The blackout: legal challenges for a power system under strain
The massive power outage that paralyzed Spain and Portugal on April 28 not only left millions of citizens without supply. It also opened a technical and legal debate about responsibility in an increasingly interconnected, digitalized, and regulation-dependent system
by mercedes galán
Experts: Antonio Morales, partner at Baker McKenzie; Hermenegildo Altozano, partner at Pinsent Masons; Borja Carvajal, partner at Gómez-Acebo & Pombo (GA_P)
On April 28, 2025, Spain experienced what is already known as the largest power outage in recent decades. At midday, train stations, hospitals, data centers, and homes across the country were left without supply for hours, causing the collapse of essential services and economic losses that are still difficult to quantify. What began as a technical failure of uncertain scope has revealed a legal and structural reality: the Spanish electricity system, complex and fragmented, must face risks that do not always find a clear answer in the current legal frameworks.
A CAUSE STILL UNDER DISPUTE
In the first hours after the event, Red Eléctrica Española (REE)—system operator and responsible for high-voltage transmission— pointed to a failure in the automated control software, possibly worsened by a cyber intrusion of European origin. The lack of concrete information has fueled a crossfire of responsibilities between operators, distributors, marketers, and the Administration itself.
For Antonio Morales, partner at Baker McKenzie, the legal framework allows the attribution of responsibilities, but the difficulty lies in identifying the real causes of the incident “The attribution of responsibilities in a phenomenon like the one experienced is possible according to our regulatory framework and its avenues of claims both in civil and administrative courts. However, the difficult part in this case is identifying the causes that originated it and, therefore, the responsible parties”. The first thing, as Morales points out, “is to determine whether the blackout was caused by human error, technical failure, or force majeure”. Once the cause is identified, it will be possible to assess whether there is a responsible party—public or private—and which claims avenues apply according to their ownership. These may include actions against Red Eléctrica as system operator or against Public Administrations involved, either by direct action or by lack of adequate supervision, he concludes.
SYSTEMIC RISKS AND INSUFFICIENT FRAMEWORKS
Beyond the possible impact on individual consumers, the blackout brings to the table a deeper issue: the adequacy of the regulatory framework in the face of systemic risks such as cyberattacks, automation failures, or extreme weather events.
