{"id":14944,"date":"2026-07-08T14:26:20","date_gmt":"2026-07-08T12:26:20","guid":{"rendered":"https:\/\/www.gentile.law\/?p=14944"},"modified":"2026-07-08T14:26:20","modified_gmt":"2026-07-08T12:26:20","slug":"liability-of-directors-in-spanish-companies-common-risks-in-2026","status":"publish","type":"post","link":"https:\/\/www.gentile.law\/en\/liability-of-directors-in-spanish-companies-common-risks-in-2026\/","title":{"rendered":"Liability of Directors in Spanish Companies: Common Risks in 2026"},"content":{"rendered":"\n

Published: July 8 <\/strong>, 2026<\/p>\n\n

I. Being a manager in 2026: a personal management risk<\/strong><\/h2>\n\n

Serving as a director of a Spanish company no longer exposes one to liability only in cases of obvious fraud. Liability arises more frequently when the director cannot demonstrate that he or she monitored the relevant risks, made decisions based on adequate information, and took action within the legal timeframes. Due diligence in 2026 takes on an evidentiary dimension: it must be objectively and verifiably demonstrated. <\/p>\n\n

The Capital Companies Act (hereinafter,\u201cLSC\u201d<\/strong>) bases the liability of directors on two duties: (i) the duty of care, which requires dedication to the position, adequate disclosure, and an organizational structure suitable for management, [1]<\/a> and (ii) the duty of loyalty, which requires acting in good faith and in the best interests of the company.[2]<\/a><\/p>\n\n

Since the reform introduced by Law 31\/2014, business decisions made in good faith, without personal interest, based on sufficient information[3]<\/a>, and in accordance with an appropriate procedure are protected by thebusiness judgment rule<\/em>.[4]<\/a> In this context, it should be emphasized that documentation is key evidence for establishing these requirements. Anyone who makes a sound decision but fails to document how they reached it effectively forgoes their best defense. <\/p>\n\n

II. The Key Distinction: Liability for Damages vs. Liability for Debts<\/strong><\/h2>\n\n

On that basis, we must distinguish between two systems that are often confused in practice because they require very different types of evidence.<\/p>\n\n

Liability for damages requires <\/strong>proof of unlawful conduct, negligence or willful misconduct, damage, and a causal link.[5]<\/a> Therefore, mere nonpayment resulting from the company\u2019s insolvency does not automatically constitute direct damage attributable to the director: a link to the director\u2019s conduct must be proven.<\/p>\n\n

Liability for debts is <\/strong>based on essentially objective criteria: if a legal ground for dissolution exists and the manager fails to act within the prescribed time limit, the manager is jointly and severally liable for subsequent corporate obligations, without the need to prove intent, specific fault, or actual damage.[6]<\/a><\/p>\n\n

Both legal frameworks can be applied concurrently, although they do not result in double punishment for the same offense. This distinction determines what each party must prove and explains why the first risk on this list occurs almost automatically. <\/p>\n\n

III. Common Risks<\/strong><\/h2>\n\n
    \n
  1. Proceeding with a dissolution case without activating the corporate protocol<\/strong><\/li>\n<\/ol>\n\n

    If a legal ground for dissolution exists,[7]<\/a> the manager must call a General Meeting within two (2) months so that the meeting may approve the dissolution or remedy the cause by increasing or reducing the capital or through contributions from members. If the administrator fails to do so, he or she is jointly and severally liable for the company\u2019s obligations arising after the cause occurred. [8]<\/a><\/p>\n\n

    Two nuances that often go unnoticed: what matters is when the obligation arises, not when it expires, and liability is limited to the period of service, not extending to obligations that arise after leaving office.<\/p>\n\n

    To determine whether a company is subject to dissolution due to losses\u2014net worth below half of its share capital\u2014 the so-called \u201ccorporate moratorium\u201d allows, on an exceptional basis, for the losses from 2020 and 2021 not to be taken into account until the end of the fiscal year beginning in 2026.[9]<\/a> For companies whose fiscal year coincides with the calendar year, this exclusion applies to financial statements closed as of December 31, 2026; starting with the fiscal year beginning in 2027, those losses will be included again, unless the provision is extended once more. As a result, a company that is currently considered financially sound\u2014precisely because it is not carrying forward losses from 2020 and 2021\u2014may become subject to dissolution from one fiscal year to the next\u2014without any recent deterioration in its business\u2014simply because the moratorium has ended. <\/p>\n\n

      \n
    1. Insolvency, Restructuring, and Bankruptcy Proceedings<\/strong><\/li>\n<\/ol>\n\n

      A second area of liability is delayed handling of insolvency. The administrator must have an internal system\u2014even if it is basic\u2014to detect current or imminent illiquidity and to document when it is detected and what measures are being considered. The law presumes willful misconduct or gross negligence when the duty to file for insolvency proceedings is breached within two (2) months of the date on which the insolvency was known or should have been known; evidence to the contrary is admissible, but the burden of proof is initially unfavorable to the administrator. [10]<\/a><\/p>\n\n

      A finding of culpability does not automatically result in an order to cover the bankruptcy deficit:[11]<\/a> the conduct must have caused or exacerbated the insolvency, and case law allocates liability among the various directors based on their respective roles in the omission. When the position of director is held by another corporation, the Supreme Court (hereinafter, the\u201cSC\u201d<\/strong>) clarified in its ruling 114\/2026 this year that the natural person representing the corporate director may be subject to the finding of culpability and be jointly and severally liable for the deficit, although not all consequences are transferred identically from the represented entity to the representative.[12]<\/a> <\/p>\n\n

      At the European level, Directive (EU) 2026\/799 harmonizes, for the first time, the obligation to file for the opening of insolvency proceedings within a maximum of three months. Its transposition is not due until January 2029, so it is not yet enforceable in Spain, but it serves as an indicator of the direction European law is taking in this area. <\/p>\n\n

        \n
      1. De facto manager and de jure manager<\/strong><\/li>\n<\/ol>\n\n

        The existence of a de facto administrator\u2014that is, someone who performs management functions without formally holding the position\u2014does not exonerate the de jure administrator: tolerating such a functional substitution is typically interpreted as a dereliction of duty or a lack of oversight. During the insolvency classification hearing\u2014the phase of the insolvency proceedings in which it is determined whether the conduct was accidental or culpable, with personal consequences for the legal administrator\u2014the legal administrator is held liable unless he or she can prove a genuine lack of autonomy vis-\u00e0-vis the de facto manager, and is liable for legal violations specific to the position even if there is a hidden de facto administrator. <\/p>\n\n

          \n
        1. Conflicts of Interest and the Duty of Loyalty<\/strong><\/li>\n<\/ol>\n\n

          After insolvency, conflicts of interest are likely the most common source of litigation and, at the same time, one of the most underestimated risks because they do not herald their arrival with a visible financial crisis. Article 229 of the Spanish Companies Act (LSC) specifies the duty of loyalty in terms of specific obligations: (i) not to engage in transactions with the company except under market conditions, (ii) not to use company assets for private purposes, (iii) not to take advantage of the company\u2019s business opportunities, (iv) not to obtain benefits from third parties in connection with one\u2019s position, and (v) not to compete with the company. This regime also extends to indirect conflicts involving persons related to the director. [13]<\/a><\/p>\n\n

          A fact that may surprise those coming from other jurisdictions: this regime is mandatory and cannot be limited by statute, except for the exemptions permitted by the law itself.[14]<\/a> A violation of this regime allows for the joinder of a claim for damages and a claim for restitution of unjust enrichment.<\/p>\n\n

            \n
          1. Accounting and the filing of financial statements as evidence<\/strong><\/li>\n<\/ol>\n\n

            Its significance lies not in its legal complexity, but in how easily it can be committed due to administrative negligence. In insolvency proceedings, fraud or gross negligence is presumed\u2014unless proven otherwise\u2014when the annual financial statements for any of the three fiscal years preceding the declaration of insolvency have not been prepared, audited, or filed.[15]<\/a> Outside of insolvency proceedings, failure to file the financial statements is treated in judicial practice as an indication of \u201cqualified losses\u201d and may shift the burden of proof to the administrator. A low-cost formal obligation with a disproportionate evidentiary effect. <\/p>\n\n

              \n
            1. Tax Liability of the Administrator<\/strong><\/li>\n<\/ol>\n\n

              Article 43.1.a) of the General Tax Law provides for the subsidiary liability[16]<\/a> of directors, whether de facto or de jure, of companies that have committed tax violations, when they failed to perform the acts within their purview, condoned noncompliance by their subordinates, or adopted resolutions that enabled the violation. This liability has a punitive component: it cannot be imposed merely by virtue of holding the position; the burden of proving culpable conduct rests with the Administration; and the imposition of liability must be individually justified by specifying which specific omissions warrant it. <\/p>\n\n

                \n
              1. Criminal Liability and Compliance<\/strong><\/li>\n<\/ol>\n\n

                The criminal liability of a director operates on two levels: for their own acts and, more controversially, for omissions regarding the acts of third parties within the organization, which is triggered only when there is a position of guarantor\u2014a genuine legal duty of oversight\u2014and the actual ability to prevent the outcome. In the case of board members, mere membership on the board of directors is not usually sufficient to establish liability by omission for a crime committed by another director, unless there was a specific duty of oversight or clear indications of wrongdoing. <\/p>\n\n

                The criminal liability of the company itself is a different matter,[17]<\/a> which requires proof not only of a crime committed for the benefit of the entity but also of a serious organizational failure in its prevention and oversight mechanisms. The absence of an adequate compliance program does not in itself give rise to criminal liability, but it eliminates the company\u2019s primary defense\u2014and, indirectly, that of the director who should have implemented it. <\/p>\n\n

                  \n
                1. Cross-Cutting Risks in 2026: Cybersecurity, AI, and ESG as Organizational Responsibilities<\/strong><\/li>\n<\/ol>\n\n

                  Cybersecurity<\/strong>. Directive (EU) 2022\/2555 (hereinafter, the\u201cNIS2 Directive\u201d<\/strong>) entered into force at the European level in January 2023, and Spain has not yet completed its transposition across the board: the bill remains under consideration in the Spanish Parliament, and the European Commission, following its reasoned opinion in 2025, issued a second formal notice in May 2026\u2014a preliminary step toward a potential lawsuit before the Court of Justice of the EU. <\/p>\n\n

                  The fact that the law has not been enacted does not put the risk on hold: although the directive does not, on its own, impose enforceable obligations on companies until it is transposed, it provides a framework from which to define the cybersecurity standard that incorporates the duty of care expected of responsible business owners in the affected sectors.[18]<\/a> The bill under consideration also provides for personal sanctions against directors\u2014including temporary disqualification\u2014for gross negligence in supervising these measures, along with specific and documented training for the board of directors.<\/p>\n\n

                  Artificial intelligence<\/strong>. The duty of care hardly justifies uncritical reliance on AI tools: it can be argued that it requires understanding and overseeing these systems, not delegating management, risk, and compliance decisions to them without oversight. <\/p>\n\n

                  ESG<\/strong>. Directive (EU) 2026\/470, part of the Omnibus Package, has significantly narrowed the scope of sustainability reporting: the new thresholds (more than 1,000 employees and 450 million euros in revenue) exclude most of the companies initially affected. For those that remain within the scope, the bar has been raised: the board of directors bears ultimate responsibility for the published sustainability information, in a manner analogous to annual financial statements. <\/p>\n\n

                  IV. Three Defensive Management Checkpoints<\/strong><\/h2>\n\n

                  None of these risks can be controlled in and of themselves. What is within the administrator\u2019s control, however, is the level of preparedness with which they are addressed: <\/p>\n\n