Key data
| Regulation | Order INT/1068/2026, of October 7 — Basic Directive for Civil Protection Planning of Self-Protection |
|---|---|
| Publication | October 10, 2026 |
| Entry into force | October 11, 2026 |
| Regulation it replaces | Royal Decree 393/2007 (which remained in force transitionally after its repeal by RD 524/2023) |
| Affected parties | Holders of public and private centers, establishments and facilities with activities that may generate emergencies |
| Category | Regulatory Changes — Civil Protection |
| Year | 2026 |
If your company has activities with emergency risk, your Self-Protection Plan can no longer be based on the Royal Decree 393/2007. The Order INT/1068/2026, published on October 10, 2026 and in force from the following day, approves the new Basic Directive for Civil Protection Planning of Self-Protection, which definitively closes the transitional period opened by RD 524/2023 when it repealed RD 393/2007 without fully replacing it.
The practical result: thousands of centers and establishments in Spain must review and adapt their self-protection plans to a new framework with more homogeneous criteria, an updated registration system and the obligation to report incidents to the Statistical Information System.
What does this regulation establish?
The new Basic Directive comprehensively regulates the life cycle of Self-Protection Plans. These are the key elements it establishes:
| Regulated aspect | Before (RD 393/2007) | Now (Order INT/1068/2026) |
|---|---|---|
| Regulatory framework of reference | RD 393/2007 (in force transitionally) | New Basic Directive approved on 6/10/2026 |
| Minimum content of the Plan | Fixed by RD 393/2007 | New updated mandatory minimum content |
| Preparation criteria | Criteria from RD 393/2007 | Homogeneous criteria for preparation, implementation, maintenance and review |
| Registration system | Prior registration | Coordinated system between the State and autonomous communities |
| Incident notification | Not specifically regulated | Obligation to notify the Statistical Information System |
| Scope of application | Activities in the RD 393/2007 catalog | Activities in the new catalog annex to the Directive |
The regulation is articulated through the Agreement of the Council of Ministers of October 6, 2026, published through Order INT/1068/2026. Its objective is to ensure that all centers with emergency risk have truly operational plans, not merely formal ones.
Economic and operational impact
The regulation does not set sanction amounts or fees in the published data, but the operational impact for affected companies is significant on several fronts:
- Review and update of the Self-Protection Plan: existing plans based on RD 393/2007 must be adapted to the new mandatory minimum content. This involves hiring or reassigning specialized technical resources.
- Updated registration: holders will need to register or update their plans in the new registration system coordinated between the State and autonomous communities, which may require additional administrative procedures.
- Implementation and maintenance: the regulation requires not only preparing the plan, but implementing it, maintaining it and reviewing it with homogeneous criteria. This may involve training internal teams, drills and periodic audits.
- Incident notification: a new obligation is established to notify the Statistical Information System, which requires defining internal reporting procedures.
The actual cost will depend on the size of the center, the complexity of the activity and the degree of updating of the previous plan. Companies with recent and well-documented plans will have a more agile adaptation; those that never reviewed their plan since 2007 face a comprehensive review.
Who does it affect?
The regulation applies to holders of centers, establishments and facilities —both public and private— whose activities are listed in the annex catalog of the new Basic Directive. Among the sectors typically included in this type of self-protection regulations are:
- Industries with risk processes (chemical, petrochemical, storage of hazardous substances)
- Large commercial areas and shopping centers
- Hospitals, clinics and health centers
- Educational centers with large capacity
- Hotels and tourist accommodation establishments with large capacity
- Sports facilities and entertainment venues
- Transport infrastructure (stations, airports)
- Administrative buildings with high public traffic
The definitive and binding list is the catalog annex to the Basic Directive approved on October 6, 2026. If your activity has doubts about whether it is included, verification must be done against that official catalog.
Practical example
Imagine a 300-room hotel that prepared its Self-Protection Plan in 2010, adapting it to RD 393/2007. From October 11, 2026, that plan no longer complies with the current regulatory framework.
The hotel holder will need to:
- Verify that its activity is listed in the new annex catalog of the Basic Directive.
- Commission a competent technician to review the plan in accordance with the new mandatory minimum content.
- Update the plan registration in the coordinated State-autonomous communities system.
- Define an internal procedure to report incidents to the Statistical Information System.
- Schedule drills and periodic reviews in accordance with the new maintenance criteria.
If the hotel already had an updated plan in recent years with similar criteria, the adaptation can be relatively agile. If the plan has not been reviewed since 2007-2010, the update is comprehensive and requires investment in time and technical resources.
What should companies do now?
- Verify if the activity is in the annex catalog: consult the annex of the Basic Directive approved on October 6, 2026 to confirm if your center is obligated. Do not assume that the previous situation remains valid.
- Audit the existing Self-Protection Plan: check if the current plan meets the new mandatory minimum content. Plans based exclusively on RD 393/2007 must be updated.
- Hire or designate a competent technician: the preparation and review of the plan must be carried out by personnel with appropriate qualifications to ensure its validity.
- Update the registration in the coordinated system: register or update the plan in the new registration system coordinated between the State and the corresponding autonomous community.
- Establish the incident notification procedure: define internally how and when incidents will be reported to the Statistical Information System, as required by the new regulation.
- Schedule implementation, maintenance and reviews: the regulation requires that the plan is not just a document: it must be implemented, maintained and reviewed periodically with homogeneous criteria.
Frequently asked questions
What regulation does Order INT/1068/2026 replace?
It definitively replaces the Royal Decree 393/2007, which had been repealed by RD 524/2023 but remained in force transitionally. With the new Basic Directive approved on October 6, 2026, that transitional period is closed and RD 393/2007 ceases to apply.
When does the new self-protection regulation come into force?
Order INT/1068/2026 came into force on October 11, 2026, one day after its publication in the BOE on October 10, 2026.
What companies are required to have a Self-Protection Plan?
Holders of centers, establishments and facilities —public and private— whose activities are listed in the annex catalog of the new Basic Directive. The definitive list is in that official catalog; the obligation cannot be determined without consulting it.
What should the Self-Protection Plan include according to the new regulation?
The Basic Directive sets an updated mandatory minimum content for plans, as well as homogeneous criteria for their preparation, implementation, maintenance and review. It also requires registering the plan in the coordinated State-autonomous communities system and reporting incidents to the Statistical Information System.
What happens if my company does not adapt its Self-Protection Plan to the new regulation?
Operating with a plan not adapted to the new Basic Directive constitutes regulatory non-compliance in civil protection matters. Although the regulation does not detail sanction amounts in the published text, non-compliance can result in administrative liabilities and, in case of emergency, in civil or criminal liabilities for the holder. Adaptation should be initiated immediately.
Official source
Consult complete regulation in official source
Notice: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-21144
