Digitalization continues to gain ground among Spanish SMBs, which account for two-thirds of the country’s employment and GDP. Although they still face significant structural challenges and must take their commitment to technology as a pathway to competitiveness seriously. This is reflected in Gigas’s “Barometer of Spanish SME Digitalization,” which analyzes the adoption of cloud, cybersecurity, and artificial intelligence as the key axes of efficiency.
From the data, it can be said that the SME fabric is in full transition. The report shows that technology is increasingly perceived as an investment rather than a cost. Nearly 40% of companies already detect a favorable economic impact from digitalization, and more than 60% believe that the use of the cloud and digital services generates efficiencies. In this sense, AI is gaining ground, the cloud is consolidating as essential infrastructure, and cybersecurity is entering the corporate agenda.
However, the challenge now for SMBs is to move from the phase of testing with basic and even free tools in areas of little strategic importance to investing in higher‑level solutions that improve not only ancillary, low‑value activities but also critical processes.
Yet there is an initial contradiction to overcome. The report reveals a gap between perception and reality among SMB managers. And while 79% of surveyed companies believe they have a medium or high level of digitalization, only 9% actually demonstrate solid adoption of AI, cloud, and cybersecurity.
Cloud gains ground, but the physical server remains very present
After a decade of cloud expansion, adoption among Spanish SMBs is widespread. Two out of three companies use it. And 46% say they will migrate processes to the cloud in the next six months, driven by the need to gain flexibility, efficiency, and real‑time data access. Moreover, for 63% of companies the cloud equals economic efficiency. But the nuances start there. The cloud today mainly serves Spanish SMBs for basic functions such as email, word processing, or backups. Yet very few companies make advanced, structural use of the cloud. And many fundamental processes remain in the cloud only very modestly: ERP (in only 9% of companies), human resources (11%), CRM (12%), customer databases (22%), and accounting and invoicing (23%).
Additionally, despite the cloud’s popularization, the physical server remains very present and continues to play a leading role in many organizations: 52% of SMBs maintain local storage systems in their offices, often believing that this makes data safer and more controllable. In the small‑business segment (10 to 49 employees), almost 70% of companies opt for physical servers. The myth of the “secure server” persists, when experience shows that the cloud is the only real bunker.
On the other hand, when choosing a cloud provider, the primary reason for SMBs to make a decision is by far the price‑performance ratio. At the expense of important aspects such as technical support, regulatory compliance, or the existence of a transparent pricing model.
Contradictions also arise when Gigas’s Barometer of Spanish SME Digitalization asks about data sovereignty, a key consideration in today’s volatile geopolitical climate. Thus, the majority of companies (56%) consider it important to have data hosted on European soil. Yet more than 60% of surveyed companies don’t know where their cloud‑stored information is stored, and 88% say they feel secure with their cloud provider in any case.
Ipsos’s study for Gigas probes the brakes SMBs face in deepening their cloud commitment. Interestingly, despite the high security levels that cloud providers display, the first obstacle cited is concern about data security (23%). Other brakes include the cost of services and the lack of perceived need to move more processes to the cloud. The survey also asks about cloud spending by Spanish SMBs and confirms that investments are modest: 43% say they spend less than €1,000 per year, while another 18% say they spend between €1,000 and €5,000. And only 1% of SMBs report spending more than €20,000 per year in this category.
Cybersecurity: protection still too basic despite the risks
In cybersecurity terms, Ipsos’s study for Gigas shows that the level of awareness among SMBs is high, although the maturity level remains limited. 78% of the 1,300 small and medium-sized companies surveyed report having some form of protection, but in most cases it is basic solutions such as antivirus, standard firewalls, or backups. And it’s widely known that antivirus alone is no longer enough against cybercrime and a layered, more preventive than reactive security approach is needed. In a landscape where threats proliferate, it’s notable that only 30% of SMBs have gone further and invested in advanced systems such as EDR, next‑generation firewalls, certifications (like ISO 27001 or ENS), or cyber risk insurance.
Nevertheless, the risk is real, as the Gigas Barometer shows. If a few years ago cybercriminals targeted large companies, now any organization, of any size, can be the target of ransomware, phishing scams, or a website compromise due to a denial‑of‑service (DDoS) attack. Thus, 8% of the companies surveyed for this study report having suffered a cyberattack in the past year, a figure that rises for medium‑sized companies (up to 21%).
SMBs’ investment in cybersecurity remains very limited. Nearly half allocate less than €500 per year for protection. And another 18% invest between €500 and €2,000. Among the main brakes to investing more in advanced cybersecurity technologies are the perception that costs are high and the genuine lack of awareness of the risks they face.
Artificial intelligence: widespread adoption of free solutions, but a lack of strategy
Artificial intelligence, in its generative form, is the technology that has become the fastest to popularize in history. And Spanish SMBs are no exception to this trend. The Barometer commissioned by Gigas reveals that today 36% of Spanish SMBs use AI‑based tools. But budgets and vision still weigh in. Most (a little more than half) opt primarily for free versions, signaling a tactical, fragmented approach rather than a holistic, businesswide AI integration. The sentiment of “playing with ChatGPT” persists over a real integration of AI into business processes. However, as firms grow, they also increase their use of paid versions and corporate licenses. Thus, among medium‑sized companies, premium solutions are the majority choice. In microbusinesses, only 19% are willing to pay.
In this scenario, the AI tool most used by Spanish SMBs is, by far, ChatGPT (72%), followed by Google Gemini (43%) and Microsoft Copilot (23%). Behind them are tools embedded in management software or in custom, in‑house developments. Regarding AI uses in SMBs, the leading application is document management and word processing (46%), followed by data analytics for decision‑making (41%) and marketing and sales management (38%). In fourth place is customer support via chatbots and assistants (34%).
Nevertheless, SMBs’ expectations for AI are high. Almost six in ten companies expect to improve productivity and efficiency thanks to this technology, and 35% plan to invest or increase investment in the next 12 months. Among those not yet using it, the main barrier is not cost or security, but the lack of a clear AI application in daily activity. By company size, micro‑enterprises (1–9 employees) are the most reluctant to invest in AI solutions.
