Spain
The EU AI Act, Regulation (EU) 2024/1689, applies in Spain directly and phases in through 2028, so its prohibitions, general-purpose model duties, and Article 50 transparency duties already bind anyone placing AI systems on the Spanish market. Spain set up a dedicated supervisor, AESIA in A Coruña, in 2023. The national companion law that would name Spain's enforcement authorities and set its sanctions procedure, the Organic Law on the Good Use and Governance of AI, has been before Congress since May 2026, alongside two bills aimed at deepfakes.
Key points
- AI Act bans have applied in Spain since February 2, 2025, general-purpose model duties since August 2, 2025, and Article 50 transparency duties since August 2, 2026. Stand-alone high-risk obligations follow on December 2, 2027.
- AESIA, the Spanish Agency for the Supervision of Artificial Intelligence, is based in A Coruña. Its statute took effect on September 3, 2023, before the AI Act itself was adopted.
- The AI governance bill (121/000096) would make AESIA the default authority and assign sector cases to the data protection agencies (the AEPD and its regional counterparts), the Bank of Spain, the CNMV, the insurance supervisor, and the General Council of the Judiciary. Its amendment period, first set to close on June 30, 2026, has been extended repeatedly, week by week since September, most recently to October 7, 2026.
- Until that bill passes, Spain has no national law defining AI Act infringements and the procedure for sanctioning them. The European Commission enforces the general-purpose model rules directly.
- Two more bills target deepfakes. The honor, privacy, and image bill (121/000103) would make using or spreading hyper-realistic synthetic images or voices of a person an unlawful intrusion, and the bill on minors in digital environments (121/000052) would create a crime of spreading sexual or degrading deepfakes.
- Since 2021, works councils have had a right to be told how the algorithms and AI systems that shape hiring, working conditions, and dismissals reach their decisions.
Laws and instruments
EU AI Act (applies directly in Spain)
Binding in Spain without transposition. Bans on prohibited practices have applied since February 2, 2025, general-purpose model obligations since August 2, 2025, and Article 50 transparency duties since August 2, 2026, with generative systems already on the market given until December 2, 2026 for machine-readable marking. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved stand-alone high-risk (Annex III) obligations to December 2, 2027 and product-embedded (Annex I) ones to August 2, 2028.
Organic Law on the Good Use and Governance of AI (bill)
Would adapt the AI Act to Spanish law. Approved by the Council of Ministers on May 26, 2026, it would make AESIA the default market surveillance authority and give sector cases to the data protection agencies (the AEPD and its regional counterparts), the Bank of Spain, the CNMV, the Directorate-General of Insurance and Pension Funds, and the General Council of the Judiciary, while AI built into regulated products stays with the existing product-safety authorities. It would sort AI Act infringements into very serious, serious, and minor ones, set the sanctioning procedure, give public bodies warnings instead of fines, and require every entity in the state public sector to appoint an AI delegate.
Statute of the Spanish AI Supervisory Agency (AESIA)
Establishes AESIA, based in A Coruña, to supervise, advise, raise awareness, and train public and private bodies on national and European AI rules, including certification frameworks and testing environments. The pending governance bill would make it Spain's central AI Act authority.
Rider Law: algorithm transparency at work
Gives works councils the right to be told the parameters, rules, and instructions behind algorithms or AI systems that shape decisions on working conditions, hiring, and keeping a job, profiling included. It reaches every employer with worker representatives, delivery platforms among them.
Equal Treatment Law, article 23 (algorithms in public decisions)
Directs public administrations to favor mechanisms so that the algorithms used in their decisions account for bias minimization, transparency, and accountability, to put transparency and interpretability first in their design, and to promote a quality seal for algorithms.
Organic Law on honor, privacy, and image (bill, deepfakes)
Would update Spain's civil protection of honor, privacy, and image for social media and AI. Using or spreading a person's image or voice that has been created, simulated, or manipulated to look extremely realistic would become an unlawful intrusion, as would using a name, voice, or image for advertising, commercial, or similar purposes even when simulated. Manifestly creative, satirical, artistic, or fictional works could use such images or voices of public officials and public figures, but whoever spreads content that could be mistaken for authentic would have to disclose that it was artificially generated or manipulated. Minors aged 16 or older would be presumed able to consent, and people could bar commercial use of their image or voice after death.
Organic Law on protecting minors in digital environments (bill)
Would add a Criminal Code offense (new article 173 bis) for spreading, without consent and to damage a person's moral integrity, images or voice generated or altered by AI or other technology that simulate sexual or seriously humiliating situations, and would target grooming by adults who use a false identity. It would also raise the age of consent for processing personal data to 16 and require devices to ship with free parental controls switched on.
Timeline
- August 12, 2021Works councils gain a right to know how workplace algorithms decide (Rider Law).
- July 14, 2022Equal Treatment Law article 23 sets duties for algorithms in public decisions.
- September 3, 2023AESIA's statute takes effect; the agency is based in A Coruña.
- November 10, 2023Royal Decree 817/2023 sets up a pilot AI regulatory sandbox.
- February 2, 2025AI Act prohibitions apply in Spain.
- March 25, 2025Council of Ministers approves the bill on minors in digital environments.
- September 10, 2025Congress rejects an amendment to the whole of the minors bill, which moves on to article amendments in committee.
- May 26, 2026Council of Ministers approves the AI governance bill.
- June 12, 2026The AI governance bill is published in Congress.
- July 7, 2026Council of Ministers approves the honor, privacy, and image bill; Congress publishes it on July 27.
- August 2, 2026AI Act transparency duties apply.
- September 29, 2026The Justice Committee rapporteurs accept transactional amendments to the minors bill; the deepfake offense is untouched.
- December 2, 2026EU ban on AI that generates non-consensual intimate imagery and child sexual abuse material applies.
- December 2, 2027Stand-alone high-risk (Annex III) obligations apply.
Who it applies to
Providers, deployers, importers, and distributors of AI systems placed on the market or used in Spain, and providers of general-purpose AI models, under the AI Act. Employers with worker representatives must explain workplace algorithms, and public administrations carry the Equal Treatment Law's algorithm duties. The deepfake bills would reach anyone who uses or spreads a realistic synthetic image or voice of a real person, with civil liability under the honor bill, subject to its exceptions, and a crime under the minors bill for spreading such material in sexual or seriously humiliating situations without consent.
Penalties
The AI Act caps fines at EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other breaches, and EUR 7.5 million or 1% for supplying incorrect information. Spanish authorities have no national procedure to impose them until the governance bill passes. As introduced, the bill would cap fines at EUR 35 million or 7% for prohibited practices, EUR 15 million or 3% for other very serious infringements, EUR 7.5 million or 1% for serious ones, and EUR 500,000 or 0.5% for minor ones, with warnings instead of fines for public bodies. The minors bill would add prison terms for spreading sexual or degrading deepfakes.
Common questions
Does Spain have a comprehensive AI law?
What are the penalties for AI violations in Spain?
Who does AI regulation in Spain apply to?
Artificial Intelligence Regulations, "AI Regulation in Spain," reviewed October 2, 2026, https://artificialintelligenceregulations.com/jurisdictions/spain.html.
Entries state the position as of the review date and link to the primary text for verification.