The Iberian blackout showed how quickly mobile networks can follow the power grid down.

On 28 April 2025, at 12:33 CEST, the largest stress test of telecom infrastructure in modern European memory unfolded in less than three hours. A cascading collapse of the Iberian power grid severed mains electricity to virtually all of mainland Spain and Portugal, forcing mobile sites onto battery and generator backups and triggering a near-synchronous collapse of mobile coverage across the peninsula. By the late evening, more than half of mobile users in large parts of Spain and over 60% in the worst-affected areas of Portugal had no service at all.

Twelve months on, the Iberian regulatory and operator response has not converged. Spain has drafted Europe’s most ambitious telecom autonomy rule but has not enacted it. Portugal’s parliament published cross-party recommendations on the anniversary week. And operators, in the meantime, have made the most concrete commitments of all.

Key Takeaways:

• Spain has drafted, but not enacted, the EU’s most ambitious telecom autonomy rule. The 24/12/4-hour tiered draft Royal Decree, with an 85% population coverage target including 112 calls, remained at consultation stage on the anniversary, twelve months after the blackout.
  
• Portugal’s response is broader. ANACOM has recommended minimum autonomy for network elements, Cell Broadcast, satellite redundancy, and real-time network visibility, while the government has paired telecom recommendations with electricity and critical-infrastructure measures.
  
• Operator investment is now part of the policy equation, from Vodafone’s Enhanced Power program to MEO/Altice route-diversity projects. Our data showed that these are the right investment targets; operators with wider or deeper backup-power layers flattened and delayed the outage curve (e.g., MEO), while thinner autonomy produced fast, severe loss of service (e.g., DIGI).
  
• Satellite has emerged as a working fallback layer in Iberia, not a theory. Starlink rerouted Spanish gateways through Madrid, London and Milan during the blackout itself, and Portuguese user activity ran roughly 196% above baseline during Storm Kristin in February 2026. This strengthens the case for LEO satellite in emergency kits, government continuity plans, and remote-site backup, but it is not a panacea on its own.

Spain has drafted, but not enacted, the EU’s most ambitious telecom autonomy rule

Spain has gone furthest toward converting the blackout into explicit telecom rules. In December 2025, the Ministry for Digital Transformation opened consultation on a draft Royal Decree on the security and resilience of electronic communications networks and digital infrastructure. The draft classifies telecom networks and selected digital infrastructure as essential in emergencies and applies to telecom operators as well as certain submarine cable, satellite, data center, and internet exchange assets.

The most important shift is that resilience is specified in hours. First-level infrastructure would need at least 24 hours of operation during a power interruption, intermediate sites at least 12 hours, and other sites four hours. For mobile networks, the four-hour requirement must maintain coverage for 85% of the population, with operators able to prioritize voice over data or critical services over higher-capacity layers. The decree also strengthens 112, public-alert, incident-reporting, and coordination obligations.

This is notably sharper than a generic critical-infrastructure designation. It forces operators to classify sites, power paths, and services before the crisis. It also surfaces implementation questions around rooftop weight limits, generator fuel logistics, RAN sharing, and rural refueling. The CNMC’s formal opinion on 12 March 2026 recommended progressive rollout, prioritizing “cost-efficient solutions like inter-network roaming and satellite backup,” and full alignment with NIS2.

Both observations cut to the heart of a regulatory landscape Spain itself has not finalized: the country has not transposed NIS2 (EU cyber-resilience law for essential sectors) and was one of 19 member states to receive a Commission reasoned opinion on 7 May 2025. The cost gap between the government’s €73 million (US$85 million) estimate and operator estimates closer to €300 million (US$351 million) for power hardening has not narrowed. Public consultation closed on 8 January 2026 but, as of the anniversary, the decree had not been promulgated. Energy Minister Sara Aagesen, appearing before the Senate on 23 March 2026, was still asking power companies to publish the underlying outage data.

Portugal’s parliament has set a more operational and structural agenda

Portugal’s response has been less prescriptive at the telecom-site level, but broader across emergency systems. A government summary of the ANACOM blackout report said the prolonged power failure cascaded across fixed and mobile networks, affected 112 access, and constrained emergency communications.

The regulator’s own published recommendations reframed resilience as an operational checklist: minimum autonomy times for batteries and generators, renewable extensions at cell sites, restricted SIM/eSIM access for authorities, 112 routing diversification, and an evolution of public warnings towards Cell Broadcast (the standardized 4G/5G capability to push warning messages to all phones in a defined cell area without an app or sign-up).

The Cell Broadcast recommendation is important. Unlike SMS, Cell Broadcast sends one-to-many alert messages to compatible phones in a targeted radio area, making it better suited to fast public warnings and less exposed to congestion. It still needs powered cell sites, but it is a better emergency-warning tool than individual SMS once networks degrade.

The most consequential update in Portugal, however, came in the anniversary week itself. The cross-party parliamentary working group led by PSD deputy Paulo Moniz published its final report on 23 April 2026, recommending 72 hours of energy autonomy at hospitals, primary health centers, nursing homes and emergency services; 24 hours at all other critical infrastructure; the formal classification of food retailers and pharmacies as critical; and, most pointedly for telecoms, a national emergency alert system independent of commercial mobile networks. The structural separation of public-safety communications from operator-controlled infrastructure is the most ambitious year-two recommendation in either country.

Portugal also had a real-world second test. Between late January and February 2026, Storms Kristin, Leonardo and Marta cut median mobile download speeds by 52% at peak in Speedtest data, with around 40% of telecom failures linked back to electricity loss at mobile sites. ANACOM activated national roaming and Starlink user activity surged ~196% above baseline based on our analysis (with authorities also deploying LEO terminals to remote areas). The episode did not so much reopen Portugal’s policy debate as confirm it.

Operators have outrun both governments

The most concrete Iberian telecom resilience commitments of the past year have come from operators rather than regulators. Vodafone Group’s Enhanced Power initiative, announced on 28 November 2025 with Portugal as its first deployment region, will reinforce more than 10,000 critical sites Europe-wide. Tier specifications include 72 hours of backup or guaranteed refueling within 48 hours at more than 400 mobile data centers, and four hours at aggregation and critical access sites. The initiative is supported by an AI-controlled adaptive power-backup function already live in Greece and in trial in Turkey, which the company says nearly doubles base-station battery duration in certain scenarios.

The day of the blackout itself drew the operator distinction more sharply than any policy document could. MEO’s network peaked at just over 16% of subscribers without service, the best performance observed across either country, because deeper, more widely deployed power reserves materially flattened and delayed its outage curve. NOS peaked at around 30%; Vodafone Portugal at nearly 70%. DIGI’s still-nascent network exhibited a near step-function collapse, with up to 90% of subscribers without coverage for more than a day, pointing to gaps in core network geo-redundancy as well as site-level backup.

Building on this, more recently, Portuguese reporting highlighted MEO’s expansion of its Linda-a-Velha network center and a new Porto landing station intended to improve transatlantic route redundancy. Cellnex, Spain’s tower incumbent and a named addressee of the country’s draft decree, meanwhile reported an integrated approach to UPS, generators and battery banks across more than 120,000 sites in 10 countries, although per-site backup-hour disclosures remain opaque.

Next steps: convert resilience scaffolding into rules

The Iberian blackout exposed three layers of telecom exposure simultaneously: power autonomy at the access network, cross-border interconnection at both energy and transport layers, and the dependence of upstream services on landing stations and gateways that are themselves geographically concentrated. Year one has produced movement on all three, but unevenly.

The European Commission’s proposed Digital Networks Act may help by simplifying rules, supporting satellite services, and improving security cooperation. It will not, by itself, set a uniform backup-power floor for mobile sites. Iberia’s lesson is that national implementation still matters.

Spain has the draft, but a draft is not a rule. Promulgating the December 2025 Royal Decree, or phasing it in along the progressive lines the CNMC has suggested, is the single highest-leverage regulatory move available to either Iberian government in the next twelve months. Portugal’s parliamentary recommendations need to translate from cross-party report to executive action; the proposed national emergency alert channel that does not depend on commercial mobile networks is the most structurally significant call in either country, and would change how public-safety messaging routes through Iberian telecom infrastructure in a future event.

Operators will keep moving voluntarily. But the next phase of resilience policy in Iberia will only be tractable if disclosure quality improves to make per-site backup-hour benchmarking comparable across networks. The same lesson is being drawn in markets that have faced very different stress tests: our analysis of Cyclone Alfred’s impact on Queensland networks reaches the same conclusion from the opposite hemisphere. What gets measured, gets hardened.