Self-protection plan

Scope and obligations

Annex I of the Basic Self-Protection Standard lists the activities subject to mandatory regulations. Among those with specific sectoral regulations are establishments handling hazardous substances (major accidents), activities involving explosives, hazardous waste management, mining operations, facilities with genetically modified organisms or biological agents, tunnels, commercial ports, airports, nuclear and radioactive installations, dams, and public events with a capacity of 2,000 people or more indoors or 20,000 outdoors. Those establishments without specific regulations include industrial facilities with a high fire load , healthcare facilities with 200 or more beds, educational centers with an occupancy of 2,000 people or more or an evacuation height of 28 meters or more, residential centers for dependent persons with 100 or more occupants, and commercial and public establishments with an occupancy of 2,000 people or more or an evacuation height of 28 meters or more. Autonomous communities may expand this list in their own regulations.

The operator of the activity is responsible for developing, implementing, maintaining, and reviewing the plan; submitting it to the relevant authority for registration; informing civil protection agencies; cooperating with the authorities; and designating the person responsible for managing emergency response, who must have the authority and capacity to handle the emergency. The plan must be prepared by a qualified technician trained to assess the aspects it covers, and its contents must be known by all personnel, who must also receive the necessary training and participate in drills to ensure its effectiveness.

Law 17/2015, of the National Civil Protection System, and the Basic Civil Protection Standard approved by Royal Decree 524/2023 establish the framework in which self-protection plans are integrated with the territorial and special plans of the administrations, and reinforce the self-protection obligation of the owners of centers and facilities that may generate risk situations.

Minimum content of the plan (Annex II)

• Chapter 1. Identification of the owners and the location of the activity.
• Chapter 2. Detailed description of the activity and the physical environment in which it takes place: facilities, surroundings, access and occupancy.
• Chapter 3. Inventory, analysis and evaluation of the risks inherent to the activity and of external risks that may affect it.
• Chapter 4. Inventory and description of self-protection measures and means: protection facilities, human and material resources.
• Chapter 5. Maintenance program for the facilities, both those at risk and those for protection.
• Chapter 6. Emergency action plan: classification of emergencies, action procedures, emergency equipment, identification of the person in charge and coordination with external help.
• Chapter 7. Integration of the plan into other higher-level plans: notification protocols and collaboration with civil protection.
• Chapter 8. Implementation: responsible party, training and information program, signage and equipment provision program.
• Chapter 9. Maintaining effectiveness and updating: training retraining program, replacement of equipment, drills, review and audits.
• Annexes. Communication directory, emergency management forms and plans.

Implementation, drills and review

• Implementation. Designation of the person in charge, training of emergency teams, information to all staff and users, signage and verification of resources.
• Drills. At least one per year, with documented evaluation of the results and necessary improvements.
• Review. Complete review of the plan at least every three years and update in response to changes in activity, facilities, occupancy or regulations.
• Registration. Communication of the data in Annex IV to the competent administration and updating of the registration.
• Coordination. Notification and collaboration protocols with public emergency services and civil protection plans.
• Documentation. Preservation of training records, drills, maintenance and inspections available to the authorities.
• Relationship with prevention. Integration with risk assessment, emergency measures of article 20 of Law 31/1995 and coordination of business activities.

Organizational application: how to develop and implement the self-protection plan

1. Determine whether the activity is included in Annex I of the Basic Self-Protection Standard or in the regional catalog and, if not, whether it is appropriate to prepare it voluntarily or limit oneself to the emergency measures of Article 20 of Law 31/1995.
2. Entrust the preparation to a competent technician and collect the information: ownership, description of the activity and the environment, facilities, occupancy, resources and internal and external risks.
3. Draft the plan with the nine chapters and annexes, with clear operating procedures, defined emergency teams and a designated person in charge.
4. Communicate the plan to the competent administration for its registration and integrate it with the civil protection plans.
5. Implement the plan: train the teams, inform the staff and users, put up signs, check the equipment and coordinate with external services.
6. Conduct at least one annual drill, evaluate it and correct any deficiencies; maintain the facilities according to the program.
7. Review the plan at least every three years and in the event of any relevant changes, and keep the records.

Preventive management software allows you to manage the self-protection plan as a living document: teams and those responsible, training, maintenance program, planning and evaluation of drills, reviews and records, with traceability and integration with risk assessment and coordination of business activities.

Limits and common mistakes

1. Confusing the self-protection plan with the emergency measures of article 20 of Law 31/1995, which are mandatory for all companies but have different scope and requirements.
2. Develop the plan as a formal document without implementing it: without team training, without drills, and without verifying the resources.
3. Do not communicate the plan to the administrative registry or coordinate it with civil protection.
4. Failure to update the plan after changes in activity, facilities or occupancy, or letting the review period pass.
5. Appointing an emergency manager without authority or real management capacity.
6. Ignoring regional regulations, which may expand the list of mandatory activities and requirements.

The specific requirements are set out in Royal Decree 393/2007 and in the regional self-protection regulations; this sheet is for informational purposes.

Regulatory and reference framework

• Royal Decree 393/2007, of March 23. Basic Self-Protection Standard for centers, establishments and premises dedicated to activities that may give rise to emergency situations.
• Law 17/2015, of July 9. National Civil Protection System; duty of self-protection and integration of plans.
• Royal Decree 524/2023, of June 20. Basic Civil Protection Standard.
• Law 31/1995, of November 8. Law on Prevention of Occupational Risks; emergency measures (article 20).
• Royal Decree 171/2004, of January 30. Coordination of business activities; information on emergency measures between competing companies.
• Royal Decree 164/2025, of March 4. Fire safety regulations in industrial establishments; protection installations that the plan would inventory and maintain.

The autonomous communities have approved their own self-protection regulations that can expand the catalog of activities and registration requirements, and the Technical Building Code and the Regulation of fire protection installations regulate the installations that the plan must maintain.