Inspections by installation
Since 11 October 2026 the self-protection plan has been governed by a new Directive, and who must have one has changed
On 10 October 2026 the BOE published the Directriz Básica de Planificación de Protección Civil de autoprotección (the Basic Civil Protection Planning Directive on self-protection), which applies from the following day and replaces the Basic Standard of Royal Decree 393/2007. It changes who must have a plan: the national rule that caught any building with an evacuation height of 28 metres or an occupancy of 2,000 people is gone. The plan is reviewed at least every five years, the drill is still yearly and existing plans have four years to adapt.
What changed on 11 October 2026
Royal Decree 524/2023, which approved the Norma Básica de Protección Civil (Basic Civil Protection Standard), repealed Royal Decree 393/2007 on self-protection with effect from 11 July 2023, but provided that its Basic Standard and other instruments "continuarán aplicándose hasta tanto sean aprobados" (shall continue to apply until approval of) their replacements (sole repealing provision, sections 2(d) and 3). The replacement arrived in October 2026: on the 6th the Council of Ministers approved the Basic Civil Protection Planning Directive on self-protection, and Order INT/1068/2026 published it in the BOE of the 10th.
El Real Decreto 393/2007, de 23 de marzo, por el que se aprueba la Norma Básica de Autoprotección […] dejará de aplicarse desde la publicación de este acuerdo. ("Royal Decree 393/2007 of 23 March approving the Basic Self-Protection Standard […] shall cease to apply upon publication of this agreement.")
The agreement takes effect from the day after its publication (fifth point), that is, from 11 October 2026. For a business with premises, four changes matter:
- The general 28-metre and 2,000-people rule is gone. Annex I of Royal Decree 393/2007 covered "Todos aquellos edificios que alberguen actividades comerciales, administrativas, de prestación de servicios, o de cualquier otro tipo" (all buildings housing retail, administrative, service or any other activities) with an evacuation height of 28 m or more or an occupancy of 2,000 people or more, and applied the same thresholds to public residential, educational and healthcare use. The Directive has no such heading.
- Plan review moves from three to five years at most (section 2.6), "salvo que la normativa sectorial específica indique una periodicidad inferior" (unless specific sector rules set a shorter interval).
- The drill is still yearly: at the interval set by the plan itself and, in any case, at least once a year (section 2.5.2).
- Existing plans have four years to adapt to the Directive (section 2.6.3).
Who must have one now: Annex I
The Directive applies as a minimum standard to the activities in its Annex I, and on a supplementary basis to those with their own sector regulations (section 1.4). These are the ones closest to a business with premises, with the thresholds as they appear in the text and what the previous rule said:
| Activity | Directive threshold (from 11 Oct 2026) | What RD 393/2007 said | Annex I |
|---|---|---|---|
| Public entertainment and recreational activities in an enclosed building (events regulated by that legislation) | Capacity of 1,000 people or more, or evacuation height of 28 m or more | Capacity of 2,000 or more, or 28 m or more | 1.E.1.1 |
| Enclosed temporary or seasonal structures | Capacity of 1,000 people or more | 2,500 or more | 1.E.1.2 |
| Outdoor events | 5,000 people in a bounded space; 20,000 where unbounded | 20,000 or more | 1.E.2 |
| Schools and educational centres | 50 or more people who cannot be evacuated by their own means or with disabilities (D.1), or activity that could cause civil protection emergencies (D.2) | Centres for people unable to evacuate on their own, or 28 m or occupancy of 2,000 | 2.D |
| Care homes and day centres for older or disabled people | 100 or more people authorised in the licence, not counting staff | 100 or more people | 2.E.1 |
| Retail, administrative or service buildings, and the rest of public residential use | Not listed | 28 m or more, or occupancy of 2,000 or more | — |
| Industry and storage | Weighted and corrected fire load of 13,600 MJ/m² or more (high intrinsic risk 8), dangerous substances, chemical storage above its thresholds and refrigeration plants with more than 3 t of group 2 and 3 refrigerants | 13,600 MJ/m² or more, dangerous substances, chemical storage and refrigeration plants above 3 t | 1.A |
| Healthcare | Inpatient, intensive or surgical care; others, 28 m or more or occupancy of 500 or more | 200 beds; others, 28 m or 2,000 | 2.C |
Source: Basic Self-Protection Directive, Annex I (BOE no. 252 of 10 October 2026), and Royal Decree 393/2007, Annex I.
For everything else, the Directive says three things. Activities outside Annex I "deberán desarrollar sus propios protocolos o instrumentos de autoprotección según la normativa específica que los regule" (must develop their own self-protection protocols or instruments under the specific rules governing them), and these do not count as self-protection plans for the purposes of the Directive (Annex I, 2.F). Educational centres below the threshold remain bound by their evacuation and emergency protocols under occupational health and safety and education rules (Annex I, 2.D). And the authorities may require a plan from an activity not in Annex I "cuando presenten un especial riesgo o vulnerabilidad" (where they present a special risk or vulnerability) (section 1.4).
What the plan contains and who signs it
The plan is a single document structured as in Annex II: identification of the owner, the site and the technician who drafts it; description of the activity and the building, with plans of every floor; inventory and assessment of risks; self-protection resources, with plans of evacuation routes; the maintenance programme for the installations, including the record of statutory inspections; the emergency action plan; integration into civil protection plans; implementation; and keeping the plan effective. Its annexes are a directory with emergency numbers and 112, action sheets and plans.
It is drafted and signed by "un técnico capacitado" (a qualified technician) and countersigned by the owner (section 2.2.3(c)); the requirements to accredit that technician are set by the competent civil protection bodies (section 2.3.4). The owner approves it and notifies the authorities so it can be registered (section 2.7.1.2). If the building has premises that are leased or held under concession, each of those activity owners draws up, implements and integrates its own plan with its own resources (section 2.2.3(h)). The maintenance chapter links to the checks on fire protection equipment, which have a rule of their own: the RIPCI.
Drills, training, review and registration
se realizarán simulacros de emergencia, con la periodicidad mínima que fije el propio plan y, en todo caso, al menos una vez al año, evaluando sus resultados. ("Emergency drills shall be carried out at the minimum interval set by the plan itself and, in any case, at least once a year, with their results assessed.")
The owner notifies civil protection of each drill within the deadline each authority sets (section 2.3.5) and keeps, available to the authorities, information on the plan's maintenance activities and the assessment reports signed by the person in charge (section 2.5.2). Training for the staff assigned to the plan is periodic, with some way of checking what has been learnt; it must cover how to act with highly vulnerable people, whom Annex V defines to include children up to the age of 6. Once the plan is implemented, the owner issues a certificate in the form each authority lays down (section 2.5.1).
There is a new and very visible duty: to place "en un lugar visible a la entrada del local o establecimiento, una copia escrita de los datos del anexo III, incluyendo los planos" (in a visible place at the entrance to the premises, a written copy of the Annex III data, including the plans) for the emergency services (section 2.3.5). That data includes, among other things, capacity, number of floors and exits, the assembly point, the 24-hour contact, where the gas and electricity shut-offs are and what fire protection installations there are.
Registration in the register of plans is mandatory for every activity in Annex I, whether or not specific regulations apply, and the register is not public: the owner can see its own data, as can the authority that grants the licence and the civil protection services (section 2.7.4). Breaches are penalised under Title VI of Ley 17/2015 del Sistema Nacional de Protección Civil (the national Civil Protection System Act) and the regional acts (section 2.3.4).
The regions have their own catalogues
The Directive is a minimum: the authorities may set "valores umbrales más restrictivos" (stricter thresholds) than those in Annex I based on capacity, vulnerability, fire load or the response time of the rescue services, among other criteria (section 1.4). Several regions have a catalogue of their own. Two examples read in their official gazette, in their original publication; we have not checked whether they have been amended since:
- Catalonia, Decret 30/2015 (DOGC no. 6824 of 5 March 2015): covers, among others, buildings with a capacity of 2,000 people or more or an evacuation height of 28 m or more (Annex I.A), those of more than 1,000 and fewer than 2,000 people, and "las guarderías, ludotecas y similares con más de 100 alumnos" (nurseries, play centres and similar with more than 100 children) (Annex I.B). Plan review at least every four years (Art. 6(1)) and drills at least yearly (Art. 13(1)).
- Valencian Community, Decreto 32/2014 (DOGV no. 7215 of 17 February 2014): includes hotels, hostels, guesthouses, youth hostels and rural houses with a capacity of 100 people or more; retail activities with a capacity of 1,000 people, 5,000 m² of usable area or 28 m of evacuation height; administrative or service buildings with 2,000 people, 10,000 m² of usable area or 28 m; car parks with 200 spaces or 2,500 m²; and first-cycle nursery schools.
The other regions may have different rules, and you need to check your own before assuming that a set of premises does not need a plan.
Rules that still refer to Royal Decree 393/2007
Several rules still cite the Basic Standard that has stopped applying. The RIPCI (the Spanish fire protection installations regulation) requires category A photoluminescent signage "en los centros donde se desarrollen las actividades descritas en el anexo I de la norma Básica de Autoprotección, aprobado por Real Decreto 393/2007" (in centres carrying out the activities in Annex I of the Basic Self-Protection Standard) (Annex I, section 2, point 3). The 2025 industrial fire safety regulation refers to the self-protection plan "atendiendo al Real Decreto 393/2007" (in line with Royal Decree 393/2007) (Art. 12(3)). And the Valencian decree requires plans to be drawn up under that Basic Standard (Art. 3). The Directive does not say how those references should now be read.
What the rule does not say
Worth knowing
The Directive does not cover any restaurant, gym, shop or office simply for being one, and it does not mention residential blocks. Nor does it say how often staff are trained (it speaks of "actividades formativas periódicas", periodic training activities) or how often emergency exits are checked to be clear: it asks the plan to provide for that check (section 2.2.3(l)). And premises being outside Annex I does not mean nobody can ask them for a plan: their region or their town council can (sections 1.4 and 2.3.4).
Nor is a protocol you draw up on your own using the Annex II format a self-protection plan: the Directive allows it, but says it does not count as a plan "a los efectos normativos de esta Directriz Básica de Autoprotección" (for the regulatory purposes of this Basic Self-Protection Directive) (Annex I, 2.F).
Frequently asked questions
When is a self-protection plan mandatory in Spain?
When the activity is in Annex I of the Basic Self-Protection Directive, in force since 11 October 2026, or when your region or your town council requires it. For a business with premises, the most common national thresholds are public entertainment and recreational activities with a capacity of 1,000 people or an evacuation height of 28 m, care homes with 100 places and educational centres with 50 people who cannot evacuate on their own.
Is Royal Decree 393/2007 still in force?
No. Royal Decree 524/2023 repealed it with effect from 11 July 2023, but its Basic Standard went on applying until there was an instrument to replace it. That instrument is the Basic Self-Protection Directive, published by Order INT/1068/2026 in the BOE of 10 October 2026: Royal Decree 393/2007 ceased to apply on publication and the Directive takes effect from the 11th.
Does a hotel need a self-protection plan?
Under the national rule, since 11 October 2026 Annex I no longer covers public residential use in general, only care homes and day centres for older or disabled people with 100 places or more; before, it applied from 28 m of evacuation height or 2,000 people. But your region may require it: the Valencian decree includes hotels with a capacity of 100 people or more.
How often must a drill be held?
At least once a year, or at the shorter interval set by the plan itself, with its results assessed (section 2.5.2 of the Directive). The owner must notify civil protection that it has been held within the deadline each authority sets. In Catalonia, Decret 30/2015 also requires drills at least yearly, except for temporary activities.
How often is the self-protection plan reviewed?
At least every five years, unless a sector rule asks for less, and it must always be kept up to date (section 2.6 of the Directive). Under Royal Decree 393/2007 the maximum was three years. Some regions set their own: Catalonia, at least every four years and whenever there is a substantial change. Plans that already existed have four years to adapt to the Directive.
Who can draw up the self-protection plan?
It is drafted and signed by a technician qualified to assess the risks of the activity, and countersigned by the owner or their representative (section 2.2.3(c) of the Directive). The requirements to accredit that technician are set by the competent civil protection bodies, local, regional or national as the case may be. The owner approves the plan and notifies the authorities so it can be entered in the register of plans.
Where it usually applies
- GymsA gym: no national law; qualifications, insurance and notices under each region's sports professions act, plus low voltage, Legionella, pool, RIPCI and defibrillator as premises.
- HotelsA hotel: guest register and reporting within 24 hours, regional classification, low voltage and lift as a public-assembly venue, RIPCI, Legionella, pool, kitchen and defibrillator.
- Shops and franchisesA shop: responsible declaration up to 750 m², opening hours, prices, franchises with no register since 2018, complaint forms, accessibility adjustments and the inspections of premises open to the public.
- OfficesThe obligations of an office in Spain: temperature and upkeep of the premises, screen work, health and safety, coordination with contractors, internal reporting channel, right to disconnect and building checks.
- SchoolsA school: minimum facilities, protocols against violence and a wellbeing coordinator, canteen and menus from April 2026, self-protection and the building inspections.
- Industrial unitsAn industrial unit: fire inspection every five years under the 2025 regulation, chemical storage (APQ), air receivers, work equipment, low voltage, cooling towers and self-protection.
Other mandatory inspections
- Fire protection (RIPCI)RIPCI checks: quarterly by the owner, yearly and five-yearly by the maintenance company, records kept for five years and an inspection every ten years, with its exemptions.
- Low-voltage inspectionInspection by an accredited body every 5 years for the premises in ITC-BT-05 (bars, restaurants and hotels always) and every 10 years for residential common areas over 100 kW.
- Thermal installations (RITE)Maintenance company from 5 kW; contract, annual certificate and efficiency inspection every 4 years above 70 kW, with the minimum intervals of table 3.1.
- LegionellaWhat Royal Decree 487/2022 requires of the holder of business premises: a control plan, hot water temperatures, yearly disinfection, Legionella sampling and records kept for five years.
- Lift inspectionWhat ITC AEM 1 (Royal Decree 355/2024) requires of a lift's holder: a contract with a lift maintenance company, monthly servicing, a periodic inspection every 2, 4 or 6 years and deadlines for defects.
- Swimming poolsWhat Royal Decree 742/2013 requires by type of pool: self-monitoring, daily and monthly checks, information for users and incidents, and what it leaves to the autonomous communities.
- HACCP (APPCC)What Article 5 of Regulation 852/2004 requires of a bar, a restaurant or an institutional kitchen in Spain: the seven principles, the records, the flexibility and what is no longer in force.
- Defibrillator (AED)What the Spanish national rule on defibrillators requires, and who must have one in Madrid, Catalonia, Andalusia and the Basque Country, with each threshold and article.