Spain AI Regulation Overview

Overview

Spain's national approach to artificial intelligence regulation has evolved from strategic policy frameworks into a comprehensive, binding regulatory system aligned with European Union law. Early foundational initiatives—including the Spanish Strategy for AI in R&D&I (2019), the National Artificial Intelligence Strategy (ENIA, 2020), and the Spanish Digital Rights Charter (2021)—established national priorities centered on research excellence, human-centric development, digital rights protection, and ethical deployment across public and private sectors.

To support transition from policy goals to active oversight, Spain established dedicated administrative infrastructure. Royal Decree 729/2023 created the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA), making Spain one of the first EU Member States to establish a specialized independent supervisory authority for AI. Additionally, Royal Decree 817/2023 launched the National AI Sandbox (Entorno controlado de pruebas) to enable supervised testing of high-risk AI systems prior to full market deployment. Strategic investments under NextGenerationEU further support research chairs via Order ETD/1180/2022 (Cátedras ENIA, as modified by Order TDF/304/2025) and sustainable AI practices through the National Programme for Green Algorithms (PNAV).

The central statutory milestone in Spain's regulatory architecture is the draft organic law (Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial). Approved in first reading by the Council of Ministers on 11 March 2025 and subsequently submitted to the Cortes Generales in 2026, this legislation adapts Spain's national legal order to the EU AI Act (Regulation (EU) 2024/1689). It designates domestic authorities, institutes provisional market withdrawal powers, codifies transparency obligations for generative AI, and outlines administrative sanctioning mechanisms.

Regulatory Approach

Spain enforces a hybrid, risk-based regulatory framework heavily anchored in European Union product safety and fundamental rights principles. The regulatory system differentiates AI practices by risk tier: prohibited (unacceptable) practices are banned outright, high-risk AI systems are subject to rigorous mandatory compliance obligations, and lower-risk systems face specific transparency and labeling requirements. Promotional soft-law instruments (such as the Digital Rights Charter and PNAV guidance) operate alongside binding legal decrees and formal statutory prohibitions.

Under the draft Organic Law on AI, prohibited practices mirror EU prohibitions already in effect, including subliminal manipulation, exploitation of vulnerable groups, discriminatory biometric categorization, social scoring, predictive criminality profiling, and unpermitted emotion recognition in workplace or educational settings. High-risk systems—tied to critical infrastructure, employment, education, essential services, biometrics, justice, and migration—require risk management systems, human oversight, detailed technical documentation, robust data governance, logging, cybersecurity safeguards, and CE marking/conformity assessment.

In addition, Spain emphasizes proactive regulatory guidance and controlled experimentation. Through the National AI Sandbox, deployers and developers can evaluate compliance under administrative supervision before placing products on the market. Furthermore, transparency regulations mandate that generative content and deepfakes (AI-generated or manipulated images, audio, or video depicting real or fabricated persons) must be clearly labeled at the first interaction or point of exposure.

Key AI Legislation

• Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial (2025): Primary national bill adapting Spain's legal framework to the EU AI Act. Codifies prohibited uses, high-risk compliance requirements, generative content labeling, provisional market withdrawal powers, and a three-tiered administrative sanction regime.
• Royal Decree 817/2023 (National AI Sandbox): Established the Entorno controlled de pruebas para una inteligencia artificial confiable, enabling supervised operational testing of high-risk AI systems to validate compliance with the EU AI Act.
• Royal Decree 729/2023 (Statute of AESIA): Approved the statute establishing the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA) as an autonomous entity of public law tasked with market surveillance, inspection, guidance, and AI oversight.
• Order ETD/1180/2022 & Order TDF/304/2025 (Cátedras ENIA): Regulatory bases governing NextGenerationEU-funded university–industry research chairs in AI, setting financial flexibility, staffing rules, and verification requirements under RRF milestone CID 253.
• National Programme for Green Algorithms (PNAV, 2022): Policy framework (Measure 20 of ENIA) establishing energy consumption calculators, Green Tech quality seal certifications, and 'Green by Design' technical standards for AI models.
• Spanish Digital Rights Charter (Carta de Derechos Digitales, 2021): Non-normative reference policy framing fundamental constitutional rights in digital and AI environments, focusing on algorithmic non-discrimination, transparency, and human oversight.
• National Artificial Intelligence Strategy (ENIA, 2020): Whole-of-government strategic roadmap allocating recovery funds across six axes to advance R&D, talent attraction, language infrastructure (LEIA), value chain integration, and ethical governance.
• Spanish Strategy for Artificial Intelligence in R&D&I (2019): National strategic framework prepared by the Ministry of Science to orient public and private R&D&I funding toward priority application sectors and cross-cutting AI technologies.
• Basque Country AI Strategy (2022): Regional strategic framework integrated into Euskadi's digital transformation agenda, managed alongside the Basque Artificial Intelligence Center (BAIC) to foster industrial AI adoption and data governance.

Governance & Enforcement Bodies

Spain's administrative oversight structure is anchored by the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA), an autonomous public agency attached to the Ministry for Digital Transformation via the Secretaría de Estado de Digitalización e Inteligencia Artificial (SEDIA). AESIA serves as the primary supervisory and market surveillance authority for AI matters not explicitly delegated to specialized sectoral regulators. Its mandate includes conducting inspections, issuing technical guidance, coordinating national sandboxes, and acting as Spain's single point of contact with the European AI Office and the European network of AI supervisory bodies.

Sectoral oversight is distributed among specialized pre-existing regulatory authorities. The Agencia Española de Protección de Datos (AEPD) maintains jurisdiction over personal data protection, privacy-by-design, and biometric processing. Judicial applications are monitored by the Consejo General del Poder Judicial (CGPJ), electoral processes by the Junta Electoral Central (JEC), and financial market applications by the Banco de España, the Dirección General de Seguros y Fondos de Pensiones (DGSFP), and the Comisión Nacional del Mercado de Valores (CNMV).

Policy coordination, sandbox execution, and grant management are led by SEDIA in coordination with central ministries and executing agencies like Red.es. Territorial execution and regional ecosystem diagnostics are supported by specialized bodies such as the Basque Artificial Intelligence Center (BAIC) and the public-private Observatorio de Derechos Digitales.

Penalties & Enforcement

Enforcement and administrative penalties under Spanish AI law are structured around a three-tiered system (very serious, serious, and minor infringements) aligned directly with the maximum financial limits set by the EU AI Act. Monetary fines for serious breaches can range from hundreds of thousands of euros up to tens of millions of euros, or up to 7% of an undertaking's total worldwide annual turnover for the most critical violations involving prohibited AI practices, with specific lower caps provided for small and medium-sized enterprises (SMEs).

In addition to administrative fines, national supervisory authorities possess provisional enforcement powers. Under the draft Organic Law, authorities can order provisional digital market withdrawals, restrict commercialization, or mandate immediate corrective adaptations if an AI system causes a grave incident—such as an event resulting in death, major environmental damage, or critical infrastructure failure. Compliance with public funding conditions (such as Cátedras ENIA grants or PNAV subsidies) is enforced under Law 38/2003 (General Subsidies Act), where unauthorized budget deviations or failure to justify expenditure trigger grant revocation, administrative recovery, and potential exclusion from future public calls.

Data Protection Framework

Data governance within Spanish AI systems is grounded in existing EU and national data protection frameworks, notably the General Data Protection Regulation (GDPR) and Title X of Spain's Organic Law 3/2018 on Data Protection and Digital Guarantees. These frameworks establish mandatory standards for personal data processing, lawful basis, data minimization, user consent, and restrictions against automated profiling without adequate legal grounds.

The Agencia Española de Protección de Datos (AEPD) collaborates with AESIA and SEDIA to ensure that AI developments—including those undergoing testing within the National AI Sandbox—incorporate privacy and security by design. System providers and deployers must maintain data provenance records, perform data protection impact assessments, and implement measures to prevent algorithmic bias or discriminatory profiling based on sensitive personal attributes.

Sector-Specific Rules

Sector-specific rules adapt AI requirements to sensitive application domains. In employment and education, national rules prohibit the use of AI systems for unfair emotion recognition or discriminatory candidate screening. Public sector deployment is governed by specific ethical standards, including public algorithmic transparency registers, GobTechLab testing facilities, and strict adherence to digital rights principles outlined in the Spanish Digital Rights Charter.

In financial services, insurance, and capital markets, AI systems are subject to combined supervision by the Banco de España, CNMV, and DGSFP to prevent systemic risk, credit discrimination, and market manipulation. Environmental sustainability in AI computation is specifically regulated via the National Programme for Green Algorithms (PNAV), which introduces Green Tech quality seals, standardized metrics for energy and water consumption during model training and inference, and guidelines for efficient data center operations.

International Alignment

Spain's AI legal architecture is fully aligned with European Union regulatory initiatives. The domestic statutory framework explicitly implements Regulation (EU) 2024/1689 (the EU AI Act), ensuring that definitions, risk categories, prohibited uses, and conformity assessment pathways match EU standards. Spain's National AI Sandbox was established directly to meet Member State sandbox obligations under EU timelines and shares empirical testing data with the European Commission and the European AI Office.

Furthermore, Spain's strategic initiatives support broader international commitments. Programs like PNAV and ENIA align with the European Green Deal, EU Digital Rights and Principles, and international standardisation efforts executed in coordination with Grupo UNE and AENOR. Funding structures across Cátedras ENIA and national AI research calls strictly comply with EU Recovery and Resilience Facility (NextGenerationEU) rules and Do No Significant Harm (DNSH) environmental principles.

Future Developments

The primary upcoming legal milestone is the parliamentary passage and final enactment of the Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial. Following its approval by the Council of Ministers and submission to the Cortes Generales in 2026 under urgent procedure, the final law will formalize AESIA's full sanctioning powers, operationalize sectoral coordination protocols, and mandate public registration for high-risk AI deployments.

Operational developments include the evaluation and guidance outputs resulting from the National AI Sandbox's initial cohort of 12 selected high-risk systems, mid-term and final evaluations of the National Programme for Green Algorithms (PNAV), and the transition of Cátedras ENIA university-industry chairs into Phase 2 co-financing following RRF milestone CID 253 completion.

Enforcement Bodies