Distributes a software product, in Spain

Real Decreto Legislativo 1/2007, de 16 de noviembre, Libro tercero, artículos 128 a 146 · Read the law's page

• Software supplied on its own may fall outside the definition of a product, which is any movable good together with gas and electricity, and the point is not settled (Art. 136).
• If you manufacture or import into the European Union a finished product, an element integrated in a finished product or a raw material, you answer for the damage a defect in it causes (Arts. 135 and 138(1)).
• Offer the safety that could legitimately be expected of the product, taking account of its presentation, its reasonably foreseeable use and the time you put it into circulation, and at least the safety your other units of the same series normally offer (Art. 137(1) and (2)).
• If the producer cannot be identified, you answer as producer when you supply the product, unless within three months you tell the injured person who the producer is or who supplied it to you (Art. 138(2)).
• Do not supply a product you know to be defective: a supplier that does so answers as if it were the producer (Art. 146).
• Be able to prove that you did not put the product into circulation, that the defect probably did not exist then, that it was not made for sale or distribution with an economic purpose or in the course of a professional or business activity, that the defect arose from compliance with mandatory rules, or that the state of scientific and technical knowledge then did not allow the defect to be discovered (Art. 140(1)).
• If you make medicines or food for human consumption, do not count on the state-of-knowledge defense (Art. 140(3)).
• Do not rely on a contract term to limit or exclude your liability to the injured person (Art. 130).

Real Decreto 1494/2007, de 12 de noviembre, servicios de confianza: art. 9 · Read the law's page

• Make the trust services you provide, and the products for end users that you use to provide them, accessible to elderly persons and persons with disabilities, unless no technological solution allows it (Art. 9).

Arts. 12, 13, 15 y 17 del Real Decreto-ley 7/2022, de 29 de marzo · Read the law's page

• If you are a 5G operator, a 5G supplier, or a 5G corporate user holding rights to use the radio spectrum for a private 5G network or for professional or self-supply 5G services, this decree-law binds you (Article 4).
• As a 5G operator, guarantee the secure installation, deployment and operation of public 5G networks and the secure provision of 5G services, including technical and operational measures for the physical and logical integrity of the networks, contingency plans for essential services that depend on them, control of who can access network assets, use of only certified products, resources, services and systems to operate them, compliance with applicable technical standards and European certification schemes, supplier security requirements, control of your own supply chain, and a security audit at your cost (Article 12(1) and (2)).
• If you own or operate critical elements of a public 5G network, design a supply-chain diversification strategy under which access-network equipment, systems and resources come from at least two different suppliers, and send it to the Ministry of Economic Affairs and Digital Transformation within six months of the decree-law's entry into force (Article 12(3) and the Second Additional Provision).
• As a 5G supplier, guarantee the security of the telecommunications equipment, hardware, software and ancillary services you provide for 5G networks and services: meet security standards from design to commissioning, strengthen software integrity and manage updates and patches, show product and service certification, audit the security of your equipment, products and services, give information on possible third-party interference in their design and operation, and give operators and corporate users information showing compliance with security standards (Article 13(1) and (2)).
• As a 5G corporate user with spectrum rights for a private 5G network or self-supply services, guarantee the secure installation, deployment and operation of your private 5G network and the secure provision of your 5G services (Article 15(1)).

Real Decreto 311/2022, art. 2.3, Esquema Nacional de Seguridad · Read the law's page

• If you provide services or supply solutions to a Spanish public-sector entity under a contract, for that entity's exercise of its administrative competences and powers, the Scheme applies to the information systems behind what you provide (Article 2.3).
• Have a security policy approved by the body that holds your highest executive competences (Articles 2.3 and 12).
• Expect the public body's tender specifications to require a declaration or certification of conformity with the Scheme for the systems behind your service, and to reach your own suppliers as far as the risk analysis requires (Article 2.3).
• Have the systems within the Scheme audited at least every two years, and again after substantial modifications that may affect the required security measures (Article 31.1).

Real Decreto 443/2024, arts. 18, 19, 23 y 24, Esquema Nacional de Seguridad 5G · Read the law's page

• If you are a 5G operator, a 5G supplier or a 5G corporate user, this scheme binds you under Real Decreto-ley 7/2022 (Article 4.1).
• As a 5G operator, analyse the risks to your 5G networks and services and send a new analysis to the Ministry for Digital Transformation and the Civil Service before 1 October 2024 and then every two years, or when it requires one after significant changes (Article 18.1 and 18.6).
• As a 5G operator, submit to an ordinary security audit at your own cost at least every two years, and to an extraordinary one after substantial changes that may affect the security measures (Article 23.2(j)).
• As a 5G supplier, analyse the risks of the equipment, hardware, software and ancillary services you provide for 5G networks, and give that analysis to the Ministry and to the operators you supply when required (Article 19.1 and 19.2).
• As a 5G supplier, meet security standards from design to commissioning, strengthen software integrity, manage updates and patches, and carry out a security audit of your equipment, products and services (Article 24.2(a), (b) and (e)).

Ley 11/2023, de 8 de mayo, de trasposición de Directivas de la Unión Europea en materia de accesibilidad de determinados productos y servicios, título I (arts. 1 a 31) · Read the law's page

• If you provide to consumers a service listed in Article 2(2)(a) to (f) (electronic communications, access to audiovisual media services, elements of passenger transport services, consumer banking, e-books and their dedicated software, or e-commerce), meet the universal accessibility requirements of Sections III and IV of Annex I (Ley 11/2023, Arts. 2(2) and 3(1)); urban, suburban and regional transport services meet Section IV only.
• Provide the service with products that meet Section I of Annex I and, where relevant, Section II; give information on how the service works, and on its accessibility features and interoperability with assistive devices, through more than one sensory channel and in a form that is easy to understand and perceivable; make your websites, related online applications, mobile device services and mobile applications perceivable, operable, understandable and robust; and have any support services you run (help desks, call centers, technical support, relay and training services) give information on the service's accessibility and compatibility with assistive technologies in accessible modes of communication (Annex I, Section III(a) to (d)).
• For e-commerce services, give the accessibility information on the products and services for sale where the responsible economic operator provides it, make the identification, security and payment function perceivable, functional, understandable and robust where it is provided as part of the service, and offer identification methods, electronic signatures and payment services that are perceivable, functional, understandable and robust (Annex I, Section IV(g)).
• For consumer banking services, make identification methods, electronic signatures, security and payment services perceivable, functional, understandable and robust, and keep information at or below level B2 of the Common European Framework of Reference for Languages (Annex I, Section IV(e)).
• For electronic communications services, offer real-time text as well as voice and full conversation with video support, and make emergency communications that use voice and text, or video, synchronized and transmitted by you to the most appropriate public safety answering point (Annex I, Section IV(a)); for services giving access to audiovisual media services, offer accessible electronic program guides and transmit subtitles, audio description, spoken subtitles and sign language in full (Annex I, Section IV(b)).
• For e-books, keep text and audio synchronized, do not block assistive technology, give access to and navigation through the content with a dynamic layout, allow alternative renditions, make the e-book discoverable through accessibility metadata, and do not let digital rights management block accessibility features (Annex I, Section IV(f)); for air, bus, rail and waterborne passenger transport, give information on the accessibility of vehicles, infrastructure and assistance and on smart ticketing, real-time travel information and additional services (Annex I, Section IV(c)); for urban, suburban and regional transport, make the self-service terminals used to provide the service accessible (Annex I, Section IV(d)).
• Include in your general conditions, or an equivalent document, the information that evaluates how the service meets the accessibility requirements, make it available to the public in written and oral form and in a way accessible to persons with disabilities, and keep it up to date (Art. 13(2) and (4)).
• Keep procedures that keep the service conforming, provide information showing that the way you provide and monitor the service keeps it conforming, take corrective measures where it does not conform, tell the competent authorities of the Member States where you provide it, and give a competent authority on a reasoned request the information it needs and your cooperation (Art. 13(5) to (8)).
• Make the products you use in the service with which the consumer interacts meet the accessibility requirements, remain responsible when you subcontract part of the service, and train your staff on accessible products and services (Arts. 14 and 15).
• A passenger transport service that meets the accessible-information and accessibility-information requirements of the European passenger rights regulations and railway interoperability acts is treated as meeting the corresponding requirements of Title I, and any additional requirement of Title I applies in full (Art. 4).
• Assess, under the criteria in Annex V, whether compliance would substantially modify the basic nature of the service or impose a disproportionate burden; document the assessment keep it for five years after the last provision of the service and give the authority a copy on request; renew it for each category or type of service when the service changes, when an authority asks and at least every five years; and send information to the authorities of the Member State where you provide the service (Art. 16(2), (3), (5) and (7)). You cannot rely on the disproportionate burden exception for accessibility improvements you fund from sources other than your own resources (Art. 16(6)), and you must still make the service as accessible as possible (Art. 16(1)).
• The service requirements and any obligation relating to compliance with them do not apply to a microenterprise, meaning an enterprise that employs fewer than 10 persons and whose annual turnover or annual balance sheet total does not exceed EUR 2 million (Arts. 3(3); Annex VII, point 16).
• Until 28 June 2030, you may keep providing services with the products you lawfully used to provide similar services before that date, continue service contracts concluded before 28 June 2025 unchanged until they expire but for no longer than five years from that date, and keep using self-service terminals lawfully in use before 28 June 2025 until the end of their economic life, for no more than ten years after they were put into operation (transitional provision, paras. 1 and 2).

Ley 11/2023, de 8 de mayo, productos: arts. 2.1, 3.1 y 7 a 23 · Read the law's page

• If you manufacture a product listed in Article 2(1) (consumer general-purpose computer hardware and operating systems, payment terminals, cash machines, ticketing machines, check-in machines, interactive information terminals, queue-management terminals, consumer terminal equipment for electronic communications or audiovisual access, e-readers), design and make it meet Sections I and II of Annex I, or Section I only for a self-service terminal (Ley 11/2023, Arts. 2(1), 3(1) and 7(1)).
• Before placing the product on the market, draw up the technical documentation under Annex IV, apply the conformity assessment procedure, draw up the EU declaration of conformity and affix the CE marking, and keep the documentation and declaration for five years (Arts. 7(2) and (3), 18 and 20).
• Keep procedures that hold series production to conformity, mark the product with a type, batch or serial number, your name and a single contact address, and supply instructions and safety information in at least Castilian and the official language of the territory where it is marketed, in clear language (Art. 7(4) to (7)).
• If a product you placed on the market does not conform, take corrective measures at once or withdraw it, inform the competent supervisory authority and the authorities of the other Member States where you marketed it, keep a register of non-conforming products and complaints, and on a reasoned request give the authority the information and cooperation it asks for (Art. 7(8) and (9)).
• If you import a product, place only conforming products on the market, check that the manufacturer applied the conformity assessment, drew up the documentation and applied the CE marking, mark the product with your name and contact address, supply the instructions and safety information in at least Castilian and in easy-read form, keep a copy of the EU declaration of conformity for five years, and keep storage and transport conditions from compromising conformity (Art. 9).
• If you distribute a product, check before marketing it that it bears the CE marking and carries the documents and instructions, offered also in formats accessible to persons with disabilities where physically possible, do not market a product you think non-conforming, and inform the manufacturer or importer and the supervisory authorities (Art. 10).
• If you place a product on the market under your own name or trademark, or modify a product so that conformity may be affected, you carry the manufacturer's duties (Art. 11); on request, identify the operators that supplied you and that you supplied, for five years (Art. 12).
• If you rely on a significant change in the basic nature of the product or on a disproportionate burden, assess it under the criteria in Annex V, document the assessment, keep it for five years from the last marketing of the product, send information to the authorities of the Member State where the product is placed on the market, and list the excepted requirements in the EU declaration of conformity (Arts. 16(1) to (3) and (7) and 18(1)); you must still make the product as accessible as possible.
• A service provider may keep using self-service terminals that it lawfully used before 28 June 2025 until the end of their economic life, for no more than ten years after they were put into operation (transitional provision, para. 2).
• A microenterprise dealing with products, meaning an enterprise that employs fewer than 10 persons and whose annual turnover or annual balance sheet total does not exceed EUR 2 million, need not document its assessment but gives the authority the relevant information on request (Art. 16(4); Annex VII, point 16).

Real Decreto 188/2016, art. 3.3 d) a f), equipos radioeléctricos · Read the law's page

• If you manufacture radio equipment that is internet-connected, or that is childcare, toy or wearable equipment that can process personal, traffic or location data, or that lets the user transfer money or virtual currency, this binds you from 1 August 2025; radio equipment that the medical devices regulations also cover is outside it (Article 3.3 and Delegated Regulation (EU) 2022/30 Articles 1 and 2).
• Design internet-connected radio equipment so that it does not harm the network or its functioning, or misuse network resources in a way that causes unacceptable degradation of service (Article 3.3(d)).
• Build safeguards into the equipment categories the delegated regulation names so that personal data and the privacy of the user and the subscriber are protected (Article 3.3(e)).
• Build in functions that protect against fraud in internet-connected equipment that lets the user transfer money, monetary value or virtual currency (Article 3.3(f)).
• Before placing the equipment on the market, ensure it has been designed and manufactured in line with these essential requirements (Article 9.1).