Modernizing Spain’s Corporate Governance Framework: CNMV’s Plan 2030

In June 2025, the Comisión Nacional del Mercado de Valores (Spanish Securities Commission, or CNMV) presented the CNMV Plan 2030¹ setting their roadmap for the upcoming years by identifying strategic priorities that aim to strengthen the Spanish capital market, protect investors and modernize the CNMV itself.

One of the first significant improvements comes in the form of an updated Spanish Good Governance Code of Listed Companies (Código de Buen Gobierno Corporativo de las Sociedades Cotizadas, or the Code), the main guidance on corporate governance for Spanish public companies. The Code was lastly fully revamped in 2020, with only minor tweaks during the past few years. The CNMV is now working on a broad review to reflect regulatory, economic and technological developments.

Evolving Expectations and Regulations: The Wider European Context

Given the speed at which new developments in governance take place, most European markets have been updating their codes either significantly, or by implementing minor tweaks almost annually. See Table 1 below.

Table 1. Summary of Recent Corporate Governance Code Updates in Select EU Markets

_{Source: Various. Summarized by Glass Lewis Research.}

The frequency of the updates illustrates how quickly expectations around corporate governance are evolving. Issues that were once peripheral to the work of boards, including sustainability, cybersecurity, data, corporate culture and stakeholder engagement, are now increasingly becoming part of the mainstream governance agenda.

Notably, explicit recommendations around AI governance have so far been limited in national corporate governance codes. As an example, Germany’s Corporate Governance Commission has published guidance² on AI oversight by supervisory boards, however, this is not intended to form part of the German Kodex; and the Dutch Corporate Governance Code references responsible AI only in its explanatory notes.³ Against this background, the CNMV’s decision to revisit its Code five years after the 2020 revision is perhaps unsurprising – and may mark the first instance of an EU member state embedding AI oversight expectations directly within its corporate governance code.

Proposed Updates to the Code

The updates are expected to be two-fold. On the one hand, the updated Code is intended to address areas lacking guidance or not covered in sufficient detail such as cybersecurity, the use and implementation of AI, and the governance implication of new technologies, as well as broader challenges arising from the ever changing economic and social landscape.

In addition, the review will also take into consideration developments at the international level, such as the Organisation for Economic Co-operation and Development (OECD) Principles of Corporate Governance, principles which have not been adopted by the CNMV yet but need their place in the code. These developments place increased emphasis on areas such as sustainability, transparency, accountability and the responsibilities of boards and shareholders, and have been highlighted by the CNMV as topics to be taken into account in their review.

Addressing Cybersecurity and Artificial Intelligence

Current Market Practice

Most large-cap Spanish boards have already taken steps to incorporate both cybersecurity and AI into their governance structure. As Figure 1 shows, 97% of Ibex-35 companies disclose oversight of cybersecurity (compared to 95% across all European large-caps), while 67% have a defined AI policy (compared to 54%), and 60% disclose AI oversight (compared to 72%).

Figure 1. Comparison of Cybersecurity and AI Oversight Among Large-Cap Companies in Spain and Europe

_{Source: Glass Lewis Research.}

Regulations on Cybersecurity

While neither the Spanish Stock Exchange, Bolsas y Mercados Españoles, nor the IBEX-35, the Spanish large-cap index, incorporate specific indicators measuring cybersecurity regulations across the index, most companies adhere to either NIS2 (Network and Information Security Directive),⁴ a European directive seeking to strengthen cybersecurity requirements for companies deemed relevant to the economy and society, or Digital Operational Resilience Act (DORA)⁵ which applies specifically to entities operating within the financial sector.

Companies falling within the scope of NIS2 are required to implement cybersecurity risk-management measures, notify significant incidents and ensure that either management or the board holds responsibility over cybersecurity oversight. DORA, on its part, focuses on enhancing financial companies’ resilience against IT failures, cyberattacks and other technology-related issues.

Regulations on AI

The Digital Omnibus on AI entered into force on July 27, 2026,⁶ deferring obligations for standalone high-risk AI systems, such as those used in recruitment, employee management and creditworthiness assessment to December 2027, and for AI used regulated products such as machinery and medical devices to August 2028. Transparency requirements covering situations where individuals interact with AI systems have been applicable since August 2026.

Finally, Spain established the EU’s first dedicated national AI supervisory authority, the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA) in 2023, ahead of the AI Act entering into force. In December 2025, AESIA published 16 guidance documents on AI usage.⁷

Factoring in OECD Principles

While the OECD principles have not been formally adopted by the CNMV, they would have been addressed through EU legislation, and as such, their incorporation in the Spanish Corporate Governance Code should not require significant amendments. For example, the European Corporate Sustainability Reporting Directive (CSRD), while not fully transposed into Spanish legislation yet, is already being used by a significant number of Spanish public companies as part of the framework governing mandatory sustainability disclosure.

Further regulations on this regard are established by Royal Decree 214/2025 of March 18,⁸ which sets the obligation for public companies with more than 500 employees to calculate their carbon footprint and to prepare and publish plans for reducing greenhouse gas emissions.

Rather than merely updating individual recommendations, it seems that the CNMV’s objective is to ensure that the Code remains an effective and practical reference for listed companies while reflecting the issues that board are increasingly expected to address.

A Consultation-Led Approach

The CNMV has initiated works with different multidisciplinary working groups, supported where necessary by additional specialists with experience across different areas of the market and chaired by CNMV chair Carlos San Basilio, and vicechair Paloma Marín, with the purpose to determine the updated contents of the code. An initial draft was expected to be published around September 2026.⁹

This will be followed by a public consultation process in the first half of 2027 and the consideration of the responses, with publication of the updated code expected by the second half of that year. As such, listed companies, investors and other market participants will have an opportunity to contribute to the discussion.

Plans Beyond Corporate Governance

The review and update of the Corporate Governance Code is not the only element worked on within the CNMV’s Plan 2030. Other matters could be grouped in two main categories:¹⁰

External-impact initiatives:

• Protecting investors against new commercialisation and investment products;
• Developing measures encouraging individual investment;
• Promoting interest in the Spanish capital market;
• Simplifying the regulatory and supervisory framework of the capital markets; and
• Adapting governance measures to the new economic and social context.

Internal-impact initiatives:‍

• Attracting and retaining talent;
• Digitalising, transforming and modernising the CNMV;
• Increasing the CNMV’s openness, transparency and accountability; and
• Strengthening the CNMV’s international presence and influence.

All of these priorities collectively point towards a broader transformation of both the Spanish market and the CNMV as the regulator responsible for its overseeing. The CNMV focuses mainly on the protection of investors and the strengthening of the Spanish capital market while simultaneously reducing regulatory burdens. At the same time, there’s an additional focus on enhancing market knowledge and financial literacy in the hopes of reducing financial fraud and addressing risks associated with misleading sustainable products.

In terms of corporate governance, there is a clear emphasis on adapting to the evolving environment through the simplification of the supervisory and regulatory framework – in Spain by reviewing and updating its Corporate Governance Code, but also more broadly in Europe, by contributing to the efforts to simplify and streamline the regulatory framework and thus enhancing efficiency and effectiveness.

What This Means for Spanish Listed Companies

The CNMV’s 2030 Plan may represent more than a simple regulatory update. Instead, it may mark the start of a larger shift in how corporate governance is understood and implemented in the Spanish market, and could make Spain one of the first EU member states to embed AI oversight expectations directly within the corporate governance code.

The consultation process will provide companies, investors and other stakeholders with an opportunity to influence how emerging governance expectations are translated into practical recommendations. Meanwhile, the direction of travel is already becoming real: corporate governance in Spain is expected to adapt to a market which is increasingly digital, internationally connected and focused on transparency, sustainability and accountability.

On October 13, 2026, Glass Lewis’ Europe and UK Research team will hold a webinar reflecting on the key governance, voting and market developments that shaped the 2026 proxy season, and highlight insights from our Proxy Season Review reports. Sign up to participate.

‍