Self-protection plan

Scope and obligations

Annex I of the Basic Self-Protection Standard lists the activities subject to mandatory regulations. Among those with specific sectoral regulations are establishments handling hazardous substances (major accidents), activities involving explosives, hazardous waste management, mining operations, facilities with genetically modified organisms or biological agents, tunnels, commercial ports, airports, nuclear and radioactive installations, dams, and public events with a capacity of 2,000 people or more indoors or 20,000 outdoors. Those establishments without specific regulations include industrial facilities with a high fire load , healthcare facilities with 200 or more beds, educational centers with an occupancy of 2,000 people or more or an evacuation height of 28 meters or more, residential centers for dependent persons with 100 or more occupants, and commercial and public establishments with an occupancy of 2,000 people or more or an evacuation height of 28 meters or more. Autonomous communities may expand this list in their own regulations.

The operator of the activity is responsible for developing, implementing, maintaining, and reviewing the plan; submitting it to the relevant authority for registration; informing civil protection agencies; cooperating with the authorities; and designating the person responsible for managing emergency response, who must have the authority and capacity to handle the emergency. The plan must be prepared by a qualified technician trained to assess the aspects it covers, and its contents must be known by all personnel, who must also receive the necessary training and participate in drills to ensure its effectiveness.

Law 17/2015, of the National Civil Protection System, and the Basic Civil Protection Standard approved by Royal Decree 524/2023 establish the framework in which self-protection plans are integrated with the territorial and special plans of the administrations, and reinforce the self-protection obligation of the owners of centers and facilities that may generate risk situations.

Minimum content of the plan (Annex II)

• Chapter 1. Identification of the owners and the location of the activity.
• Chapter 2. Detailed description of the activity and the physical environment in which it takes place: facilities, surroundings, access and occupancy.
• Chapter 3. Inventory, analysis and evaluation of the risks inherent to the activity and of external risks that may affect it.
• Chapter 4. Inventory and description of self-protection measures and means: protection facilities, human and material resources.
• Chapter 5. Maintenance program for the facilities, both those at risk and those for protection.
• Chapter 6. Emergency action plan: classification of emergencies, action procedures, emergency equipment, identification of the person in charge and coordination with external help.
• Chapter 7. Integration of the plan into other higher-level plans: notification protocols and collaboration with civil protection.
• Chapter 8. Implementation: responsible party, training and information program, signage and equipment provision program.
• Chapter 9. Maintaining effectiveness and updating: training retraining program, replacement of equipment, drills, review and audits.
• Annexes. Communication directory, emergency management forms and plans.

Implementation, drills and review

• Implementation. Designation of the person in charge, training of emergency teams, information to all staff and users, signage and verification of resources.
• Drills. At least one per year, with documented evaluation of the results and necessary improvements.
• Review. Keep the plan up to date and review it at intervals not exceeding five years under section 2.6 of the 2026 Guideline, unless a shorter applicable regional or sector-specific interval governs. Relevant changes require checking and updating the plan without waiting for the review cycle to expire.
• Registration. Submit and keep required register information current; its national minimum content is set out in Annex III of the 2026 Guideline, subject to the competent authority’s applicable procedure and arrangements.
• Coordination. Notification and collaboration protocols with public emergency services and civil protection plans.
• Documentation. Preservation of training records, drills, maintenance and inspections available to the authorities.
• Relationship with prevention. Integration with risk assessment, emergency measures of article 20 of Law 31/1995 and coordination of business activities.

Organizational application: how to develop and implement the self-protection plan

1. Determine whether the activity is included in Annex I of the Basic Self-Protection Standard or in the regional catalog and, if not, whether it is appropriate to prepare it voluntarily or limit oneself to the emergency measures of Article 20 of Law 31/1995.
2. Entrust the preparation to a competent technician and collect the information: ownership, description of the activity and the environment, facilities, occupancy, resources and internal and external risks.
3. Draft the plan with the nine chapters and annexes, with clear operating procedures, defined emergency teams and a designated person in charge.
4. Communicate the plan to the competent administration for its registration and integrate it with the civil protection plans.
5. Implement the plan: train the teams, inform the staff and users, put up signs, check the equipment and coordinate with external services.
6. Conduct at least one annual drill, evaluate it and correct any deficiencies; maintain the facilities according to the program.
7. Keep the plan up to date and review it at intervals not exceeding five years under section 2.6 of the 2026 Guideline, unless a shorter applicable regional or sector-specific interval governs. Relevant changes require checking and updating the plan without waiting for the review cycle to expire. Retain records of updates and reviews.

Preventive management software allows you to manage the self-protection plan as a living document: teams and those responsible, training, maintenance program, planning and evaluation of drills, reviews and records, with traceability and integration with risk assessment and coordination of business activities.

Limits and common mistakes

1. Confusing the self-protection plan with the emergency measures of article 20 of Law 31/1995, which are mandatory for all companies but have different scope and requirements.
2. Develop the plan as a formal document without implementing it: without team training, without drills, and without verifying the resources.
3. Do not communicate the plan to the administrative registry or coordinate it with civil protection.
4. Failure to update the plan after changes in activity, facilities or occupancy, or letting the review period pass.
5. Appointing an emergency manager without authority or real management capacity.
6. Ignoring regional regulations, which may expand the list of mandatory activities and requirements.

Requirements must be checked against the Guideline published through Order INT/1068/2026, its scope and adaptation provisions, and applicable regional and sector-specific rules. The agreement ended application of RD 393/2007 from publication on 10 October 2026 and took effect the following day. Section 2.6.3 gives plans already in force up to four years to adapt and separately addresses the filing period for previously licensed Annex I activities.

Regulatory and reference framework

• Spanish Official State Gazette. Order INT/1068/2026 of 7 October, publishing the Council of Ministers Agreement of 6 October 2026 and the Basic Self-Protection Planning Guideline. Published 10 October 2026; agreement effective 11 October 2026. Its scope and adaptation provisions must be considered.
• Law 17/2015, of July 9. National Civil Protection System; duty of self-protection and integration of plans.
• Royal Decree 524/2023, of June 20. Basic Civil Protection Standard.
• Law 31/1995, of November 8. Law on Prevention of Occupational Risks; emergency measures (article 20).
• Royal Decree 171/2004, of January 30. Coordination of business activities; information on emergency measures between competing companies.
• Royal Decree 164/2025, of March 4. Fire safety regulations in industrial establishments; protection installations that the plan would inventory and maintain.

The autonomous communities have approved their own self-protection regulations that can expand the catalog of activities and registration requirements, and the Technical Building Code and the Regulation of fire protection installations regulate the installations that the plan must maintain.