Skip to main content

    AI by country · Southern Europe

    AI in Spain: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Spain know before starting with AI?

    Spain applies the EU AI Act and the GDPR, with the GDPR filled in by Organic Law 3/2018 (LOPDGDD). The Spanish AI Supervisory Agency (AESIA) is Spain's single point of contact for the AI Act, but the national bill that would have set its powers and sanctions lapsed when Parliament was dissolved in October 2026. A company should check which AI Act duties already apply to it, how its AI uses personal data, and how staff are monitored at work.

    At a glance

    Spain at a glance

    Key facts about Spain
    Data protection lawGDPR (applies since 25 May 2018) plus Organic Law 3/2018 (LOPDGDD), in force since 7 December 2018
    RegulatorSpanish Data Protection Agency (AEPD) for personal data; AESIA as AI Act single point of contact, final designation pending
    AI policyEU AI Act, Regulation (EU) 2024/1689, phased; Spain's AI Strategy 2024. The national AI governance bill lapsed on 6 October 2026
    Time zoneCET, UTC+1 in winter and UTC+2 in summer on the mainland; Canary Islands one hour behind
    CurrencyEUR (euro)
    Business languageSpanish, plus Catalan, Galician and Basque in their regions; English common in larger firms

    Why now

    Why Spain is worth watching

    Each point links to the document it comes from.

    • Eurostat data show 20.27% of Spanish enterprises with 10 or more staff used at least one AI technology in 2025, up from 11.31% in 2024 and just above the EU figure of 19.95%.[10]

    • The AI Act's transparency duties in Article 50 started on 2 August 2026, and new prohibitions on certain AI-generated content start on 2 December 2026.[1]

    • Spain set up AESIA by Royal Decree 729/2023, based in A Coruña, to supervise AI systems and sanction breaches of AI rules.[5]

    • The Government approved the AI Strategy 2024 in May 2024, with 1,500 million euros of new money for 2024 and 2025 on top of 600 million already committed.[9]

    • The strategy funds ALIA, a family of language models in Spanish and the co-official languages.[9]

    • The draft Organic Law on the good use and governance of AI was sent to Congress in May 2026 but is marked as lapsed from 6 October 2026, after elections were called for 29 November 2026.[7]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation, Regulation (EU) 2016/679

    In force2016People have a right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects (Article 22). High-risk processing needs a data protection impact assessment (Article 35), and breaches must be reported within 72 hours where feasible (Article 33). Fines can reach 20 million euros or 4% of worldwide turnover, whichever is higher.[4]

    Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD)

    In force2018It fills in the GDPR for Spain. People must be told when their data will be used for profiling (Article 11), and minors can consent alone only from age 14 (Article 7). Articles 87 to 91 set workplace digital rights, including limits on device access, cameras and geolocation, which matter for any AI that monitors staff.[3]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI

    Phased2024Prohibitions and AI literacy have applied since 2 February 2025 and general-purpose AI rules since 2 August 2025. After the 2026 omnibus, high-risk rules for Annex III systems apply from 2 December 2027 and for AI in Annex I products from 2 August 2028. Fines reach 35 million euros or 7% of turnover for prohibited practices, with the lower cap for SMEs.[1]

    Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial (121/000096)

    Draft2026This bill would have set Spain's AI Act sanctions and named its authorities. The Congress record shows it presented on 28 May 2026 and lapsed from 6 October 2026, when the Cortes were dissolved. A new Parliament would have to start again, so the national sanctions regime is not yet confirmed as of 29 October 2026.[7]

    Where AI fits first

    Where AI fits first

    Banking and insurance

    Document checks for onboarding, fraud alerts and summarising claims files in Spanish.

    Credit scoring of individuals and life and health insurance pricing are Annex III high-risk uses under the AI Act, which apply from 2 December 2027.[1]

    Tourism and hospitality

    Multilingual guest messaging and booking support, with a clear notice that guests are talking to AI.

    Article 50 of the AI Act requires people to be told when they interact with an AI system; this has applied since 2 August 2026.[1]

    Employers in any sector

    Screening job applications or scheduling shifts.

    AI used in recruitment or for decisions about workers is high-risk under Annex III. The LOPDGDD also limits workplace cameras and geolocation (Articles 89 and 90).[3]

    Public sector and regional services

    Drafting replies to citizens in Spanish and the co-official languages.

    The AI Strategy 2024 backs ALIA models for these languages. The lapsed bill had a chapter on AI in the state public sector, so rules here may change after the election.[9]

    Your first steps

    Your first steps

    1. List every AI system you build or use, and mark which fall under the AI Act's prohibited, high-risk or Article 50 transparency categories.
    2. Add a clear AI notice to chatbots and label AI-generated or deepfake content now, since Article 50 already applies.
    3. Run a GDPR impact assessment before using AI for credit, hiring, staff monitoring or health data.
    4. Check workplace tools against LOPDGDD Articles 87 to 91, and inform staff before any monitoring.
    5. Give staff basic AI training so you can show the measures you took on AI literacy.
    6. Put a GDPR transfer mechanism, such as standard contractual clauses, in place before personal data goes to a vendor outside the EU.
    7. Watch the AESIA and AEPD sites, and the new Parliament, for a fresh national AI bill.

    AI services for Spain

    AI consulting and development for teams in Spain

    We work remotely with companies in Spain, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Mainland Spain is on UTC+1 in winter and UTC+2 in summer, and India is on UTC+5:30, so the gap is 4.5 hours in winter and 3.5 hours in summer. Taking a 9:00 to 18:00 day in Madrid and 9:30 to 18:30 in India, the overlap is 5 hours in winter (09:00 to 14:00 Madrid time) and 6 hours in summer (09:00 to 15:00). India has no EU adequacy decision, so any personal data we handle from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Spain

    Does Spain have its own AI law?

    Not as of 29 October 2026. The EU AI Act applies directly. Spain's bill to set national sanctions and authorities lapsed when Parliament was dissolved on 6 October 2026, ahead of the 29 November 2026 election.

    Who supervises AI in Spain?

    The European Commission lists AESIA as Spain's single point of contact for AI Act market surveillance, with final national designation still pending. The AEPD remains the regulator for personal data used by AI.

    Were the AI Act high-risk deadlines delayed?

    Yes. The Digital Omnibus on AI moved Annex III high-risk rules to 2 December 2027 and AI in regulated products to 2 August 2028. Article 50 transparency duties were not delayed and apply from 2 August 2026.

    Can we test AI in a regulatory sandbox?

    Spain created an AI sandbox by Royal Decree 817/2023 in November 2023. It was set to last up to 36 months, so check with AESIA whether calls are still open. The AI Act requires each member state to have a sandbox running by 2 August 2027.

    What are the maximum fines?

    Under the GDPR, up to 20 million euros or 4% of worldwide turnover. Under the AI Act, up to 35 million euros or 7% for prohibited practices and 15 million euros or 3% for most other breaches.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] European Commission, AI Act Service Desk, 2026-10-29. Timeline for the implementation of the EU AI Act(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      Timeline for the implementation of the EU AI Act. Primary. Accessed on this date. Used for all AI Act dates; the page states it reflects the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026). Annex III high-risk uses (credit, insurance, employment) are from the Act itself.

    2. [2] European Commission, AI Act Service Desk, 2026-10-29. Article 99: Penalties, and Article 4: AI literacy(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      Article 99: Penalties, and Article 4: AI literacy. Primary. Used for AI Act fine caps and the SME rule. Article 4 was read at https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4, which shows it as amended by the omnibus to a duty to take measures to support AI literacy.

    3. [3] Boletín Oficial del Estado, 2018-12-06. Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personal…(boe.es)
      Full title and what we used it for

      Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (consolidated text). Primary. Used for Articles 7, 11, 18, 22 and 87 to 91 and the entry into force on 7 December 2018. Consolidated text last updated 27 December 2025.

    4. [4] Boletín Oficial del Estado (copy of the Official Journal of the EU, L 119), 2016-05-04. Reglamento (UE) 2016/679 (General Data Protection Regulation)(boe.es)
      Full title and what we used it for

      Reglamento (UE) 2016/679 (General Data Protection Regulation). Primary text, read in Spanish. Used for Articles 22, 33, 35 and 83 and the 25 May 2018 application date. EUR-Lex could not be opened from our tools.

    5. [5] Boletín Oficial del Estado, 2023-09-02. Real Decreto 729/2023, de 22 de agosto, Estatuto de la Agencia Española…(boe.es)
      Full title and what we used it for

      Real Decreto 729/2023, de 22 de agosto, Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial. Primary. Used for AESIA's seat in A Coruña and its supervisory and sanctioning functions.

    6. [6] European Commission, 2026-09-07. Market surveillance authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market surveillance authorities under the AI Act. Primary. Lists AESIA as Spain's single point of contact, marked as national designation pending final adoption.

    7. [7] Congreso de los Diputados, 2026-10-29. Proyecto de Ley Orgánica para el buen uso y la gobernanza de la intelig…(congreso.es)
      Full title and what we used it for

      Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial (121/000096). Primary. Used for presentation on 28 May 2026 and the status 'Concluido (Caducado)' from 6 October 2026. Bill content (sanctions, public sector chapter) is from law-firm summaries by ECIJA and CMS, used for interpretation only.

    8. [8] Boletín Oficial del Estado, 2026-10-06. Real Decreto 806/2026, de 5 de octubre, de disolución del Congreso de l…(boe.es)
      Full title and what we used it for

      Real Decreto 806/2026, de 5 de octubre, de disolución del Congreso de los Diputados y del Senado y de convocatoria de elecciones. Primary. Used for the dissolution of Parliament and the election date of 29 November 2026.

    9. [9] Ministerio para la Transformación Digital y de la Función Pública, 2024-05-14. El Gobierno aprueba la Estrategia de Inteligencia Artificial 2024(digital.gob.es)
      Full title and what we used it for

      El Gobierno aprueba la Estrategia de Inteligencia Artificial 2024. Primary press release. Used for the funding figures and ALIA. The page shows 13 May 2024 in its text and 14 May in its URL, so we say May 2024.

    10. [10] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary dataset, read through the Eurostat API. Indicator E_AI_TANY, enterprises with 10 or more persons employed, excluding the financial sector.

    11. [11] Boletín Oficial del Estado, 2023-11-09. Real Decreto 817/2023, de 8 de noviembre, entorno controlado de pruebas…(boe.es)
      Full title and what we used it for

      Real Decreto 817/2023, de 8 de noviembre, entorno controlado de pruebas de inteligencia artificial. Primary. Used for the creation of Spain's AI sandbox and its maximum 36-month life.

    This is general information, not legal advice. EU and Spanish AI rules are changing, and Spain's national AI bill must restart after the November 2026 election. Check with a qualified Spanish lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Spain?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score