Spain - AI Regulation Summary

Overview

Spain's autonomous communities are actively developing and implementing their own regulatory frameworks for Artificial Intelligence, demonstrating a proactive approach to governing this transformative technology at a sub-national level. Asturias, Catalonia, and Galicia have emerged as key regions leading this effort, each establishing distinct yet often complementary legal instruments and strategies. These state-level initiatives primarily focus on the responsible, ethical, and human-centric deployment of AI systems within their respective public sectors and administrations. The aim is to leverage the benefits of AI for improved public services while rigorously safeguarding citizens' fundamental rights and fostering public trust in AI technologies.

The regulatory landscape at the state level reflects a commitment to anticipating and addressing the challenges posed by AI, often in anticipation of or in direct alignment with broader European Union regulations and emerging national strategies. This regional activity highlights a decentralized yet harmonized effort to create a robust governance structure for AI, ensuring that technological advancement is coupled with strong ethical considerations and legal oversight. The regulations in force, predominantly from 2025, signify a rapid evolution in regional AI governance.

Regulatory Approach

The approach to AI regulation across Spanish autonomous communities largely centers on establishing comprehensive frameworks for the integration and use of AI within public administration. A common thread is the emphasis on ethical principles, transparency, accountability, and human-centric AI design and deployment. For instance, the regulations in Asturias and Galicia aim to ensure that AI systems in the public sector are designed, acquired, implemented, and used with full respect for good administration and the principles and rights outlined in their respective laws. This includes a focus on preventing biases, ensuring security, and maintaining human supervision.

While sharing core principles, there are variations in the specific regulatory instruments. Asturias and Galicia have opted for decrees and laws that establish a legal framework for AI use in their public sectors. Catalonia, on the other hand, has adopted a broader strategy, the Catalonia AI 2030 Strategy, which aims to position the region as a European leader in ethical, responsible, and secure AI, complemented by the establishment of an Office of Ethical and Responsible AI. These diverse approaches demonstrate a flexible yet principled commitment to AI governance, adapting to regional priorities and existing institutional structures.

Key State Legislation

• Asturias:
  • Asturias AI Public Administration Decree 2025: Establishes a comprehensive legal framework for AI integration within the regional public sector, focusing on transparency and ethical use.
  • Decreto 98/2025, de 22 de julio, por el que se regula el uso de la Inteligencia Artificial en la Administración del Principado de Asturias y su sector público: Enacted on July 22, 2025, this decree establishes a pioneering regulatory framework for the ethical, safe, and responsible use of AI within the Principality of Asturias's public administration and sector.
• Catalonia:
  • Catalonia AI 2030 Strategy (Estratègia Catalunya IA 2030): Approved in November 2025, this comprehensive plan aims to position Catalonia as a European leader in ethical, responsible, and secure AI.
  • Catalonia Office of Ethical and Responsible AI (OEIAC): Established in 2020, this office is a key part of Catalonia's AI strategy, focusing on ethical AI development and fundamental rights, acting as an advisor.
• Galicia:
  • Galicia AI Law 2/2025: Establishes a comprehensive framework for AI systems within the Galician public sector, ensuring responsible, ethical, and human-centric deployment aligned with EU and national regulations.
  • Ley 2/2025, de 2 de abril, para el desarrollo e impulso de la inteligencia artificial en Galicia: Enacted on April 2, 2025, this law establishes a pioneering framework for ethical AI in Galicia, focusing on public administration and aligning with EU and national AI regulations.

Enforcement Bodies

At the state level, the primary responsibility for the oversight and enforcement of AI regulations typically rests with the regional public administrations themselves. In Asturias, the implementation and supervision of the AI decree fall under the purview of the Administration of the Principality of Asturias and its public sector. Similarly, in Galicia, the General Administration of the Autonomous Community of Galicia and its public sector are tasked with ensuring the proper design, acquisition, implementation, and supervision of AI systems. These bodies are expected to integrate AI governance into their existing administrative structures and processes.

Catalonia has established a more specific entity, the Catalonia Office of Ethical and Responsible AI (OEIAC), which plays a crucial advisory role in ethical AI development and fundamental rights. Additionally, the Catalan Data Protection Authority (APDCat) is actively involved in AI oversight, particularly concerning data protection and the assessment of AI's impact on fundamental rights, aligning with the new EU AI Regulation. These regional bodies work to ensure compliance with the established principles and frameworks within their respective jurisdictions.

Penalties & Enforcement

While the specific state-level regulations provided do not explicitly detail monetary penalties, they are designed to establish comprehensive legal frameworks for the ethical, safe, and responsible use of AI, particularly within the public sector. Non-compliance with these frameworks would likely fall under general administrative law provisions or be subject to future detailed regulations. The emphasis is on ensuring adherence to principles such as transparency, human supervision, and the prevention of biases, with mechanisms for oversight and review.

It is important to note that state laws operate within the broader national and European regulatory landscape. The Spanish government is developing a draft law on AI governance that will establish a sanctioning regime, adapting national legislation to the EU AI Act. The Spanish Agency for the Supervision of Artificial Intelligence (Aesia), a national body, has indicated that sanctions for the misuse of AI in prohibited areas can reach up to 35 million euros, as stipulated by the EU AI Act. State-level enforcement would therefore align with and complement these national and EU-level penalty structures, ensuring a consistent and robust approach to AI governance across Spain.

Sector Focus Areas

The state-level AI regulations in Spain predominantly focus on the public sector and public administration. All the existing regulations from Asturias, Catalonia, and Galicia explicitly target the integration and use of AI systems within their respective regional public sectors. This focus reflects a strategic effort to modernize public services, enhance efficiency, and ensure that the benefits of AI are harnessed responsibly for the citizenry.

While the overarching focus is the public sector, the scope implicitly extends to various administrative functions within key societal areas. For instance, Asturias's decree aims to foster innovation in sectors such as healthcare, social-healthcare, and other administrative domains. Galicia's law also covers AI applications in daily digital services, administrative processes, healthcare, and education. This indicates that while not exclusively sector-specific, the regulations address the impact of AI across a broad spectrum of public services that directly affect citizens' lives.

National/Federal Alignment

Spanish state-level AI laws are designed with a clear intent to align with and complement both national and European Union (EU) AI regulations. The descriptions of the Asturias and Galicia regulations explicitly state their alignment with "EU and national AI regulations". This reflects a concerted effort to ensure coherence and avoid fragmentation in the regulatory landscape, particularly given the overarching influence of the EU AI Act, which is progressively coming into force.

Furthermore, the Spanish government has been actively working on a national draft law for the governance of AI, which aims to adapt Spanish legislation to the EU AI Act. This national framework, along with the establishment of the Spanish Agency for the Supervision of Artificial Intelligence (Aesia), provides a foundational layer upon which regional regulations can build. The state laws often serve as a localized implementation of these broader principles, allowing for regional specificities while adhering to common standards of ethical, responsible, and secure AI development and deployment. Spain has also proactively launched an AI regulatory sandbox to help providers comply with legislation, a measure that complements both national and regional efforts.

Notable Provisions

Several autonomous communities have introduced pioneering and notable provisions within their AI regulatory frameworks. Asturias, for instance, has established a "sandbox de IA" (AI sandbox) as a key feature of its regulation. This controlled testing environment allows for the evaluation of AI systems before their full deployment, ensuring data security, efficacy, and alignment with ethical and legal principles. This proactive approach to testing and validation is a significant step towards responsible innovation.

Catalonia stands out with its dedicated Catalonia Office of Ethical and Responsible AI (OEIAC), established in 2020, which serves as a crucial advisory body focused on ethical AI development and fundamental rights. Additionally, the Catalan Data Protection Authority has developed a pioneering "Modelo para la Evaluación de Impacto sobre los Derechos Fundamentales en el uso de IA (AIDF)" (Model for Fundamental Rights Impact Assessment in the use of AI), aligning with the new EU AI Regulation. Galicia's Ley 2/2025 emphasizes a comprehensive set of guiding principles, including traceability, explainability, absence of biases, security, privacy, accessibility, and human supervision, as fundamental requirements for AI systems within its public sector. These provisions collectively highlight a commitment to robust governance and human-centric AI development at the regional level.

Future Developments

The landscape of state-level AI regulation in Spain is expected to continue evolving rapidly. With the EU AI Act progressively coming into effect and the Spanish government's ongoing efforts to finalize its national draft law on AI governance, autonomous communities will likely further refine and expand their existing frameworks to ensure full alignment and effective implementation. This may include the development of more detailed implementing regulations, technical guidelines, and best practices tailored to regional contexts.

It is also anticipated that other autonomous communities in Spain may follow the lead of Asturias, Catalonia, and Galicia, introducing their own AI regulations to address the specific needs and priorities of their public administrations and citizens. The current pioneering efforts by these regions could serve as models for broader adoption across the country, fostering a more comprehensive and harmonized approach to AI governance at the sub-national level. Continued collaboration between regional and national authorities, as well as with the European Union, will be crucial in shaping the future trajectory of AI regulation in Spain, ensuring a balance between innovation and protection of fundamental rights.

State Regulations

State	Title	Type	Status	Year
Asturias	Asturias AI Public Administration Decree 2025	Decree	In Force	2025
Asturias	Decreto 98/2025, de 22 de julio, por el que se regula el uso de la Inteligencia Artificial en la Administración del Principado de Asturias y su sector público	Decree	In Force	2025
Catalonia	Catalonia AI 2030 Strategy (Estratègia Catalunya IA 2030)	Policy	In Force	2025
Catalonia	Catalonia Office of Ethical and Responsible AI	Framework	In Force	2020
Galicia	Galicia AI Law 2/2025	Act	In Force	2025
Galicia	Ley 2/2025, de 2 de abril, para el desarrollo e impulso de la inteligencia artificial en Galicia	Act	In Force	2025