Spain State AI Laws Overview

Overview

In Spain, subnational regulatory activity surrounding artificial intelligence is driven by the Autonomous Communities (Comunidades Autónomas), which hold significant constitutional competencies over their regional public administrations, economic development, healthcare, education, and local governance. Regions such as Galicia, the Principality of Asturias, and Catalonia have established legislative frameworks, executive decrees, and strategic governance initiatives designed to regulate the deployment of AI technologies within subnational public administrations and regional public sector entities.

These regional interventions reflect Spain's decentralized territorial structure, where Autonomous Communities leverage their administrative autonomy to establish legally binding standards for algorithmic transparency, ethical AI procurement, automated administrative procedures, and fundamental rights protections. Rather than seeking to regulate private commercial markets—which remain subject to European Union regulations and Spanish national oversight—regional laws focus heavily on responsible AI governance, public trust, and ethical compliance within public administration and civic service delivery.

As the implementation of the European Union AI Act (Regulation EU 2024/1689) advances across member states, Spanish regional legislation serves as an operational bridge between European-level risk categorization and the daily administrative operations of regional health services, social care systems, and public procurement boards.

Regulatory Approach

The regulatory approach across Spain's Autonomous Communities centers on human-centric AI governance, mandatory risk assessments, ethical auditing, and administrative transparency. Subnational legislative bodies and regional executive councils focus primarily on governing how public authorities acquire, design, and deploy algorithmic tools, ensuring that automated decision-making does not erode citizens' procedural rights or due process guarantees.

Galicia and Asturias have enacted formal binding regulatory instruments—most notably Galicia's Law 2/2025 and Asturias's Decree 98/2025—which impose affirmative duties on public authorities. These mandates include mandatory pre-deployment algorithmic impact assessments, public transparency registries for automated systems, human oversight mandates, and non-discrimination rules. Catalonia has adopted a complementary strategic and institutional model through the Catalonia AI 2030 Strategy and specialized institutional bodies like the Observatory of Ethics in Artificial Intelligence (OEIAC).

Across active Autonomous Communities, regional regulatory frameworks share a common philosophy: ensuring that the integration of artificial intelligence in public administration prioritizes transparency, maintains continuous human supervision, safeguards personal data, and guarantees equal treatment for all citizens interacting with subnational public services.

Key State Legislation

State and regional AI regulatory frameworks in Spain are structured by individual Autonomous Communities as follows:

• Galicia:
  • Ley 2/2025, de 2 de abril, para el desarrollo e impulso de la inteligencia artificial en Galicia: A landmark regional statute regulating the development, acquisition, and deployment of AI systems across the Galician public administration and public sector entities. The law establishes mandatory risk classification, ethical design standards, public transparency registries, and explicit human oversight rules for administrative acts.
• Asturias:
  • Decreto 98/2025, de 22 de julio, por el que se regula el uso de la Inteligencia Artificial en la Administración del Principado de Asturias y su sector público: A binding regional executive decree establishing operational guidelines for AI use within regional government departments. It regulates system safety, pre-deployment impact assessments, public disclosure of algorithmic tools, and civil service oversight.
• Catalonia:
  • Estratègia Catalunya IA 2030 (Catalonia AI 2030 Strategy): A comprehensive policy framework positioning Catalonia as a regional leader in ethical AI, focusing on public sector modernization, enterprise innovation, and research infrastructure.
  • Catalonia Office of Ethical and Responsible AI (OEIAC): An institutional body created to oversee fundamental rights protections, conduct ethical evaluations, and advise Catalan public authorities on trustworthy AI deployment.

Enforcement Bodies

Enforcement and operational oversight of regional AI regulations in Spain are assigned to specialized administrative directorates, digital transformation departments, and ethical observatories established within each Autonomous Community. In Galicia, Law 2/2025 entrusts supervisory authority to the regional agency responsible for technological modernization, supported by advisory bodies specializing in artificial intelligence ethics and administrative transparency.

In Asturias, oversight responsibilities under Decree 98/2025 are managed through the regional ministry responsible for public administration and digital transformation, working in coordination with internal algorithmic governance committees. In Catalonia, the Observatory of Ethics in Artificial Intelligence (OEIAC), alongside the Secretariat for Telecommunications and Digital Transformation, maintains regional algorithmic inventories, monitors public sector deployments, and issues ethical impact guidance across regional initiatives.

Penalties & Enforcement

Penalties and enforcement mechanisms under Spanish regional AI laws operate primarily through public administrative law, civil service disciplinary frameworks, and public procurement regulations. Because regional enactments govern public sector operations rather than broad commercial product safety, enforcement focuses on administrative remedies, contract invalidation, and procedural administrative checks rather than private market financial penalties.

Under regulations such as Galicia Law 2/2025 and Asturias Decree 98/2025, administrative decisions generated by AI systems that violate statutory transparency, human intervention, or non-discrimination rules are subject to administrative appeal and judicial nullification under standard administrative procedure laws. Furthermore, public sector contractors providing non-compliant AI software face contract termination, procurement debarment, and administrative penalties under public contracting rules.

Sector Focus Areas

Subnational AI regulations in Spain focus heavily on high-impact public domain sectors, with particular emphasis on public administrative procedures, healthcare delivery, social services, and public sector employment. Automated tools used to determine citizen eligibility for social subsidies, evaluate public employment applications, or process regional tax and licensing matters are subject to the highest level of regulatory scrutiny.

Healthcare and education within regional competence also constitute major focus areas. Regional health services in Galicia, Catalonia, and Asturias integrating AI for diagnostic assistance, patient triage, or healthcare resource allocation must comply with specialized ethical impact protocols, clinical human oversight mandates, and strict health data privacy standards established under both regional legislative frameworks and national data protection laws.

National/Federal Alignment

Regional AI legislation in Spain is explicitly designed to harmonize with national statutory frameworks and European Union mandates. At the national level, Spain created the Spanish Artificial Intelligence Supervision Agency (AESIA)—headquartered in A Coruña, Galicia—as the primary national authority under the EU AI Act (Regulation EU 2024/1689), alongside national administrative procedure statutes (Law 39/2015 and Law 40/2015).

Regional laws explicitly reference national and EU standards, ensuring that subnational definitions, risk classifications, and administrative requirements align with AESIA guidance and federal AI executive strategies. Autonomous Communities act as primary operational implementers, translating national policy principles and EU requirements into concrete rules for regional public procurement, public health management, and local administrative governance.

Notable Provisions

Spain's regional AI enactments feature several pioneering legal instruments that set benchmarks for subnational algorithmic governance across Europe. A prominent example is Galicia's statutory mandate establishing an official Public Algorithmic Register (Registro Público de Algoritmos), which guarantees citizens the right to inspect the basic logic, purpose, and impact assessments of any automated decision-making system deployed by regional authorities.

Another notable provision is featured in Asturias's Decree 98/2025, which mandates pre-deployment Algorithmic Impact Assessments (Evaluaciones de Impacto Algorítmico) addressing non-discrimination, ethical integrity, and environmental sustainability. Additionally, Catalonia's institutional model under the OEIAC introduces continuous lifecycle auditing, evaluating the societal and ethical impacts of public AI tools continuously rather than solely during initial public procurement.

Future Developments

As full enforcement of the European Union AI Act approaches, additional Autonomous Communities across Spain—including Andalusia, the Basque Country, and the Community of Madrid—are preparing regional legislative proposals and public administrative directives to structure their AI adoption. These emerging frameworks will focus on standardizing public sector AI procurement templates, establishing ethical review boards, and setting guidance for generative AI adoption within regional civil services.

Future developments will also emphasize deeper institutional coordination between regional digital administrative bodies and the national AESIA authority. Anticipated regulatory initiatives include joint regional-national regulatory sandboxes, standardized cross-regional public algorithmic registries, and updated civil service training programs focused on algorithmic auditing and human oversight.