compliance gap can arise where an institution fails to classify an incident correctly, reports it through the wrong regulatory channel, or misses an applicable notification deadline.

Not every cyber incident is reportable under every regime. Reporting obligations depend on the type of entity, the applicable law, and the incident's classification.

4.6 Deficient board and management accountability

A critical infrastructure compliance programme also requires appropriate governance.

For financial entities subject to DORA, the management body has specific responsibilities concerning the ICT risk management framework.

A compliance gap can arise if senior management has inadequate visibility into operational risks, fails to approve necessary governance arrangements, or lacks effective monitoring and escalation procedures.

5. Judicial precedents and case law

A distinction is necessary when examining judicial precedent. Reported cases dealing specifically with the administrative designation of Spanish banking infrastructure as critical infrastructure are relatively limited and may involve sensitive or non-public designation information.

Consequently, the following decisions establish legal principles relevant to cybersecurity duties, infrastructure governance, proportionality, fundamental rights, liability, and regulatory accountability. They should not be represented as judgments directly determining whether a particular Spanish bank was properly designated as a critical infrastructure operator.

Case 1: Natsionalna agentsia za prihodite (C-340/21), Court of Justice of the European Union, 14 December 2023

Facts: A cyberattack affected Bulgaria's National Revenue Agency, resulting in the unauthorised disclosure of personal information relating to numerous individuals.

The litigation raised questions about the responsibility of a public organisation for security measures under the General Data Protection Regulation (GDPR).

Principal legal issues:

Whether a data breach automatically establishes that security measures were inadequate.

Who must establish the appropriateness of implemented protective measures.

Whether the unlawful conduct of third parties automatically excludes the controller's liability.

Whether fear of future misuse of personal information can constitute compensable non-material damage.

Judgment:

The CJEU held that unauthorised disclosure or access does not, by itself, establish that security measures were inappropriate.

However, the controller must be able to demonstrate that the technical and organisational measures implemented were appropriate under GDPR requirements.

The Court also clarified that a cyberattack by a third party does not automatically exempt the controller from liability.

Reasonable fear of potential misuse of personal data can constitute non-material damage where properly established.

Relevance to critical infrastructure compliance gaps:

This case illustrates the difference between a cybersecurity incident and a legally established compliance failure.

A serious cyberattack against banking infrastructure is evidence requiring investigation, but the fact that an attack succeeded does not automatically prove that every applicable resilience obligation was breached.

Regulators must examine the actual controls, legal standards, and evidence.

Legal principle: A security breach is not conclusive proof of non-compliance, but an entity subject to cybersecurity obligations must be capable of demonstrating that it adopted appropriate measures.

Case 2: Österreichische Post AG (C-300/21), CJEU, 4 May 2023

Facts: Österreichische Post processed information relating to individuals' presumed political affinities. The claimant sought compensation for alleged non-material damage resulting from unlawful personal-data processing.

Legal issue: Whether a GDPR infringement automatically creates entitlement to compensation without proof of damage.

Judgment:

The CJEU clarified that Article 82 GDPR requires three cumulative elements:

An infringement of the GDPR.

Material or non-material damage.

A causal connection between the infringement and the damage.

The Court rejected the proposition that any GDPR violation automatically gives rise to compensation.

It also held that non-material damage need not reach a particular threshold of seriousness.

Application to banking infrastructure:

Suppose a bank fails to implement legally required information-security controls and customers subsequently claim compensation.

Under the GDPR compensation framework, proving a regulatory infringement is not necessarily sufficient. A claimant must also establish damage and causation.

The case is important for distinguishing administrative compliance liability from private claims for compensation.

Legal principle: Regulatory non-compliance and compensable civil damage are related but distinct legal issues.

Case 3: Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (C-311/18), CJEU, 16 July 2020 — Schrems II

Facts: The dispute concerned transfers of personal data from the EU to the United States and the adequacy of protections available under the relevant international transfer arrangements.

Legal issue: Whether EU data transferred internationally remained subject to protections essentially equivalent to those guaranteed by EU law.

Judgment:

The CJEU invalidated the EU–US Privacy Shield adequacy decision.

It upheld the validity of the European Commission's Standard Contractual Clauses decision, while emphasising the need to assess whether the relevant data-transfer environment provides adequate protection in practice.

Where necessary safeguards cannot be ensured, transfers may need to be suspended or prohibited.

Application to critical banking infrastructure:

A Spanish bank may depend on non-EU ICT service providers for hosting, processing, analytics, or cloud services.

This creates potential overlaps between operational resilience requirements and GDPR international data-transfer rules.

For example, a bank's use of a third-country service provider may require evaluation of both:

Operational resilience and third-party risk under DORA.

The legality of international personal-data transfers under GDPR Chapter V.

Compliance with one framework does not automatically establish compliance with the other.

Legal principle: Outsourcing and international processing arrangements do not eliminate an institution's obligations under applicable EU data-protection law.

Case 4: Maximillian Schrems v Data Protection Commissioner (C-362/14), CJEU, 6 October 2015 — Schrems I

Facts: The claimant challenged the transfer of his personal information to the United States under the then-existing Safe Harbour system.

Judgment:

The CJEU invalidated the European Commission's Safe Harbour adequacy decision.

The Court emphasised the importance of effective protection of fundamental rights and the role of independent data protection authorities.

Importance for infrastructure compliance:

Although this was not a critical-infrastructure designation case, it demonstrates that administrative or regulatory approval does not necessarily immunise an arrangement from legal scrutiny.

In the banking context, official approval of a service arrangement or participation in a particular regulatory framework does not necessarily settle every independent legal obligation.

For instance, a bank may have an approved operational arrangement that is still subject to scrutiny under privacy, cybersecurity, or outsourcing rules.

Legal principle: Regulatory authorisation must remain compatible with applicable higher-ranking legal protections and is subject to judicial review.

Case 5: Digital Rights Ireland Ltd and Seitlinger and Others (Joined Cases C-293/12 and C-594/12), CJEU, 8 April 2014

Facts: The proceedings challenged the validity of the EU Data Retention Directive, which imposed extensive communications-data retention obligations.

Legal issue: Whether generalised data retention requirements complied with the rights to privacy and protection of personal data under the EU Charter of Fundamental Rights.

Judgment:

The CJEU declared the Data Retention Directive invalid.

The Court concluded that the interference with fundamental rights was particularly serious and that the directive lacked sufficient safeguards to satisfy proportionality requirements.

Application to critical infrastructure designation:

Designation of infrastructure as critical can justify enhanced security requirements, monitoring, and risk-management obligations.

However, designation does not provide unlimited authority to collect personal information, monitor individuals, or impose disproportionate restrictions.

Where security obligations interfere with fundamental rights, the legal measures must comply with necessity and proportionality requirements.

Legal principle: National security and infrastructure protection objectives do not dispense with the requirement for legally justified and proportionate interference with fundamental rights.

Case 6: Ligue des droits humains ASBL v Conseil des ministres (C-817/19), CJEU, 21 June 2022

Facts: The litigation concerned EU rules governing the collection and processing of passenger name record information for combating terrorism and serious crime.

Judgment:

The CJEU upheld the relevant directive subject to important limitations and interpretations ensuring compliance with the EU Charter.

The Court examined requirements concerning proportionality, automated analysis, purpose limitation, retention, and safeguards.

Application to critical infrastructure protection:

Critical infrastructure security systems may employ advanced monitoring and automated risk identification.

This decision illustrates that significant public-security objectives must be accompanied by appropriate limitations and procedural safeguards.

In the banking sector, automated detection systems, security surveillance, and personal-data processing may require careful consideration of privacy and data-protection obligations.

The case does not establish a specific banking cybersecurity standard, but it provides broader constitutional guidance.

Legal principle: Security-related data processing must remain constrained by clear legal rules, safeguards, and proportionality.

Case 7: Tribunal Constitucional de España, STC 292/2000, 30 November 2000

Facts and legal context: The Spanish Constitutional Court examined provisions of Spanish personal-data protection legislation and their compatibility with the constitutional right to the protection of personal data.

Judgment:

The Court affirmed that the protection of personal data is a fundamental right with its own constitutional content under Article 18.4 of the Spanish Constitution.

It stressed the importance of individuals' control over the use and processing of their personal information.

Application to Spanish banking infrastructure:

Critical infrastructure designation may require heightened security oversight, cooperation with public authorities, and information sharing.

However, such measures must still respect constitutional rights where personal information is involved.

For example, an infrastructure operator cannot assume that designation alone authorises unlimited disclosure of customer information.

The particular statutory basis, applicable safeguards, and relevant exceptions must be examined.

Legal principle: Security-related regulatory objectives must be reconciled with Spain's constitutional guarantees concerning personal data.

Case 8: Tribunal Constitucional de España, STC 76/2019, 22 May 2019

Facts: The Constitutional Court examined a legislative provision concerning the processing of personal information relating to political opinions in electoral activities.

Judgment:

The Court declared the challenged provision unconstitutional and void because the relevant legislative safeguards were insufficient to justify the interference with fundamental data-protection rights.

Application to infrastructure security obligations:

This decision is relevant where critical infrastructure regulations or administrative measures authorise collection, processing, or transfer of sensitive information.

The legislature and regulatory authorities must establish a sufficiently precise legal basis and adequate safeguards for restrictions affecting fundamental rights.

Legal principle: Broad statutory references to legitimate public-interest objectives are insufficient where legislation fails to establish safeguards required to protect fundamental rights.

Case 9: WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12, UK Supreme Court, 1 April 2020

Facts: A supermarket employee deliberately disclosed payroll information relating to employees. The affected individuals sought to hold the employer vicariously liable.

Judgment:

The UK Supreme Court concluded that the employer was not vicariously liable on the facts because the employee's wrongful acts were not sufficiently closely connected with the acts he was authorised to perform.

Application to banking infrastructure:

The judgment illustrates that liability for insider misconduct depends on the applicable legal basis and factual circumstances.

It does not mean that a bank is automatically exempt from cybersecurity or data-protection obligations whenever an insider causes a breach.

A bank may still face separate obligations relating to access management, internal controls, employee monitoring within lawful limits, incident response, and data protection.

Legal principle: The existence of employee misconduct does not, without further analysis, determine whether organisational regulatory duties were fulfilled or whether the institution incurs civil liability.

This is a UK comparative-law precedent, not binding Spanish or EU authority.

6. Comparative analysis of judicial principles

These judgments provide supporting legal principles rather than direct rulings on Spanish critical-infrastructure designation gaps. A challenge to an actual designation decision would also require examination of applicable Spanish administrative procedure and judicial-review law.

7. Identifying a compliance gap in a Spanish bank

A regulatory assessment should be conducted in stages.

Stage 1 — Identify the essential service

Determine which banking, payment, or supporting infrastructure is being assessed.

Stage 2 — Establish legal status

Verify formal designation and independently identify applicable EU and Spanish regulatory regimes.

Stage 3 — Map legal obligations

Identify security plans, ICT governance, testing, reporting, outsourcing, and continuity requirements.

Stage 4 — Assess implemented controls

Review policies, approvals, technical controls, contracts, testing reports, and incident records.

Stage 5 — Classify deficiencies

Separate proven legal breaches from potential risks, missing evidence, and suggested improvements.

Stage 6 — Remediation and verification

Assign responsibility, address deficiencies, preserve evidence, and retest the corrective measures.

8. Hypothetical banking-sector case study

Banco Central de Servicios Digitales SA — Spanish payment-processing disruption

This is an illustrative hypothetical, not a reported judgment.

Facts: A Spanish credit institution operates a large digital payment-processing platform. Its payment services rely on a third-party cloud provider.

An operational disruption prevents customers from completing transactions for several hours.

A subsequent internal investigation identifies inadequate continuity testing, incomplete third-party dependency documentation, and unclear responsibilities for incident escalation.

The bank has not established whether the particular facility has been formally designated as critical infrastructure under Law 8/2011.

Legal issues

Issue 1: Does the outage establish that the facility should have been designated critical infrastructure?

Not automatically. The legally prescribed designation criteria and the competent authority's role must be examined.

The bank's systemic importance and the facility's operational significance may be relevant evidence, but neither alone establishes formal designation.

Issue 2: Can DORA apply without national critical-infrastructure designation?

Yes. Assuming the institution falls within DORA's scope, relevant DORA requirements apply independently of a facility's designation under Spanish critical infrastructure legislation.

Issue 3: Does the bank's use of a cloud provider eliminate its responsibility?

No. Outsourcing does not ordinarily remove the bank's own regulatory responsibility for ICT third-party risk management.

Issue 4: Does an outage automatically establish non-compliance?

No. Investigators must determine the applicable legal obligations and whether the bank's preventive, detective, response, and recovery arrangements met those obligations.

An incident can occur despite appropriate controls. Equally, deficiencies can constitute regulatory violations even before an incident occurs.

Issue 5: Can affected customers recover compensation?

Potentially, depending on the facts and the relevant legal cause of action. Claims may arise under applicable contractual, payment-services, consumer-protection, or data-protection law.

Where GDPR Article 82 is invoked, the requirements explained in Österreichische Post become relevant.

Reasoned legal conclusion

The strongest initial regulatory concern would concern the documented deficiencies in ICT risk management, continuity testing, and outsourcing governance—not the mere absence of verified national critical-infrastructure designation.

A separate designation assessment would still be appropriate.

9. Regulatory enforcement and potential consequences

The consequences of a compliance gap depend upon which legal obligation was violated.

Not every deficiency triggers a penalty. Enforcement generally requires identification of an applicable legal duty, sufficient supporting evidence, and compliance with relevant procedural guarantees.

In Spain, different issues may engage different authorities, including the Ministry of the Interior and relevant critical infrastructure bodies, the Bank of Spain, the European Central Bank within its supervisory competence, and the Spanish Data Protection Agency.

The precise allocation depends on the institution, activity, and legal instrument concerned.

10. Compliance-gap remediation framework

A banking institution can use a legal and operational gap register to organise its corrective programme.

The priority classifications shown here are illustrative; an actual organisation should determine severity based on legal exposure, risk, business impact, and relevant supervisory requirements.

11. Important legal distinctions

Four principles are particularly important in any assessment.

First, designation is a legal status, not merely a technical risk rating. An internally classified “critical” banking system does not necessarily satisfy the statutory definition or formal designation procedure.

Second, DORA compliance is not equivalent to national critical-infrastructure compliance. The two frameworks can overlap, but their legal obligations and institutional mechanisms are different.

Third, an incident does not automatically establish a legal infringement. Compliance must be determined through the relevant legal requirements and the evidence concerning actual measures implemented.

Fourth, the absence of formal critical-infrastructure designation does not release a financial institution from independently applicable obligations. A bank may still be subject to extensive ICT security and operational-resilience requirements.

12. Conclusion

A Critical Infrastructure Designation Compliance Gap is best understood as a mismatch between infrastructure criticality, formal regulatory status, legally applicable obligations, and actual institutional preparedness.

In Spain's banking sector, the central legal framework includes Law 8/2011, Royal Decree 704/2011, applicable national cybersecurity law, DORA, GDPR, and relevant EU resilience legislation.

The case law establishes valuable principles concerning institutional cybersecurity responsibility, proportionality, data protection, outsourcing, causation, and remedies.

However, the judgments discussed do not, by themselves, establish that a particular Spanish bank is a designated critical infrastructure operator or that an omission from a designation register is unlawful.

The decisive legal test is whether a specific, enforceable obligation applies to the institution, whether the required standard has been met, and whether an identified deficiency can be established through legally sufficient evidence.

For a formal legal opinion or litigation memorandum, the next step would be to examine the precise designation decision, relevant regulatory notices, the current consolidated legislation, and any Spanish administrative-court judgments directly involving that designation or operator classification.