Spain - AI Supervision Agency (729/2023)

Overview

Royal Decree 729/2023 (22 August 2023) approves the Statute that creates the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA). The Royal Decree and the inserted Statute establish AESIA as an autonomous public agency attached to the Ministry of Economic Affairs and Digital Transformation, with the mission to supervise, inspect, advise, raise awareness and provide training in relation to AI systems in Spain. The Statute was published in the Boletín Oficial del Estado and the full text is available in the official BOE publication (see BOE, Real Decreto 729/2023 (PDF)). AESIA is designed both to manage present risks and to anticipate obligations deriving from the proposed EU Regulation on Artificial Intelligence; it combines supervisory, coordination and capacity‑building roles to support trustworthy AI, promote regulated testing environments and act as Spain’s point of contact with EU bodies. The Agency’s seat is established in A Coruña and the Statute contains transitional measures for staffing, budgets and the constitution of the Governing Council within three months of entry into force.

Definitions

The Statute uses standard public‑law definitions and expressly refers to applicable EU and national law. Relevant terms include: the "Agency" (AESIA), "systems of artificial intelligence" (AI systems, understood broadly to include algorithmic systems), "supervision" (oversight and market surveillance activities), "high‑risk systems" (systems that may produce significant risks to health, safety or fundamental rights, in line with the EU AI regulatory approach), "providers" and "deployers" (natural or legal persons developing, placing on the market or using AI systems), and "testing environments" (regulated sandboxes and pilot spaces for lawful experimental use). The Statute also references the legal framework for public agencies under Law 40/2015 and the enabling provisions found in Law 28/2022 and the General State Budgets where relevant.

Governance and Institutional Framework

The Statute organizes AESIA’s governance with distinct corporate and executive bodies: the Presidency (political head), the Director (executive head), the Governing Council (Consejo Rector) as the principal governing body, and a Control Commission to provide oversight. The Council is to include representatives of several ministries (Economic Affairs and Digital Transformation, Finance, Industry, etc.) and an expert representative from the AI ecosystem; members are appointed by the responsible minister. The executive structure is set out to include a central Directorate, two Subdirectorates (one oriented to infrastructure and reporting; another to certification, evaluation, coordination and training) and a General Secretariat that provides administrative and legal support. The Statute clarifies appointment procedures, responsibilities and internal decision‑making rules. It also establishes obligations on transparency, public reporting and the production of an annual activity report. The Statute contemplates cooperation mechanisms with other national authorities such as the Agencia Española de Protección de Datos (AEPD) and sectoral ministries, and with EU bodies; operational guidance and memoranda of understanding may be concluded to formalize inter‑agency cooperation (see AESIA official site at AESIA official website for organizational updates and publications).

Key Focus Areas

The Agency’s primary competencies, as set out in the Statute, are supervision, inspection, advisory services, awareness‑raising and training. AESIA is empowered to supervise the deployment, commercialization and use of AI systems that may present significant risks to safety, health, equality of treatment, non‑discrimination and other fundamental rights. The Statute tasks AESIA with: (a) identifying risks and trends in AI deployment and proposing regulatory or operational responses; (b) promoting and facilitating regulated testing environments (sandboxes) to safely pilot AI innovations while protecting rights; (c) preparing operational guides and interpretative material to assist public and private actors to comply with applicable national and EU requirements; (d) coordinating national reporting and market surveillance activities; (e) acting as Spain’s point of contact with the European Commission and the envisioned European AI governance structures; and (f) performing inspection and sanctioning activities where lawfully empowered to do so. The Statute also highlights the Agency's role in supporting a gender perspective, sustainability, and in fostering skills and literacy programs to improve public understanding of AI impacts.

Implementation Framework

The Statute sets a structured implementation path: the Agency is constituted with the formation of its Governing Council within three months of the Real Decree’s entry into force; the Council appoints the Director and initial executive team. The Statute foresees the transfer and integration of personnel from other public bodies under equivalent legal arrangements (preserving rights and seniority), the subrogation of relevant contracts, and provisional budgetary arrangements to allow the Agency to start operations. AESIA must adopt a multi‑year management contract framework, prepare an initial inventory of assets, set up administrative and procurement practices and issue internal regulations. The Statute authorizes the relevant minister to issue additional development regulations to operationalize competences and to ensure alignment with future national legislation implementing the EU AI regulatory framework. Transitional provisions cover initial staffing, budget, and contract management to ensure continuity and legal certainty.

Monitoring and Evaluation

The Statute mandates transparency and accountability instruments including annual activity reports, publication obligations, and mechanisms for public communication. AESIA is required to produce an annual report detailing its supervisory activity, findings, enforcement actions (where applicable) and recommendations for regulatory or policy changes. The Agency shall maintain monitoring systems for market surveillance, early detection of prohibited or risky AI practices and performance indicators for its regulatory actions. Cooperation agreements with other administrative bodies are envisaged to share data and inspection resources. The Statute also provides the legal basis for AESIA to develop technical and methodological guides for risk assessment, conformity assessment and evaluation of AI systems in coordination with sectoral authorities.

Penalties, Liability, and Appeals

The Statute provides AESIA with powers to inspect, investigate and, within the limits of applicable law, to propose or impose corrective measures and sanctions in accordance with national and EU law. While the Real Decree establishes the Agency’s sanctioning role in principle, the concrete sanctioning powers, categories of infractions and fines are defined by the applicable legal framework (including existing administrative sanctioning regimes and future implementing national legislation aligned with the EU AI Act). The Statute also lays out procedural safeguards, requirements for due process and coordination with judicial and administrative review mechanisms; persons and entities affected by administrative decisions have access to ordinary appeal routes under administrative law. The Agency must respect rights to defense and judicial protection in the exercise of sanctioning or restrictive measures.

Relationship to Other Instruments

The Statute explicitly situates AESIA within Spain’s public‑law framework (Law 40/2015 on the legal regime of the public sector) and references enabling provisions such as Law 28/2022 and the General State Budgets that provided the basis for the Agency’s creation. It is designed to operate in complementarity with sectoral authorities (e.g., Ministry of Health and the Spanish Medicines and Medical Devices Agency for medical devices and health applications; Labour and Social Security Inspectorate for labor relations; and the Agencia Española de Protección de Datos for data protection matters) and to respect existing sectoral competences, while assuming national supervision responsibilities that derive from the EU AI regulatory framework. The Statute also empowers AESIA to enter into cooperation agreements and memoranda with other public bodies and international entities to coordinate supervision and enforcement activities.

International Alignment

The Statute anticipates AESIA’s role as Spain’s national supervisory authority under the proposed EU Regulation on Artificial Intelligence: to act as the single point of contact with the Commission, to represent Spain in EU AI governance structures and to coordinate cross‑border supervisory activity. The Statute also stresses adherence to international standards and collaboration with EU and third‑country authorities in matters such as model evaluation, conformity assessment, certification schemes and cross‑border incident response. AESIA is positioned to engage in multilateral forums, to promote alignment with OECD AI principles and European interoperability approaches, and to contribute to the development of common technical and procedural instruments at EU level (for example, operational guides and joint investigations).

Implementation Timeline

Sources and References