The riverside Asco plant experienced a leak in November, but plant operators did not detect it until March and then waited to notify regulators on April 4, according to the Nuclear Safety Council.
The agency said the risk to humans and the environment was minimal, but that the plant's operators had nonetheless violated monitoring and incident-reporting rules.
It also said Asco, owned by utility Endesa, had grossly underreported the amount of contamination released.
The agency proposed six sanctions against the plant, which is located on the Ebro River, 44 miles (28 kilometers) upstream from the Mediterranean.
It is up to the Industry Ministry will decide whether to fine the company, and if so how much. The punishment could total 22.5 million (US$33 million).
In April, the council upgraded its classification of the leak from Level 1, the lowest on a scale of one to seven, to Level 2.
Spain has seven nuclear power plants operating. The Socialist government says it will let them run until their licenses expire, then decommission them.