🇪🇸Spain

Overview

Spain's approach to Artificial Intelligence (AI) regulation is characterized by a forward-looking and comprehensive strategy, deeply integrated with the broader European Union framework. The nation aims to position itself as a leader in the ethical and responsible development and deployment of AI, fostering innovation while rigorously safeguarding fundamental rights and public safety. This philosophy is evident in its blend of strategic policy documents, such as the National Artificial Intelligence Strategy (ENIA) and the Spanish Digital Rights Charter, with concrete legislative initiatives like the draft national AI bill and the establishment of a dedicated supervisory authority, the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA). The overall maturity level of Spain's AI regulatory landscape is rapidly advancing, moving from initial policy guidance to the implementation of binding legal instruments and robust institutional structures designed to operationalize the forthcoming EU AI Act.The country's regulatory philosophy is firmly rooted in a human-centric vision for AI, emphasizing transparency, accountability, and non-discrimination. This is reflected in the foundational principles outlined in the Spanish Digital Rights Charter, which interprets existing constitutional rights in the digital realm and guides future legislation. Furthermore, Spain's commitment to promoting trustworthy AI is underscored by initiatives like the National AI Sandbox, which provides a controlled environment for testing and validating AI systems against regulatory requirements, thereby accelerating compliance and fostering innovation, particularly for SMEs and startups. The proactive establishment of AESIA, even before the full entry into force of the EU AI Act, demonstrates Spain's dedication to creating a robust governance ecosystem capable of addressing the complex challenges and opportunities presented by AI technologies.

Regulatory approach

Spain's regulatory approach to AI is primarily horizontal, influenced heavily by the European Union's Artificial Intelligence Act, which adopts a risk-based methodology. This means that AI systems are categorized based on their potential to cause harm, with stricter obligations imposed on "high-risk" systems. The forthcoming Draft Bill for the Good Use and Governance of Artificial Intelligence explicitly replicates and operationalizes these EU categories, including prohibited AI practices, high-risk systems subject to strict obligations, and limited/transparency obligations for other AI systems. This horizontal framework is complemented by sectoral oversight, where pre-existing authorities retain competence in their respective domains, ensuring specialized expertise is applied to AI applications in areas like data protection, justice, finance, and electoral processes.The regulatory landscape in Spain combines both binding legal instruments and soft law. While strategic documents like the National Artificial Intelligence Strategy (ENIA) and the Spanish Strategy for Artificial Intelligence in R&D&I provide overarching policy guidance and funding priorities, the Draft Bill and the Royal Decree establishing AESIA introduce binding legal obligations and institutional mandates. The emphasis on supervised testing environments, such as the National AI Sandbox, further illustrates a balanced approach that supports innovation through controlled experimentation while gathering evidence-based technical guidance for future regulatory refinement. This blend of prescriptive requirements for high-risk systems and flexible, innovation-friendly mechanisms aims to create a dynamic and adaptable regulatory environment. Governance of AI in Spain is anchored by a multi-tiered architecture, with the newly established Agencia Española de Supervisión de la Inteligencia Artificial (AESIA) at its core. AESIA, approved by Royal Decree 729/2023, is an autonomous public agency with its own legal personality and management autonomy, attached to the Ministry of Economic Affairs and Digital Transformation. Its primary mandate includes supervising, inspecting, advising, raising awareness, and providing training to both public and private entities on the correct implementation of national and European AI rules. AESIA is specifically designed to minimize risks arising from AI systems to rights and safety, promote trustworthy AI, and coordinate with other national and EU authorities. It acts as Spain's national supervisory authority for AI, performs market surveillance functions, and serves as the single contact point to the European Commission for AI matters.While AESIA serves as the primary national supervisory authority for most AI cases, Spain's governance model also assigns sectoral monitoring to pre-existing authorities depending on their domain of expertise. For instance, the Agencia Española de Protección de Datos (AEPD) maintains competence for biometric or data protection matters, ensuring that AI systems comply with privacy regulations. The Consejo General del Poder Judicial (CGPJ) oversees AI applications within the justice system, while the Junta Electoral Central (JEC) manages AI-related issues in electoral processes. Similarly, financial regulators such as the Banco de España, the Dirección General de Seguros y Fondos de Pensiones (DGSFP), and the Comisión Nacional del Mercado de Valores (CNMV) are responsible for overseeing AI in their respective financial and insurance sectors. This coordinated approach ensures comprehensive oversight across various applications of AI, with AESIA facilitating coordination among these diverse authorities through mechanisms such as public registers and guidance documents.

Enforcement & penalties

Spain's enforcement mechanisms for AI regulations, as outlined in the Draft Bill for the Good Use and Governance of Artificial Intelligence, are designed to be robust and aligned with the European Union framework. The draft sets out a sanctions regime structured into three tiers: very serious, serious, and minor infringements. Monetary penalties for non-compliance can be substantial, potentially ranging from hundreds of thousands to tens of millions of euros, or a percentage of a company's global turnover, reaching up to the EU maxima of 7% in the most serious cases. Lower caps are foreseen for Small and Medium-sized Enterprises (SMEs) under specific circumstances to ensure proportionality. This tiered approach allows for flexible application of penalties based on the severity and impact of the infringement, ensuring that enforcement is both effective and fair.Beyond financial penalties, the Draft Bill also foresees significant provisional digital withdrawal powers for the national market. If an AI system causes a grave incident, such as a death or a major critical infrastructure failure, national authorities can temporarily remove the system from the market. Furthermore, authorities are empowered to require adaptation of non-compliant systems, block their commercialization, or impose other corrective measures. The enforcement responsibilities are distributed among AESIA as the primary national supervisory authority and other sectoral regulators, each exercising sanctioning powers within their established legal remits. This comprehensive enforcement framework, combined with the obligation for public registers of certain high-risk systems, aims to ensure accountability and deter non-compliant AI practices across Spain.

Data protection

Spain operates under a robust data protection framework primarily governed by the European Union's General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), which is directly applicable across all EU member states. Complementing the GDPR, Spain has its own national legislation, Organic Law 3/2018 on Data Protection and guarantee of digital rights (Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales), which adapts and specifies certain aspects of the GDPR within the Spanish legal system. This framework ensures comprehensive protection of personal data, including principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.The Agencia Española de Protección de Datos (AEPD) serves as the independent national supervisory authority responsible for enforcing data protection laws in Spain. Its mandate includes investigating complaints, conducting audits, imposing fines for non-compliance, and providing guidance on data protection matters. The AEPD plays a crucial role in overseeing AI systems, particularly concerning biometric or other personal data processing, ensuring that AI development and deployment respect privacy and data protection rights. The Spanish Digital Rights Charter further reinforces these protections by explicitly addressing rights related to data protection, non-profiling, and pseudonymity in the digital environment, guiding the ethical and legal use of data within AI systems. While specific data localization requirements are not broadly imposed beyond general GDPR principles, the emphasis on data governance within AI strategies and regulations underscores the importance of secure and responsible data handling for all AI applications in Spain.

Sector-specific rules

While Spain's AI regulatory approach is largely horizontal, aiming to apply a consistent risk-based framework across all sectors, the existing and proposed legislation includes provisions for sector-specific oversight and considerations. The Draft Bill for the Good Use and Governance of Artificial Intelligence, for instance, categorizes high-risk AI systems that are tied to goods, safety components, or certain sectors such as biometrics, critical infrastructure, education, employment, access to essential services, migration, justice, and democratic processes. This implies that AI applications in these sensitive areas will be subject to stricter obligations, including risk-management systems, human oversight, technical documentation, and conformity assessment.Furthermore, the multi-tiered governance architecture ensures that pre-existing sectoral authorities retain competence for AI matters within their respective domains. For example, the Agencia Española de Protección de Datos (AEPD) is responsible for biometric and data protection issues, ensuring AI systems comply with privacy regulations in any sector. The Consejo General del Poder Judicial (CGPJ) oversees AI in the justice system, while the Banco de España, Dirección General de Seguros y Fondos de Pensiones (DGSFP), and Comisión Nacional del Mercado de Valores (CNMV) regulate AI applications in the finance, insurance, and capital markets sectors, respectively. The National AI Sandbox has also provisionally selected AI systems classified as high-risk for sectors including biometric identification, access to essential services, employment, critical infrastructures, machinery, and medical devices, indicating a practical focus on these areas for compliance testing and guidance. This combination of horizontal risk-based regulation and specialized sectoral oversight allows Spain to address the unique challenges and risks posed by AI in diverse contexts.

International alignment

Spain's AI regulatory strategy is deeply intertwined with and strongly aligned to international, particularly European, frameworks and principles. The most significant influence is the European Union's Artificial Intelligence Act (Regulation (EU) 2024/1689), which serves as the foundational architecture for Spain's national legislation. The Draft Bill for the Good Use and Governance of Artificial Intelligence is explicitly designed to adapt Spain's legal framework to this EU regulation, replicating its key categories, prohibited practices, and obligations for high-risk systems. The establishment of the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA) as the national supervisory authority is also a direct response to the obligations imposed by the EU AI Act on Member States. AESIA is mandated to coordinate with the European network of AI supervisory bodies and serve as the single contact point to the European Commission, ensuring harmonized implementation across the EU.Beyond the EU AI Act, Spain's AI strategies and policies also reflect broader international principles for responsible AI. The National Artificial Intelligence Strategy (ENIA) and the Spanish Strategy for Artificial Intelligence in R&D&I emphasize ethical considerations, transparency, accountability, and human-centric approaches, which align with principles promoted by organizations such as the OECD. Furthermore, the National Programme for Green Algorithms (PNAV) aligns with EU-level priorities like the European Green Deal, promoting sustainable AI development and contributing to international standardization and regulatory debates on sustainable AI. The Spanish Digital Rights Charter, while a national policy, also references EU initiatives and informs cooperation at national and Ibero-American levels, demonstrating a commitment to a shared understanding of digital rights in the global context. This comprehensive international alignment ensures that Spain's AI regulatory efforts are coherent with global best practices and contribute to a unified European digital single market.

What's next

The most significant future development in Spain's AI regulatory landscape is the progression of the Draft Bill for the Good Use and Governance of Artificial Intelligence. Approved in its first reading by the Council of Ministers on 11 March 2025, this bill is currently undergoing public consultation and is intended to be processed rapidly under urgent legislative procedure before being sent to the Cortes Generales (Spanish Parliament) for parliamentary debate. Its enactment will fully transpose and operationalize the EU AI Act into national law, establishing concrete legal obligations, a comprehensive sanctions regime, and detailed governance mechanisms for AI systems in Spain. The ongoing legislative process will clarify final details regarding enforcement, specific sectoral adaptations, and the precise roles and coordination mechanisms among AESIA and other national regulators. Stakeholder input from the public consultation phase is expected to influence the final text, particularly concerning aspects like sanctions for public authorities and transparency requirements for algorithmic information.Beyond the immediate legislative developments, Spain's AI regulatory framework will continue to evolve through the operational activities of AESIA and the ongoing work within the National AI Sandbox. AESIA is tasked with producing annual public reports, coordinating with the EU supervisory network, and developing official guidance documents and sectoral technical guides to assist compliance. The sandbox initiative is expected to generate practical, replicable guidance for compliance across the EU market and to inform market surveillance and conformity assessment practices, contributing to the refinement of regulatory standards. Furthermore, the National Artificial Intelligence Strategy (ENIA) is designed as a living document, subject to periodic review and revision to reflect technological and regulatory evolution, ensuring that Spain's approach remains adaptable to rapid advancements in AI. These ongoing efforts will shape the practical implementation and future direction of AI regulation in Spain, reinforcing its commitment to trustworthy and innovative AI development.