CEDESA DIGITAL

CEDESA Blog

Technical content on public sector software, public tenders, the National Security Framework (Esquema Nacional de Seguridad, ENS), compliance and process digitalisation.

Traceability

Mandatory CCTV in abattoirs (RD 695/2022): how to integrate the recordings with traceability and the meat ERP

Royal Decree 695/2022 requires Spanish abattoirs to have cameras covering unloading, the lairage where live animals are held, the passageways and races, and the stunning and bleeding areas until death (and scalding for poultry and pigs), with footage accessible to the competent authority for 30 days; mandatory since 24 August 2023 and, for small abattoirs, since 24 August 2024. What exactly it requires, how to comply with data protection for the workers who are recorded, and how to link each recording to the slaughter batch, the incident log and the traceability in the ERP.

Compliance

Verifactu in 2027: what business management software or a custom ERP must comply with (RD 1007/2023 and the self-declaration)

Royal Decree-Law 15/2025 fixes 1 January 2027 as the date from which corporate income tax payers must use invoicing systems that comply with Spain's Verifactu Regulation, and 1 July 2027 for everyone else. What RD 1007/2023 requires of any program that issues invoices, including a custom ERP: invoicing records, chained hash, QR code, event log, Verifactu or non-Verifactu mode, the producer's self-declaration and the penalties under Article 201 bis of the LGT (Spain's General Tax Law).

Livestock

Digital livestock traceability: from ear tag to REGA without paper

How livestock traceability works in Spain (the SITRAN system, with its REGA, RIIA and REMO registers), what the individual and electronic identification of animals requires, which documents and notifications a holding or an association generates, and how a digital system captures everything from the ear tag to the register with no paper and no rekeying.

Transport

Smart tachograph version 2 in vans (from 1 July 2026): what data it generates and how to integrate it into fleet management

Since 1 July 2026, vehicles of between 2.5 and 3.5 tonnes engaged in international goods transport or cabotage have had to carry a smart tachograph version 2 (G2V2), the last of the dates in Mobility Package I (Regulation (EU) 2020/1054). What the G2V2 records that its predecessor did not (position at the start, every three hours of driving and at the end, automatic border crossings, loading and unloading, Galileo authentication, DSRC remote checks, the ITS interface), what download and retention obligations the company has and how to integrate that data with fleet management and with time tracking for drivers.

Artificial Intelligence

IoT sensing in water networks: what it measures, what it predicts and how it is funded

Which sensors are installed in a water supply network (flow, pressure, level, quality, remote meter reading), what is calculated from them (water balance, non-revenue water, minimum night flow, sectorisation), what the models predict (leaks, demand, bursts), what Directive 2020/2184 and Spain's Royal Decree 3/2023 require on leakage and how it is funded through the PERTE for digitalising the water cycle.

Public sector

The Interoperable Europe Act (2024/903): the interoperability assessment a public authority must carry out before procuring software

Regulation (EU) 2024/903 has applied since 12 July 2024 and, since 12 January 2025, has obliged public sector bodies to carry out and publish an interoperability assessment before adopting new or substantially modified binding requirements for trans-European digital public services. What a trans-European digital public service is, what the assessment must contain, where it is published, how it fits with Spain's National Interoperability Framework (ENI) and what it means for the tender specifications for custom software development.

Transport

Sustainable commuting plan before 5 December 2026 (Law 9/2025): what it requires and what shift and fleet data you need

Spain's Law 9/2025 on Sustainable Mobility obliges companies and public entities with workplaces of more than 200 workers, or more than 100 per shift, to have a sustainable commuting plan negotiated with the workers' legal representatives; Royal Decree-Law 7/2026 brought the deadline forward to 5 December 2026. What the plan must contain, what shift, time tracking and fleet data the assessment needs and how to get it out of the software you already have.

Traceability

Digital Product Passport (ESPR): central registry from July 2026 and how to prepare with NFC traceability

Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation, creates the Digital Product Passport: a unique identifier, a data carrier (QR code, NFC or RFID), decentralised data and a central Commission registry operational from 19 July 2026. The first mandatory passport is the battery passport (18 February 2027); iron and steel, aluminium, textiles, tyres, furniture and mattresses follow with the delegated acts of 2026 to 2029. What data it will require, who supplies it along the chain and why NFC traceability at batch or item level is the basis for being ready in time.

Next Gen EU

Digitalising the reporting and justification of EU funds: traceability for Spain's IGAE and Court of Auditors

What it takes to report on and justify a project financed by Next Generation EU, PERTE or the ERDF (milestones and targets, final recipients and beneficial ownership, anti-fraud measures, DNSH, the audit trail, document retention), why justification put together from folders and emails fails, and what a system must do to generate it out of the management of the project itself.

Public sector

Electronic case files and interoperability: what a custom case management system must comply with (Law 39/2015, ENI)

What Law 39/2015, the Regulation approved by Royal Decree 203/2021 and Spain's National Interoperability Framework (ENI) require of an electronic case management system: ENI documents and case files, the signed index, registry, notifications, signature, data intermediation, the single archive, automated action and the ENS (the National Security Framework), and how to write it all into the tender specifications for custom development.

Compliance

Mandatory B2B e-invoicing (RD 238/2026): the 2027–2028 timeline and what changes in an industrial company's ERP

Royal Decree 238/2026 implements the mandatory e-invoicing between businesses provided for in Spain's Crea y Crece law: the Tax Agency's public solution and interconnected private platforms, accepted formats, the mandatory copy to the public solution, reporting of invoice statuses and a timeline of 12 and 24 months from the ministerial order, expected on 1 October 2026. What has to change in an industrial ERP and how it differs from Verifactu.

Security

The ENS in a local council with fewer than 20,000 inhabitants: CCN-STIC 883A/B/C profiles and what to require of your software supplier

Spain's National Security Framework (ENS) is binding on small local councils too, but Royal Decree 311/2022 allows specific compliance profiles, and the National Cryptologic Centre (CCN) publishes three for local authorities according to their population: 883A (fewer than 5,000 inhabitants), 883B (fewer than 20,000) and 883C (from 20,000 to 75,000). What a compliance profile is, how conformity is declared, what role the provincial councils (Diputaciones) play and what a small council should ask of its software and hosting supplier.

Innovation

The Data Act (Regulation 2023/2854) and IoT sensing: what device data you must be able to hand over from 12 September 2025

The EU Data Act has applied since 12 September 2025 and obliges manufacturers of connected products and providers of related services to give the user access to the data the device generates and to share it with third parties at the user's request; since 12 September 2026, products placed on the market have had to be designed for that. What a connected product is, which data is covered, what rights the user has, which contractual terms are prohibited, what it requires of cloud services and how it affects an IoT sensing project for water networks or a traceability project.

Livestock

The digital farm logbook (CUE) and SIEX: what becomes mandatory on 1 January 2027 and how to integrate it with the software of your association or cooperative

Royal Decree 1054/2022 created Spain's information system for agricultural and livestock holdings (SIEX), the regional register of holdings (REA) and the digital farm logbook (CUE). The CUE has been voluntary since 2024, fertilisation has had to be recorded since 1 January 2026 and the electronic record of plant protection treatments becomes mandatory on 1 January 2027, following the postponement in Royal Decree 1039/2025. What data has to be recorded, who can keep the logbook, how private applications connect to SIEX and what an association, a cooperative or an advisory body gains by integrating the logbook into its own system.

Innovation

Public procurement of innovation: how to tender a development that does not yet exist

What public procurement of innovation is, the forms it takes under Spain's Law on Public Sector Contracts (pre-commercial procurement, procurement of innovative technology, innovation partnership, competitive dialogue), how to start with a preliminary market consultation, how it is funded and what to require of the supplier.

Security

Expired ENS certificates: why an RD 3/2010 badge no longer counts and how to check your supplier's

The deadline for complying with Royal Decree 311/2022 passed on 5 May 2024, and ENS (Spain's National Security Framework) certificates issued under RD 3/2010 ceased to be valid. How to read a certificate or a declaration of conformity, what to check in the conformity mark, the category, the scope and the certification body, and what to require in the tender specifications.

Transport

The Metro Bilbao case: real-time positioning for passenger information

How a real-time train positioning system for passenger information works: where the data comes from, how position and arrival time are calculated, how they are published on the web, in the app and on station displays, what the system demands in availability, latency and security, and what CEDESA developed for Metro Bilbao.

Public sector

Internal whistleblowing channels in local councils with fewer than 10,000 inhabitants: the shared system under Article 14 of Law 2/2023

Spain's Law 2/2023 requires every local authority to have an internal reporting system, but it allows municipalities with fewer than 10,000 inhabitants to share one with each other or with other public authorities in their autonomous community (region), and dependent entities with fewer than 50 employees to share one with the authority they depend on. What the system requires (system manager, channel, deadlines of 7 days and 3 months, register of reports, anonymity, data protection), how a shared system is organised from a provincial council (Diputación), what role the external channel of the AIPI (Spain's Independent Whistleblower Protection Authority) plays and what the software must provide.

Innovation

What is ISO 56001 and which companies should obtain it?

ISO 56001:2024 is the first certifiable innovation management standard: what it requires, how it differs from UNE 166002, who should get certified in Spain, how it is implemented and what it offers when dealing with clients, public funding and the Pyme Innovadora (innovative SME) seal.