Technical nitpicking: ERTMS is an umbrella term for the train control system (ETCS) and communications (GSM-R), it's ETCS which has levels, and ETCS L1 would have been enough, or apparently even ASFA Digital.

On your main point, I agree, but will put it more focused:

1. Existing strong European regulation on infrastructure is only mandatory for international routes. It would be good to force infrastructure managers to apply at least as high standards on national routes, too (albeit this wouldn't be sensible without extra financial support for retrofits).
   
2. What one should think through is rules for temporary solutions. As I wrote in a comment downthread, what made both the line and the train special was a temporary solution to bring high-speed service to the province of Galicia before construction of the full line from Madrid is finished. There are other examples of part-built lines being opened with lower-level technology, where the risks can be higher than on a line built entirely to the lower standards.

Of course, the part of the problem that is cost-cutting can't be solved by legislation only. In that respect the Santiago disaster reminds me of the Eschede disaster in Germany, which happened on a conventional line upgraded for 200 km/h, and could have been prevented or made much less serious by any one of a number of high-tech details which were cost-saved (air springs, on-bard diagnostics, pillar-less overpasses, high-speed switches).

_{*Lunatic*, n.
One whose delusions are out of fashion.}