The EU AI Act in Spain

Per Spain - AI University-Industry Chairs (TDF/304/2025)

• Ministry for the Transformation Digital and Public Function (Ministerio para la Transformación Digital y de la Función Pública) — Competent Ministry and policy owner; issues and enforces the Order
• Secretary of State for Digitalization and Artificial Intelligence (Secretaría de Estado de Digitalización e IA) — Operational management and call publication; oversight of Cátedras ENIA implementation
• Boletín Oficial del Estado (BOE) — Official publisher of the normative text

Per Spain - National AI Sandbox (Royal Decree 817/2023)

• Ministry for Economic Affairs and Digital Transformation (Ministerio de Asuntos Económicos y Transformación Digital) — Lead authority administering the sandbox through the Secretaría de Estado de Digitalización e Inteligencia Artificial; issues calls and coordinates testing and guidance production.
• Secretaría de Estado de Digitalización e Inteligencia Artificial — Operational manager of the sandbox, selection committee, expert advisory coordination and reporting to the European AI Office.
• Spanish Data Protection Agency (AEPD) — Data protection oversight and guidance where processing of personal data occurs in sandbox tests.
• European AI Office / European Commission — Cooperates with Member State sandboxes and receives findings to inform EU-level guidance and standardisation.

Per Spain AI Governance Bill

• Agencia Española de Supervisión de la Inteligencia Artificial (AESIA) — National supervisory authority for AI (default competent authority for non‑sectoral cases, coordinator of sandboxes and national register).
• Agencia Española de Protección de Datos (AEPD) — Supervisor for data protection, biometric systems and personal data processing related to AI.
• Consejo General del Poder Judicial (CGPJ) — Competent authority for AI systems deployed in the administration of justice.
• Junta Electoral Central (JEC) — Competent authority for AI affecting electoral processes and democratic procedures.
• Banco de España — Sectoral supervisor for AI systems impacting banking, creditworthiness and solvency assessments.
• Dirección General de Seguros y Fondos de Pensiones (DGSFP) — Sectoral supervisor for AI systems used in the insurance sector.
• Comisión Nacional del Mercado de Valores (CNMV) — Sectoral supervisor for AI systems used in capital markets and investment services.

Per Spain - AI Supervision Agency (729/2023)

• Agencia Española de Supervisión de la Inteligencia Artificial (AESIA) — National supervisory authority for AI; supervision, inspection, guidance, coordination with EU bodies
• Ministry of Economic Affairs and Digital Transformation (Ministerio de Asuntos Económicos y Transformación Digital) — Parent department; oversight and administrative attachment of AESIA

Per Spain - Green Algorithms Programme

• Secretariat of State for Digitalisation and Artificial Intelligence (Secretaría de Estado de Digitalización e Inteligencia Artificial) — Programme lead, policy design, coordination and oversight of PNAV implementation
• Plan de Recuperación, Transformación y Resiliencia / Ministerio — Recovery Plan administration — Funding and compliance oversight for NextGenerationEU components supporting PNAV
• AENOR / UNE (Spanish standards bodies) — Technical standardisation partner for metrics and measurement specifications

Per Spain - University-Industry AI Chairs (ETD/1180/2022)

• Ministry for Economic Affairs and Digital Transformation (Secretariat of State for Digitalisation and Artificial Intelligence) — Managing and awarding authority; responsible for calls, evaluation, monitoring and enforcement
• Boletín Oficial del Estado (BOE) — Official publication and repository for the legal text and subsequent modifications
• Secretariat General / Audit Units (Ministry Treasury / Intervention Delegada) — Financial control, audit and validation of guarantees and justifications (per Recovery Plan rules)

Per Spain - Digital Rights Framework

• Ministry for Economic Affairs and Digital Transformation (Ministerio de Asuntos Económicos y Transformación Digital) — Policy lead and convener for the Charter and digital transformation agenda
• Agencia Española de Protección de Datos (AEPD) — Data protection regulator; enforcer of privacy and data protection rules referenced by the Charter
• Red.es — Public entity implementing programmes, convening stakeholders, and funding projects to operationalise the Charter
• Observatorio de Derechos Digitales — Operational observatory for monitoring, awareness, and coordination of implementation actions

Per Spain - National AI Strategy

• Secretariat of State for Digitalization and Artificial Intelligence (SEDIA) — National coordinator and implementing authority for ENIA measures; leads interministerial coordination and monitoring.
• Spanish Agency for the Supervision of Artificial Intelligence (AESIA) — National supervisory body established by Royal Decree to support oversight, guidance, inspection and cooperation with EU and national regulators.
• Spanish Data Protection Agency (AEPD) — Sectoral regulator for data protection and privacy compliance for AI systems processing personal data.

Per Spain - AI Research Strategy

• Ministry of Science, Innovation and Universities (Ministerio de Ciencia, Innovación y Universidades) — Lead publisher and coordinator for the strategy; responsible for R&D&I policy alignment and integration into state plans.
• La Moncloa (Office of the Prime Minister) — Hosted the presentation and provides high-level government endorsement and coordination.
• Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD) — Data protection supervisory authority referenced by the strategy for GDPR compliance and guidance on personal data processing.

Per Spain - AI University-Industry Chairs (TDF/304/2025)

• Recovery of unduly paid amounts plus legal interest.
• Administrative fines and sanctions under Law 38/2003 and implementing regulations.
• Suspension or exclusion from future public aid programmes.
• Obligation to correct irregularities and provide compensatory measures.
• Civil or criminal liability where facts constitute offences under applicable law.

Per Spain - National AI Sandbox (Royal Decree 817/2023)

• Suspension or termination of sandbox participation for material breaches of rules or misrepresentations.
• Public disclosure of non-compliance findings by the administering authority.
• Referral to sectoral supervisors and enforcement authorities with potential administrative fines under national law and the EU Artificial Intelligence Act.
• Exclusion from future sandbox calls, public funding or related support measures.
• Civil liability under Spanish tort and contract law for harm arising from AI system operation (no liability waiver for participants).

Per Spain AI Governance Bill

• Very serious infringements: fines ranging from €7,500,000 to €35,000,000 or 2%–7% of global annual turnover (choose the higher amount where applicable), subject to SME adjustments.
• Serious infringements: fines ranging from €500,000 to €7,500,000 or 1%–2% of global annual turnover.
• Minor infringements: administrative fines for formal non‑compliance (e.g., missing CE marking) with lower values.
• Corrective measures: forced adaptation, temporary or permanent market withdrawal, prohibition on commercialization or use in Spain.
• Provisional measures: digital withdrawal from the Spanish market in case of grave incidents (including death or critical infrastructure failure).
• Publication of sanctions and corrective orders in the public register and administrative records.
• Disciplinary or administrative measures for public sector bodies (reprimands, notices), with stakeholder concerns raised about the absence of monetary fines for some public uses.

Per Spain - AI Supervision Agency (729/2023)

• Administrative corrective measures (e.g., orders to suspend use or place on the market, remediation requirements) as permitted by applicable law.
• Administrative fines and pecuniary penalties where provided by sectoral or future AI implementing legislation and within the scope of the Agency’s sanctioning competence.
• Public disclosure of enforcement measures consistent with transparency obligations and protection of procedural rights.
• Referral to other competent authorities (judicial authorities, sectoral regulators) where civil or criminal liability issues arise or specialized sanctions apply.
• Asset, contract or procurement remedies to prevent further risk where legal conditions exist.

Per Spain - Green Algorithms Programme

• Suspension of payments linked to PNAV-funded projects in case of non-compliance.
• Recovery (clawback) of misspent or ineligible funds according to national and EU rules.
• Exclusion from future PNAV funding rounds or programmes for serious or repeated breaches.
• Administrative sanctions or fines where authorized by applicable public funds and procurement law.
• Referral to criminal investigation in cases where fraud or criminal conduct is suspected.

Per Spain - University-Industry AI Chairs (ETD/1180/2022)

• Recovery (reintegro) of unduly paid amounts including interest where applicable.
• Partial or total termination of the grant and obligation to return funds.
• Administrative fines and sanctions provided under the General Subsidies Law (Ley 38/2003) and its implementing regulation.
• Exclusion from future public aid or grants in specified circumstances.
• Legal actions and enforcement procedures in case of fraud, corruption or serious breach of conditions.
• Withholding of subsequent payments or suspension pending resolution of compliance concerns.

Per Spain - Digital Rights Framework

• The Charter itself does not create new penalties; enforcement arises through existing legal instruments (for example, sanctions under Organic Law 3/2018 administered by the Agencia Española de Protección de Datos for data‑protection infringements).
• Sectoral breaches (telecommunications, audiovisual, labor law) remain subject to the relevant statutory enforcement regimes and administrative sanctions.
• Where future binding regulations are adopted to implement Charter principles, those texts may define specific penalties, administrative fines and remedial measures.

Per Spain - National AI Strategy

• ENIA itself does not set administrative penalties; enforcement is exercised under sectoral law and the EU AI legal framework.
• Supervisory and sanctioning powers for AI oversight were operationalised through the establishment of AESIA (see <a href="https://www.boe.es/diario_boe/txt.php?id=BOE-A-2023-18911">Royal Decree 729/2023</a>) which can exercise inspection and sanctioning functions under applicable legal instruments.
• Non-compliance with grant conditions may result in repayment obligations, administrative sanctions or ineligibility for future funding.
• Liability and redress provisions are to be applied under existing civil, sectoral and EU law (including GDPR and national transpositions of EU rules).

Per Spain - AI Research Strategy

• The strategy itself does not create administrative sanctions; however, failure to comply with funding conditions, ethics requirements or data protection obligations may result in ineligibility for grants, suspension or clawback of funds under the applicable grant agreements.
• Liability and penalties for legal non-compliance (e.g., GDPR breaches) remain subject to the applicable legal regimes and enforcement by competent authorities such as the Spanish Data Protection Agency.