The regulation, enacted under Royal Decree-Law 7/2026, imposes new requirements relating to renewable additionality, hourly correlation, energy and water efficiency, and digital sovereignty in respect of all access and connection permits obtained from the entry into force of the Royal Decree.
Permits currently being processed, and permits already granted for installations that are not yet connected to the grid, will have specific deadlines for compliance with the new requirements. The consequences in the event of non-compliance include the imposition of economic surcharges and/or the loss of access and connection permits.
Introduction
This alert aims to summarize and analyze the main provisions of the Draft Royal Decree (the PRD or the Draft) on energy sustainability, environmental, resilience and digital sovereignty requirements applicable to data centers, published for public consultation on August 27, 2026. Alongside the PRD, its Regulatory Impact Assessment Report (Memoria de Análisis de Impacto Normativo, MAIN) has also been published, the contents of which are also examined in the sections that follow.
The PRD is enacted in furtherance of the enabling provision contained in the First Additional Provision of Royal Decree-Law 7/2026, of March 20, 2026 (RDL 7/2026), and is jointly promoted by the Ministry for the Ecological Transition and the Demographic Challenge (MITECO), the Ministry of Economy, Commerce and Enterprise, and the Ministry of Digital Transformation and the Civil Service (MTDFP).
It should be noted from the outset that the PRD is being processed on an urgent basis, such urgent processing having been authorized by the Council of Ministers at its meeting of August 25, 2026.
The public consultation period runs from August 27 to September 4, 2026, with a minimum of seven business days, which significantly limits the window for submitting observations.
Scope of application
The PRD applies to operating entities or, where there is no separate operating entity, to the owners of data centers that have applied or intend to apply for access and connection permits to the transmission and distribution networks. The regulation distinguishes between the owner (titular) of the data center and the operating entity. The operating entity is defined as the natural or legal person that effectively carries out the operation of the data center. The owner is the corporate entity that has obtained or intends to apply for the corresponding access and connection permits.
The substantive obligations under the PRD (among others, energy efficiency, additionality, hourly correlation and digital sovereignty, discussed below) apply to data centers with an access capacity equal to or greater than 1MW—a threshold that, in practice, would affect all hyperscaler-type data centers and most edge-type data centers.
It also applies to groupings of data centers belonging to the same owner at the same location which, on an aggregate basis, apply for access and connection to the transmission and distribution networks for a capacity equal to or greater than 1MW. For the obligations relating to reporting and public disclosure of information (Article 14), the threshold is set at 500 kW of information technology capacity, regardless of the access capacity.
The PRD also applies to the operators of the transmission and distribution networks and to the CNMC (Comisión Nacional de los Mercados y la Competencia) within the scope of their respective competencies. Data centers dedicated exclusively to the defense, civil protection and public security sectors are excluded from the scope of application.
Key measures and requirements
Resilience and digital sovereignty requirements
Article 5 of the PRD establishes a set of obligations aimed at ensuring the digital sovereignty of data processing infrastructure located in Spain. In summary, it requires that the operating entity, or where there is no separate operating entity, the owner of the data center be established in the European Union; that data, metadata and records be maintained in EU territory; that control and traceability of media from third countries be guaranteed; and that direct subcontractors be identified.
Likewise, measures are envisaged to address access to data by third-country authorities, with a specific reference to the fact that public sector data subject to the National Security Framework (Esquema Nacional de Seguridad) may not be stored outside the EU.
It should be noted that compliance with these requirements will be evidenced by means of a declaratory letter (declaración responsable) filed prior to the commencement of the data center’s operation. However, the effective application of these obligations is deferred until the approval of a ministerial order for their further development. This point is particularly relevant because it creates temporal uncertainty: developers will need to prepare to comply with requirements whose specific scope is not yet fully defined. In the event of noncompliance, the envisaged consequence is the loss of access and connection permits, following an administrative decision that exhausts the administrative review procedure.
In our view, the referral to subsequent development by ministerial order to define the content of the digital sovereignty obligations introduces an element of legal uncertainty that developers will need to monitor closely.
Energy efficiency (PUE) and water efficiency (WUE)
Article 6 of the PRD requires data centers to achieve Class “A” under the European energy labeling system. On a transitional basis, until the European system is fully operational, which is anticipated for August 2027, compliance will be measured against the following indicators: a Power Usage Effectiveness (PUE) equal to or less than 1.15 and a Water Usage Effectiveness (WUE) equal to or less than 0.1, in accordance with the parameters set out in Annexes III.a and III.b of Commission Delegated Regulation (EU) 2024/1364.
For practical purposes, it should be noted that a PUE of 1.15 is a demanding standard that places the efficiency threshold at levels that only the most technologically advanced data centers consistently achieve. Similarly, a WUE of 0.1 implies very low water consumption, which in practice may limit the available cooling technologies.
The penalty regime in this area is severe: if a data center receives a Class B or lower rating for two consecutive years, this will be deemed a serious breach and may result in the loss of access and connection permits. On a positive note, the loss of permits for noncompliance with the energy and water efficiency requirements is not automatic, but rather requires an administrative decision with a prior hearing, and a prior remediation procedure is provided for, with a minimum period of three months.
Renewable additionality
Article 8 constitutes, in our view, one of the most demanding provisions and with the greatest economic impact under the PRD.
It requires that at least 80% of the data center’s total consumption be backed by renewable generation facilities that meet a strict additionality criterion: either through self-consumption pursuant to Royal Decree 244/2019 (which in turn raises significant practical challenges in terms of land availability, geographical proximity and the scale necessary to supply large-capacity data centers), or through one or more PPAs with electricity producers holding renewable production facilities located in Spain.
Precisely because the additionality criterion is linked to facilities whose commissioning certificate (acta de puesta en servicio) is no more than 18 months old at the date the data center commences operation, developers will need to closely coordinate the development schedules of both the data center and the associated renewable installations.
For practical purposes, this means that a data center will not be able to operate beyond what its additional renewable generation capacity allows it to evidence, with annual verification carried out by the system operator. Consequently, the additionality requirement introduces a functional dependency between the data center and the development of specific renewable capacity that must underpin its consumption, which increases the complexity of project structuring and, from a risk perspective, adds a contingency factor linked to the achievement of the milestones for the renewable installations.
Nevertheless, this dynamic will probably drive a clear trend towards co-development models and joint ventures between data center developers and renewable energy developers.
Hourly correlation
Article 9 of the PRD requires that, in each hour, at least 80% of the data center’s consumption be backed by equivalent renewable generation produced in that same hour, whether through self-consumption or through PPAs. Verification will be carried out on a monthly basis by the system operator.
This hourly correlation requirement aligns Spanish regulation with the EU Renewable Fuels of Non-Biological Origin (RFNBO) framework, but applied specifically to data centers. In other words, annual or monthly energy coverage is not sufficient; hour-by-hour temporal matching is required which, leaving aside self-consumption schemes, will in practice require the integration of energy storage systems or the procurement of renewable generation with complementary production profiles (for example, combining solar and wind, together with batteries), something that will undoubtedly have a material impact on the cost of supply, considering that these types of infrastructure must necessarily operate on a 24/7 basis.
Indeed, 80% hourly correlation represents a level of stringency that will probably substantially increase renewable supply costs compared to a conventional PPA model based on volume purchases and guarantees of origin.
Renewable generation quota of the system
Article 7 of the PRD provides that, where the renewable generation quota of the peninsular electricity system exceeds 90% in year n-2, the additionality and hourly correlation requirements shall be deemed automatically satisfied. However, even in that scenario, the data center is limited to a maximum number of operating hours equal to the total hours in the period multiplied by the applicable renewable quota.
Additionally, once the 90% threshold has been exceeded, this regime is maintained for a minimum period of five years, providing a degree of predictability for operators. However, it should be noted that this mechanism operates as a conditional exception, not as a permanent exemption, such that developers and operators should design their projects assuming full compliance with the additionality and hourly correlation requirements as their base case scenario.
For context, the renewable generation quota of the Spanish peninsular electricity system was approximately 56.8% in 2024 and 55.5% in 2025 (Source: Red Eléctrica de España). The 90% threshold envisaged in Article 7 is, therefore, far from being reached in the short term. For this reason, developers should plan their projects assuming full compliance with the additionality and hourly correlation requirements.
Non-compliance regime: surcharges and loss of permits
The PRD establishes a regime of consequences at two levels: economic surcharges on tolls and access charges (Article 10) and loss of access and connection permits (Article 11).
Surcharges (article 10)
- Excess operating hours over the maximum permitted by the system’s renewable quota: surcharge of 65% on tolls and charges, with an increase of 10 percentage points for each consecutive year of non-compliance.
- Non-compliance with the additionality requirement, graduated by the percentage of additional generation relative to consumption: surcharge of 500% if additional generation is below 20%; 400% if between 20% and 40%; 300% if between 40% and 60%; and 100% if between 60% and 80%.
- Non-compliance with the hourly correlation requirement, graduated by the percentage of unmatched hours in the month: surcharge of 10% if non-compliant hours are below 5%; 30% if between 5% and 20%; and 50% if they exceed 20%, with an increase of 10 percentage points for each consecutive month.
As regards the collection mechanism, surcharges are applied by the grid operator on the grid access contract (ATR contract) and are passed through to the end consumer or to the retail supplier, with the corresponding surcharge included in the monthly invoices.
In our view, the surcharge structure is particularly severe in the area of additionality, where the penalty can reach up to five times the amount of the tolls and charges. This design reflects, according to the MAIN, the intention to deter structural non-compliance, but it creates a very significant economic risk for operators.
Loss of access and connection permits (Article 11)
- In the area of renewables, a significant and repeated non-compliance triggering the loss of permits will be deemed to exist where additional generation is below 60% of consumption for five consecutive years, or where non-compliance with hourly correlation exceeds 20% of hours for five consecutive years.
- In the area of digital sovereignty and energy efficiency, the loss of permits will be determined by an administrative decision that exhausts the administrative review procedure.
In the area of renewables, the loss procedure is initiated by the State Secretariat for Energy, at the request of the grid operator, and includes a hearing procedure. We note that the requirement of five consecutive years of noncompliance provides a temporal margin that allows operators to adopt corrective measures before the loss materializes.
In the area of digital sovereignty and energy efficiency, the determination of non-compliance falls within the competence of the Ministry of Digital Transformation and the Civil Service. The ministry must require remediation within a proportionate period, which may not be less than three months, unless there is a duly justified serious and immediate risk. The loss of access and connection permits may only be determined by virtue of an administrative decision that exhausts the administrative review procedure, with a prior hearing of the interested party, following an unattended request or a serious and unremedied breach.
From a risk perspective, the loss of access and connection permits is equivalent to the termination of the data center project and therefore constitutes the ultimate regulatory risk.
Temporal application regime
The PRD applies the same substantive requirements—additionality, hourly correlation, energy and water efficiency, and digital sovereignty—to all data center projects, regardless of their stage of development. However, the regulation differentiates between three categories of projects and establishes distinct deadlines for evidencing compliance with these requirements, depending on whether the project’s access and connection application is filed after the entry into force of the PRD, is currently being processed, or has already resulted in permits being granted but the data center is not yet connected to the grid.
New projects (applications filed after entry into force)
Projects whose access and connection applications are filed after the entry into force of the PRD will be subject to the entirety of the requirements from the outset of their application process. There is no transitional regime for these projects; they must evidence compliance with all requirements as a precondition for obtaining permits.
Application in progress (three-month deadline)
The First Transitional Provision provides that applications for access and connection permits that are in progress at the date of entry into force of the PRD—including those suspended due to a capacity tender call, pursuant to the Second Transitional Provision—shall have a period of three months of its entry into force to evidence compliance with the requirements of the PRD. If such period elapses without evidence of compliance, the applications will be rejected.
This point is particularly relevant because it affects a significant number of projects currently in the access queue. The three-month period is, in our experience, extraordinarily short for the structuring of renewable PPAs with the additionality and hourly correlation requirements imposed by the PRD. Developers with applications in progress will need to act with the utmost urgency.
Projects with permits granted but not connected (six-month deadline)
The Third Transitional Provision refers to projects that already hold access and connection permits granted at the date of entry into force, but which are not yet connected. A data center is considered “connected” for these purposes if it is electrically coupled and has entered into a grid access contract (ATR contract). These projects have a period of six months of the PRD’s entry into force to evidence compliance with the requirements. Failing this, the permits will lapse and the deposited guarantees will be enforced.
However, the Second Additional Provision offers an exit route for both pending applications and projects with granted permits but not connected: voluntary surrender within the six-month period without forfeiture of the guarantees, which constitutes an incentive for developers who consider adaptation to the new regulatory framework to be unfeasible to release grid capacity in an orderly manner.
Enabling provision of RDL 7/2026 (First Additional Provision)
The PRD is enacted under the regulatory enabling provision contained in the First Additional Provision of RDL 7/2026. This enabling provision confers upon the government the power to establish by regulation the sustainability, energy efficiency and digital sovereignty requirements that data centers accessing the electricity grids must comply with.
The Royal Decree-Law nature of the enabling provision raises, in our view, questions of interest from the perspective of the hierarchy of norms and the extent of the enabling provision, aspects that are analyzed in the following section.
Preliminary assessment
Impact of the PRD on data center investment and financing
For data center projects that commence their application process after the entry into force of the PRD, the new regulatory framework substantially modifies the assumptions upon which investment and financing structures are built.
In our experience in the energy infrastructure sector, a regulatory change of this magnitude will undoubtedly require a material review of project financial models.
Renewable generation, storage and water efficiency
From a CAPEX perspective, the main driver will be investment in cooling technologies and infrastructure necessary to meet the energy efficiency (PUE ≤ 1.15) and water efficiency (WUE ≤ 0.1) requirements. Additionally, developers will need to factor in:
- the cost of the additional renewable generation necessary to meet the 80% additionality requirement and
- the energy storage systems or diversification of renewable sources necessary to achieve 80% hourly correlation in each hour; which will primarily translate into an increase in operational energy costs.
In our view, the combination of higher investment in efficiency infrastructure and increased renewable energy costs will materially alter the cost structure of data center projects compared to the parameters that had been assumed prior to the PRD.
New requirements for PPAs: additionality, term and hourly correlation
Regarding the structure of bilateral power purchase agreements (PPAs), the requirement for formalization by notarial deed (escritura pública) and a minimum term of ten years, combined with the additionality requirement (facilities commissioned no earlier than 18 months prior), means that developers will need to secure the procurement of new dedicated renewable capacity, temporally coordinated with the development of the data center. The exclusion of purely financial contracts based on guarantees of origin eliminates one of the most flexible structures that had been used in the market to date.
Accordingly, developers will need to address the negotiation of PPAs from the earliest stages of development with the level of specificity required by the PRD, including the clear identification of the data center-generation facility relationship and the certification of additionality. As a result, development timelines are expected to extend compared to previous scenarios.
Exclusion of financial PPAs: unjustified departure from the EU RFNBO framework
The PRD expressly excludes purely financial contracts based on guarantees of origin as a valid mechanism for evidencing compliance with the additionality and hourly correlation requirements, thereby limiting the admissible procurement structures to bilateral physical PPAs. In our view, this restriction is not adequately justified and departs from the very EU regulatory framework that the PRD purports to follow.
As acknowledged in the Regulatory Impact Assessment Report (Memoria de Análisis de Impacto Normativo), the PRD draws direct inspiration from the EU delegated acts on renewable fuels of non-biological origin (RFNBO), namely Commission Delegated Regulations (EU) 2023/1184 and 2023/1185. Critically, the European Commission itself, in its official Q&A on the implementation of those delegated acts3, has expressly validated the use of guarantees of origin as a tool for demonstrating compliance with the RFNBO requirements.
In particular, the European Commission has confirmed that “it would be possible for the fuel producer to demonstrate via cancelling the required number of GOs that at least an equivalent amount of electricity that is claimed as fully renewable has been produced by the installations producing renewable electricity under the renewable PPA”, provided that the guarantees of origin are issued exclusively for the installations covered by the relevant PPA and carry the same attributes as the physical installation (including location, age and time of production).
Moreover, the European Commission has clarified that intermediaries may be involved in renewable PPAs “by various means and for various purposes, including as a contracting party”, so long as a direct relationship between the electricity producer and the offtaker is maintained and the requirements on additionality, temporal correlation (hourly or monthly, as applicable) and geographic correlation (same bidding zone—in this case, Spain) are satisfied.
These interpretive clarifications are consistent with the underlying principles of CDR 2023/1184, which is structured around three pillars—additionality, temporal correlation and geographic correlation—without prescribing the specific contractual settlement mechanism (physical versus financial) through which these principles are to be met.
From a substantive standpoint, the exclusion of financial PPAs disregards the functional equivalence between physical and financial procurement structures. In a financial PPA backed by guarantees of origin, the underlying renewable generation assets (whether photovoltaic, wind or combined with storage) physically inject renewable electricity into the system, which operates as a single network for both the generation facilities and the data center).
The settlement mechanism is financial—the renewable attribute being tracked and evidenced through the cancellation of guarantees of origin—but the net effect in terms of additional renewable generation injected into the Spanish electricity system is equivalent to that of a physical bilateral PPA.
By restricting the admissible instruments to physical PPAs, the PRD introduces a formalistic distinction that, in our view, does not reflect the economic or environmental substance of the transaction. Furthermore, such a restriction does not align with prevailing market standards and could render the availability of PPAs on the scale required by data centers practically unviable, with a very significant adverse impact on both the development of renewable energy projects and the deployment of data center infrastructure in Spain.
In this regard, it is worth noting that the analysis published by the International PtX Hub on the EU requirements for renewable hydrogen production4 confirms that the CDR 2023/1184 framework is technology- and structure-neutral, requiring PPAs with renewable electricity producers, additionality, temporal and geographic correlation, but without mandating a particular contractual settlement format.
Finally, clarification will also be required regarding the treatment of sleeve PPAs (sleeved or synthetic/virtual PPAs with an underlying renewable generation asset), which share the same functional logic as financial PPAs backed by guarantees of origin: the renewable generation is physically injected into the system, with the contractual and settlement layer structured through an intermediary or on a financial basis.
To the extent that such structures satisfy the requirements of additionality, hourly correlation and geographic location within Spain—consistent with the interpretation endorsed by the European Commission for the RFNBO delegated acts—there is no policy rationale for their exclusion.
An express clarification of their admissibility in the final text of the Royal Decree would provide much-needed certainty to market participants and would be consistent with the PRD’s stated objective of aligning with European standards.
Adaptation challenges for projects in progress and with permits already granted
Likewise, the impact of the PRD is particularly acute for projects currently in the application process or which already hold access and connection permits but are not yet connected, given the extraordinarily short deadlines it imposes for compliance with the new requirements.
These projects, designed and structured under a previous regulatory framework, will need to undertake, within very short deadlines (three months in case of applications in progress, and six months for projects with permits already granted but not yet connected) an adaptation process of considerable complexity.
This process will require, among other actions, revisiting and, where applicable, restructuring existing financial models and, in many cases, restructuring and negotiating the procurement of an energy supply for the data center that complies with highly demanding additionality and hourly correlation requirements.
Sector reaction to the new regulatory framework
The publication of the PRD has generated immediate reactions from the sector and from leading market observers. Spain DC (Asociación Española de Data Centers) expressed “concern” on August 27, 2026, warning that the regulation must be “proportionate, technically feasible and aligned with the European framework.” The association explicitly warns of the risk of relocation: “Spain cannot afford to become, by regulatory decision, one of the most difficult European markets for developing digital infrastructure.”
Despite this, the association announced its constructive participation in the public consultation, which suggests a willingness to negotiate on the specific parameters of the regulation. (Source: La Vanguardia).
For its part, Data Center Dynamics described grid access as “the most sensitive point” and identified a “new regulatory risk factor with potential impact on financing, development timelines and bankability.” (Source: Data Center Dynamics).
At the institutional level, the government presents the regulation as “pioneering” at the European level, having analyzed the grid congestion problems experienced in Ireland, Singapore, the Netherlands, and the United States. Spain DC estimates that the sector could attract EUR66.9 billion in investment by 2030, with an annual GDP impact of EUR7.3bn and more than 16,000 jobs. These figures illustrate the magnitude of the investment potentially affected by the new regulatory framework.
However, these reactions should be placed in context: the PRD is at the public consultation stage and it is foreseeable that the final text will incorporate technical adjustments resulting from the submissions received. However, the fundamental architecture of the regime—additionality, hourly correlation, and loss of permits as the ultimate consequence—is unlikely to be modified in substance, and therefore developers and investors should treat compliance with these requirements as a working assumption.
Interpretative issues and ambiguities
Finally, the following interpretive issues are identified which, in our view, could give rise to a degree of legal uncertainty if the appropriate adjustments are not made in the final drafting of this regulation:
Scope of the enabling provision of RDL 7/2026
The First Additional Provision of RDL 7/2026 enables the government to establish requirements by regulation. However, it is open to question whether certain legal consequences provided for in the PRD—notably, the loss of access and connection permits and the enforcement of guarantees—exceed what can reasonably be understood as covered by a generic enabling provision to establish “sustainability requirements.” This point could be subject to challenge before the contentious-administrative courts.
Additionality criterion: 18-month window
The PRD requires that renewable installations have a commissioning certificate (acta de puesta en servicio) no more than 18 months old at the date of the data center’s entry into operation. It is unclear whether this period is computed on an absolute basis or whether it admits successive renewals (i.e., whether a PPA with an installation that met the criterion at the time of execution, but which subsequently exceeds 18 months of age, ceases to be valid for the purposes of the requirement).
In our view, the most reasonable interpretation is that the criterion is assessed at the time of the data center’s entry into operation, but the text admits alternative readings.
Interaction between surcharges and loss of permits
The PRD does not expressly clarify whether the imposition of surcharges during the years prior to the activation of the permit loss procedure is exclusive or cumulative. In other words: are surcharges applied during the five years and, in the fifth year, is the permit also lost? Or does the loss replace the surcharge? A systematic reading suggests accumulation, but an express clarification would be desirable.
Digital sovereignty requirements: indeterminate deferral
Article 5 defers its effective application to the approval of a ministerial order without setting a deadline for this. This creates a situation of uncertainty for developers who must plan their projects without knowing the specific scope of the obligations they will be required to comply with.
Definition of “connected”
The Third Transitional Provision defines the concept of a “connected” center as one that is electrically coupled and has entered into a grid access contract (ATR contract). It is arguable whether a center that has completed its connection tests but has not yet formalized the ATR contract for administrative reasons beyond the developer’s control could be considered “connected” for these purposes. The consequence of not being so—the loss of the permit and enforcement of guarantees—makes this definition extremely sensitive.
PPAs: notarial deed requirement and minimum ten-year term
Article 12 requires that PPAs be formalized by means of notarial deed (escritura pública) and have a minimum term of ten years. Purely financial contracts based solely on guarantees of origin are expressly excluded. It is notable that the requirement to formalize PPAs by means of notarial deed is unusual in practice and adds significant cost and formality.
In addition, as it has been flagged above, it remains to be determined how complex PPA structures (sleeved PPAs, virtual PPAs with subsequent physical delivery, structures involving intermediaries) will be treated for the purposes of compliance with these requirements.
1MW threshold: aggregation
The PRD applies the 1MW threshold by aggregating data centers belonging to the same owner at the same site. The question of what constitutes a “same site” and a “same owner” (particularly in structures involving separate SPVs controlled by the same group) is not defined with precision and could give rise to divergent interpretations.
