Spain AI Regulation & Governance

Derived: Probable The EU AI Act (Regulation (EU) 2024/1689) is applicable in full from 2 August 2026, with Chapters I-II applying from 2 February 2025 and GPAI rules from 2 August 2025.

Derived: Probable Spain's national AI governance bill (121/000096) lapsed on 6 October 2026 on dissolution of the Cortes for the 29 November 2026 general election, and the next legislature must present a new text.

Providers and deployers of AI systems must take measures to support AI literacy of staff and others dealing with AI systems on their behalf, proportionate to role and risk.

The AI Act's high-risk system obligations now apply from 2 December 2027 for Annex III use-case systems and 2 August 2028 for Annex I safety-component systems, as amended by the Digital Omnibus Regulation.

Spain's draft AI governance and sanctions bill lapsed on 6 October 2026 when the Cortes were dissolved for the 29 November 2026 general election.

The AI Act is directly applicable in Spain, with staged application: Chapters I-II from 2 February 2025, GPAI rules from 2 August 2025, and general application from 2 August 2026 (since amended for high-risk timelines).

The Digital Omnibus Regulation (EU) 2026/1744 replaced the single 2 August 2026 high-risk commencement date with a phased timeline: 2 December 2027 for Annex III use-case systems and 2 August 2028 for Annex I safety-component systems, with public-authority deployers to comply by 2 August 2030.

Regulation (EU) 2026/1744 (Digital Omnibus) deferred the AI Act's Annex III deadline to 2 December 2027 and Annex I deadline to 2 August 2028, formally adopted 29 June 2026.

AESIA, Spain's national AI supervisory agency, was established by Real Decreto 729/2023, in force from 3 September 2023.

Derived: Probable Spain's AI governance bill (expediente 121/000096) lapsed on 6 October 2026 when the Cortes Generales were dissolved by Real Decreto 806/2026.

Spain, with French support, secured EU agreement to add two further prohibited AI practices to Article 5 — non-consensual intimate/sexual deepfake imagery and CSAM generation — applying across the Union from 2 December 2026.

The AI Act prohibits eight AI practices outright, including manipulation, exploitation of vulnerabilities, social scoring, biometric categorisation of protected characteristics, workplace/education emotion recognition (absent medical/safety reasons), and real-time remote biometric identification for law enforcement subject to narrow exceptions.

From 2 December 2026, the AI Act will prohibit AI-generated or manipulated non-consensual intimate/sexual deepfake imagery and CSAM, an amendment agreed by the EU on 7 May 2026 following Spanish advocacy.

The AI Omnibus postponed application of obligations for high-risk AI systems listed in Annex III of the AI Act from 2 August 2026 to 2 December 2027.

Derived: Probable Providers of high-risk AI systems placed on the market or put into service must comply with Chapter III Section 2 obligations, undergo conformity assessment, and register in the EU database before market placement, under AI Act Art 16.

Derived: Probable Providers of high-risk AI systems must report a serious incident to the relevant Member State market surveillance authority within 15 days of becoming aware, with shorter 10-day and 2-day deadlines for death and critical-infrastructure disruption respectively, under AI Act Art 73.

The AI Act's high-risk system obligations now apply from 2 December 2027 for Annex III use-case systems and 2 August 2028 for Annex I safety-component systems, as amended by the Digital Omnibus Regulation.

An AI system is high-risk if it is a safety component of a product covered by Annex I harmonisation law, or is an Annex III use case not limited to a non-material preparatory/supportive role (the Art 6(3) derogation never applies to profiling).

Annex III lists eight standalone high-risk AI use-case categories, including biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration/border control, and justice/democratic processes.

High-risk AI providers must comply with the full Chapter III Section 2 requirement set and undertake conformity assessment, CE marking, database registration and (if non-EU) authorised-representative appointment.

High-risk AI providers must maintain a documented quality management system covering at least 13 elements, with financial institutions deemed compliant via existing governance rules except for risk management, post-market monitoring and incident reporting.

High-risk AI providers (or deployers if the provider is unreachable) must report a serious incident within 15 days generally, 10 days for a death, and 2 days for widespread infringement or serious critical-infrastructure disruption.

Deployers of high-risk AI must follow instructions, assign human oversight, ensure data quality, monitor and suspend on risk, retain logs six months, inform affected persons, and (if employers) inform workers' representatives before workplace use.

Public-body deployers, public-service operators, and creditworthiness/insurance-risk deployers of high-risk AI must complete and register a fundamental rights impact assessment before deployment.

High-risk AI providers must operate a documented post-market monitoring system collecting and analysing performance data across the system lifetime; Commission guidance is due by 2 September 2027.

The Digital Omnibus Regulation (EU) 2026/1744 replaced the single 2 August 2026 high-risk commencement date with a phased timeline: 2 December 2027 for Annex III use-case systems and 2 August 2028 for Annex I safety-component systems, with public-authority deployers to comply by 2 August 2030.

Microenterprises and small enterprises providing high-risk AI systems may meet quality-management requirements in a simplified form, without reducing the substance of their obligations.

AI Act Arts 22 and 54 require third-country providers of high-risk systems and GPAI models to appoint an EU authorised representative with documentation-retention and cooperation duties.

Regulation (EU) 2026/1744 (Digital Omnibus) deferred the AI Act's Annex III deadline to 2 December 2027 and Annex I deadline to 2 August 2028, formally adopted 29 June 2026.

AI Act Art 73 requires high-risk AI system providers to report serious incidents within 15 days (or 2/10 days for more severe categories), effective from 2 August 2026.

Providers of general-purpose AI models must keep technical documentation, provide information to downstream providers, maintain a copyright-compliance policy, and publish a training-content summary, before placing the model on the EU market.

Providers of general-purpose AI models not established in the Union must appoint an EU authorised representative before placing the model on the EU market.

GPAI providers must maintain technical documentation, inform downstream providers, operate a copyright policy honouring TDM rights reservations, and publish a training-content summary, with narrower FOSS exemptions.

A GPAI model's provider must notify the Commission within two weeks of its cumulative training compute meeting or being reasonably foreseen to meet the 10^25 FLOPs systemic-risk presumption.

A non-EU GPAI provider must appoint an authorised representative established in the Union before placing its model on the EU market.

AI Act Art 54 requires non-EU providers of general-purpose AI models to appoint an EU authorised representative before placing a model on the Union market, in force since 2 August 2025.

AI Act Art 53 requires GPAI providers to maintain technical documentation (Annex XI) and provide Annex XII information to downstream providers, from 2 August 2025.

AI Act Art 53(1)(c)-(d) requires GPAI providers to maintain a copyright policy and publish a training-data summary before placing the model on the market.

AI Act Arts 22 and 54 require third-country providers of high-risk systems and GPAI models to appoint an EU authorised representative with documentation-retention and cooperation duties.

Derived: Probable For AI systems generating synthetic content already placed on the market before 2 August 2026, the AI Act's machine-readable watermarking obligation under Art 50(2) is deferred to 2 December 2026 by Regulation (EU) 2026/1744.

Derived: Probable Providers and deployers of AI systems that interact with people, generate synthetic content, use emotion-recognition or biometric-categorisation, or produce deepfakes or AI-generated public-interest text, must make the disclosures required by AI Act Art 50, subject to listed exceptions, in force since 2 August 2026.

For synthetic-content systems already on the market before 2 August 2026, the machine-readable watermarking obligation under Article 50(2) is deferred to 2 December 2026; other Article 50 transparency duties applied from 2 August 2026 as originally scheduled.

AI Act Article 50 imposes four transparency duties: disclosure of AI interaction, machine-readable marking of synthetic content, informing persons exposed to emotion-recognition/biometric categorisation, and disclosure of artificial origin for public-interest deepfakes/text, subject to editorial-review and law-enforcement exceptions.

Providers of general-purpose AI models must keep technical documentation, provide information to downstream providers, maintain a copyright-compliance policy, and publish a training-content summary, before placing the model on the EU market.

GPAI providers must maintain technical documentation, inform downstream providers, operate a copyright policy honouring TDM rights reservations, and publish a training-content summary, with narrower FOSS exemptions.

AI Act Art 53(1)(c)-(d) requires GPAI providers to maintain a copyright policy and publish a training-data summary before placing the model on the market.

Spain's draft national AI governance and sanctions organic law (121/000096) lapsed on 6 October 2026 when Real Decreto 806/2026 dissolved the Cortes Generales for the 29 November 2026 general election.

High-risk AI providers must maintain a documented quality management system covering at least 13 elements, with financial institutions deemed compliant via existing governance rules except for risk management, post-market monitoring and incident reporting.

Public-body deployers, public-service operators, and creditworthiness/insurance-risk deployers of high-risk AI must complete and register a fundamental rights impact assessment before deployment.

Derived: Probable Spain's draft national AI governance and sanctions bill (121/000096), which would have designated AESIA as the default market-surveillance authority and set fines up to EUR 35,000,000 or 7% of turnover for very serious infringements, lapsed on 6 October 2026 when the Cortes Generales were dissolved; it must be reintroduced from scratch in the next legislature.

Royal Decree 806/2026 dissolved the Cortes Generales and called elections for 29 November 2026, causing the pending AI governance organic law and other bills to lapse without inheritance by the next legislature.

Derived: Probable Providers of high-risk AI systems must report a serious incident to the relevant Member State market surveillance authority within 15 days of becoming aware, with shorter 10-day and 2-day deadlines for death and critical-infrastructure disruption respectively, under AI Act Art 73.

High-risk AI providers (or deployers if the provider is unreachable) must report a serious incident within 15 days generally, 10 days for a death, and 2 days for widespread infringement or serious critical-infrastructure disruption.

High-risk AI providers must operate a documented post-market monitoring system collecting and analysing performance data across the system lifetime; Commission guidance is due by 2 September 2027.

AI Act Art 73 requires high-risk AI system providers to report serious incidents within 15 days (or 2/10 days for more severe categories), effective from 2 August 2026.

Derived: Probable Providers of high-risk AI systems placed on the market or put into service must comply with Chapter III Section 2 obligations, undergo conformity assessment, and register in the EU database before market placement, under AI Act Art 16.

AESIA, Spain's national AI supervisory authority, was created by Royal Decree 729/2023.

Derived: Probable Spain's national AI governance bill (121/000096) lapsed on 6 October 2026 on dissolution of the Cortes for the 29 November 2026 general election, and the next legislature must present a new text.

Derived: Probable AESIA can investigate suspected AI Act breaches but, absent the lapsed national governance bill's sanctioning regime, reportedly cannot yet impose fines under the AI Act in Spain.

AESIA, Spain's national AI market-surveillance authority, was created by Real Decreto 729/2023 of 22 August 2023, effective from 3 September 2023.

Derived: Probable On 14 August 2026 AESIA had opened 23 investigations, ex officio or on complaint, into Spanish companies' AI systems, requesting technical documentation, records and impact assessments.

Spain's draft national AI governance and sanctions organic law (121/000096) lapsed on 6 October 2026 when Real Decreto 806/2026 dissolved the Cortes Generales for the 29 November 2026 general election.

Spain's draft AI governance and sanctions bill lapsed on 6 October 2026 when the Cortes were dissolved for the 29 November 2026 general election.

AESIA had opened 23 investigations into Spanish companies' AI systems as of 14 August 2026, but could not yet issue fines pending national implementing legislation.

SMEs, start-ups and (once in force) small mid-cap companies have their AI Act Article 99 fines capped at the lower of the fixed amount or turnover percentage, reversing the default 'higher of' rule.

AESIA's Statute gives it supervisory, advisory, training, inspection, verification and sanctioning functions, including those assigned by applicable EU AI regulation, as Spain's state-level AI supervisory authority.

Derived: Probable Spain's draft national AI governance and sanctions bill (121/000096), which would have designated AESIA as the default market-surveillance authority and set fines up to EUR 35,000,000 or 7% of turnover for very serious infringements, lapsed on 6 October 2026 when the Cortes Generales were dissolved; it must be reintroduced from scratch in the next legislature.

AESIA (operational since 2024, empowered to inspect/sanction from August 2025) is the AI Act market-surveillance authority and single point of contact in Spain, operating alongside AEPD, which retains separate competence over personal-data aspects of AI systems.

AESIA has published a set of 16 practical guides on AI Act compliance (risk management, human oversight, documentation), which AESIA itself states are non-binding support documents; binding obligations derive from the Regulation itself.

AESIA, Spain's national AI supervisory agency, was established by Real Decreto 729/2023, in force from 3 September 2023.

Derived: Probable Spain's AI governance bill (expediente 121/000096) lapsed on 6 October 2026 when the Cortes Generales were dissolved by Real Decreto 806/2026.

Derived: Probable Whether AESIA can currently impose AI Act fines on firms is disputed: its Statute assigns a sanctioning function, but Spanish administrative law requires a statute (not a decree) to typify infractions, and the bill that would supply that statute has lapsed.

Derived: Probable AI Act Art 99(3) sets fines of up to EUR 35m or 7% of global turnover for use of a prohibited AI practice under Art 5.

Derived: Probable Spain's national AI governance bill (121/000096) lapsed on 6 October 2026 on dissolution of the Cortes for the 29 November 2026 general election, and the next legislature must present a new text.

The AI Omnibus (Regulation (EU) 2026/1744) postponed the deadline for Spain to have its mandatory AI regulatory sandbox operational under Article 57(1) from 2 August 2026 to 2 August 2027.

Spain's deadline for an operational mandatory AI regulatory sandbox under Article 57(1) AI Act was postponed from 2 August 2026 to 2 August 2027.

Spain's first AI regulatory sandbox concluded on 11 June 2026, with 11 of 44 applicants completing the programme.

Spain's Royal Decree 817/2023 established the EU's first AI regulatory sandbox, open to Spain-resident/established providers and users testing high-risk, GPAI or foundation-model systems, excluding military/national-security, subliminal-technique and real-time law-enforcement biometric systems.

Eligibility for Spain's AI sandbox requires residency or a permanent establishment in Spain, with groupings requiring a Spain-domiciled sole representative.

SMEs, start-ups and (once in force) small mid-cap companies have their AI Act Article 99 fines capped at the lower of the fixed amount or turnover percentage, reversing the default 'higher of' rule.

Microenterprises and small enterprises providing high-risk AI systems may meet quality-management requirements in a simplified form, without reducing the substance of their obligations.

Regulation (EU) 2026/1744 (Digital Omnibus) deferred the AI Act's Annex III deadline to 2 December 2027 and Annex I deadline to 2 August 2028, formally adopted 29 June 2026.

Spain must establish at least one operational AI regulatory sandbox by 2 August 2027 under AI Act Art 57 as amended by the Digital Omnibus.

AI Act Art 63, as amended by the Digital Omnibus, extends simplified quality-management-system compliance from microenterprises to all SMEs and start-ups without partner or linked enterprises.

Amazon Web Services announced a EUR 33.7 billion investment in Spain to expand its data centre infrastructure in Aragón, adding EUR 18 billion to EUR 15.7 billion already committed in 2024.

Spain's AI/data-centre sector has a projected cumulative investment pipeline of EUR 66.9 billion through 2030, with 439 MW of IT power installed at end-2025.

AWS announced a EUR 33.7 billion investment in Spanish data-centre infrastructure in March 2026.