Inicio » Basic summary of legal obligations, protocols, and bureaucracy for companies in Spain

Basic summary of legal obligations, protocols, and bureaucracy for companies in Spain

January 13, 2026

Borja Cronuts

Borja Cronuts

Business Management in Spain

Starting and managing a business in Spain involves not only creativity and strategy but also complying with a series of legal and administrative obligations. From the incorporation of the company to day-to-day operations, there are rules, procedures, and protocols that any entrepreneur must know to avoid penalties and ensure the proper functioning of their activity. In recent years, there has been a substantial increase in obligations and requirements that can cause confusion.

In our table “Basic summary of legal obligations, protocols, and various bureaucracy,” you will find a practical guide that summarizes important aspects affecting companies and businesses in Spain that are often overlooked, including for example:

Website compliance under LSSI-CE
Equality or anti-harassment plans
Whistleblowing channel

Practical guide on legal obligations for companies in Spain

At Blegal, our goal is to offer a clear and accessible resource so that entrepreneurs, freelancers, and administrative managers have a quick reference at hand to help them keep their business within the legal framework, avoiding complications and optimizing daily management.

Consult the table and make sure your company complies with all essential legal obligations. Being informed is the first step to operating with security and confidence in the Spanish market.

		Obligation by no. of emp.			Obligation by turnover			External or internal company?	More info
		No emp.	< 50	> 50	< €1M	< €6M	> €6M	External or internal company?	More info
LEGAL-CORPORATE
Digital Certificate		Mandatory	Mandatory	Mandatory	Mandatory	Mandatory	Mandatory	Authorized entity	See more
LSSI-CE Website		Mandatory if there are online economic operations (regardless of turnover).						Web developer helps.	See more
GDPR (Data)		Mandatory	Mandatory	Mandatory				External recommended.
REA (Construc.)		Mandatory for companies/freelancers with employees in construction.						Your advisor.	See more
LEI Code		Mandatory if you operate in financial markets.						Your advisor.	See more
LABOR
Equality Plan		No	No	Mandatory				External recommended.	See more
	Note: Harassment protocols are integrated here if a Plan exists.
Workplace Harassment Prot.		Mandatory	Mandatory	Mandatory				Ext. rec.	See more
Sexual Harassment Prot.		No	Mandatory	Mandatory				Ext. rec.	See more
LGBTI Protocol		No	No	Mandatory				Ext. rec.	See more
OHS (Risks)		If no employees: No. (Property communities: external coord.).						External company.	See more
Time Tracking		No	Mandatory	Mandatory				Internal.	See more
Remuneration Register		Mandatory	Mandatory	Mandatory				Your advisor.	See more
Whistleblowing Channel		No	No	Mandatory				Outsourceable.	See more
TAX
SII (Tax Agency)		Not applicable					Mandatory	Not applicable	See more
IAE		Not applicable				If > €1M		Not applicable	See more
Audit		Not applicable					If > €5.7M (2 years)	External.	See more

Photo by Arlington Research at Unsplash

Frequently Asked Questions

What obligations is a micro-SME or startup NOT obliged to fulfill?

Although bureaucracy in Spain is demanding, there are important exemptions based on company size:

Whistleblowing Channel: It is not mandatory for companies with fewer than 50 employees, unless they operate in specific sectors such as finance or money laundering prevention.
Equality Plan: If your startup has 50 employees or fewer, you have no legal obligation to implement an Equality Plan.
Financial Audit: in general, it is not applicable until you exceed 5.7 million euros in turnover for two consecutive financial years.
LGBTI Plan: it is only mandatory for companies with more than 50 employees

What protocols are mandatory regardless of company size?

There are regulations that every legal entity must comply with from day one, even without employees, for example:

Digital Certificate and LSSI: Mandatory for carrying out procedures with the public administration and for any corporate website that carries out economic operations.
Data Protection (GDPR): It is a critical obligation regardless of business volume to protect the privacy of clients and suppliers.
Workplace Harassment Protocol: All companies with at least one employee must have specific measures against sexual and workplace harassment.
Remuneration and Working Hours Register: Mandatory for all companies with employees to ensure wage transparency and time tracking.

What documentation is mandatory to file annually with the Commercial Registry?

To maintain registry transparency, every commercial company must comply with:

Legalization of Books: Electronic submission of the minute books, shareholder registry, and accounting books (journal and inventory) within four months following the close of the financial year.
Filing of Annual Accounts: Includes the balance sheet, profit and loss account, notes to the financial statements, and statement of changes in equity. This must be done after being approved by the General Meeting.
Certification of account approval: Signed document proving that the partners have approved the figures for the financial year.

Which companies are required to adopt the VeriFactu system in 2027?

The VeriFactu system (Regulation on requirements for billing computer systems) will affect:

Currently obliged entities: All companies that are not registered under the SII (Immediate Supply of Information) and use software for invoicing.
Updated Deadlines: Although 2026 is the transition year, companies with a turnover of less than 6 million euros must have their systems adapted before January 2027.
Exceptions: Those entities that already send their invoices in real-time to the AEAT (Spanish Tax Agency) through the SII.
Important: The software used must be certified to guarantee that it does not allow the alteration or deletion of invoices (“anti-fraud software”).