Spain’s AI Law: what it requires of your company and how to prove compliance.

The European AI Regulation (AI Act) has been in force since August 2024 and its sanctions regime is fully applicable from 2 August 2026. On 26 May 2026 Spain approved the draft Organic Law for the good use and governance of AI, which adapts that regulation to Spanish law and is being processed under the urgent procedure.

Any company that develops, markets or uses AI systems whose effects occur in Spain or the EU, regardless of its size or sector. The obligations depend on the system’s risk level, not on the size of the company. Common uses such as AI in recruitment, credit scoring, customer service or content generation may trigger new obligations.

Infringements are classified as very serious, serious and minor. Very serious (for example, using prohibited systems): up to EUR 35 million or 7% of global annual turnover. Serious: up to EUR 15 million or 3%. Minor: up to EUR 500,000 or 0.5%. Proportionality criteria apply and the size of SMEs and startups is taken into account.

The Spanish Agency for the Supervision of Artificial Intelligence, headquartered in A Coruña and operational since 2025. It is the national authority that coordinates market surveillance and runs the regulatory sandbox. Other authorities, such as the AEPD and the CGPJ, retain powers within their remits.

The AI Act bans unacceptable-risk practices: subliminal techniques that cause harm, exploitation of vulnerabilities due to age, disability or socioeconomic situation, biometric categorisation by race or orientation, social scoring and emotion recognition at work or in education, among others. Spain has added a ban on sexual deepfakes. In total there are ten prohibited practices.

A system that can affect safety or fundamental rights: AI in recruitment, education, access to essential services, credit, biometrics, critical infrastructure or safety components of regulated products. It carries enhanced obligations: risk management, technical documentation, human oversight, registration and conformity assessment.

Yes. The AI Act imposes transparency obligations: synthetic content (images, audio, video or text generated or manipulated with AI) must be marked in a legible way and, where technically feasible, in a format that machines can detect. You must also inform people when they interact with an AI system, such as a chatbot.

AI for recruitment, evaluation or staff management is usually considered high-risk: it requires effective human oversight, transparency, bias control and documentation. In customer service with chatbots, you must disclose that the user is talking to an AI and meet the transparency obligations.

Obligations apply according to risk, but the law includes proportionality measures: reduced sanctions for early payment or for adopting corrective measures, consideration of company size, and priority access to the AESIA sandbox to test systems safely.

The Spanish law does not replace the AI Act: it complements it by designating the supervisory authorities, the sanctions regime and the national procedures. The AI Act is directly applicable; the Spanish law enables its governance and enforcement in Spain.

A controlled testing environment operated by AESIA in which companies can develop and validate AI systems, especially high-risk ones, under supervision and before market launch, reducing regulatory risk.

Start with an inventory of all AI systems in use, including shadow AI; classify them by risk level; implement human oversight and traceability; document and assess the impact on fundamental rights. A compliance assessment gives you the prioritised gap map to arrive in time for 2 August 2026.