EU AI Act Spain Implementation

Spain’s Implementation Status

Spain has positioned itself at the forefront of EU AI Act implementation, moving faster than any other member state to establish governance infrastructure. While most EU countries are still designating competent authorities, Spain’s regulatory framework has been operational for over a year.

Legislative Framework

Spain’s AI governance rests on three foundational legal instruments:

• Royal Decree 729/2023: Establishes AESIA’s statute, designating it as Spain’s national competent authority for AI supervision. Approved November 2023.^[1]
• Royal Decree 817/2023: Creates Europe’s first AI regulatory sandbox, providing a controlled environment for testing high-risk AI systems. In force since November 10, 2023.^[4]
• Draft AI Law (March 2025): Ley para el Buen Uso y la Gobernanza de la Inteligencia Artificial—implements and supplements the EU AI Act with domestic provisions on content labeling and a national penalty regime.^[2]

Spain’s draft national AI law underwent public consultation until March 26, 2025. The legislation is expected to be enacted before the August 2025 GPAI deadline, giving Spanish organizations early clarity on national requirements beyond the baseline EU AI Act.^[3]

Implementation Progress Compared to Other Member States

As of December 2025, Spain leads EU member states in implementation readiness:

AESIA: Spain’s National Competent Authority

The Agencia Espanola de Supervision de la Inteligencia Artificial (AESIA) is Spain’s dedicated AI supervisory agency—the first of its kind appointed in the EU in compliance with the AI Act. Headquartered in A Coruna, Galicia, AESIA has been operational since June 2024 under Director General Ignasi Belda.^[1]

AESIA’s Mandate and Powers

Decentralized Enforcement Model

Spain adopts a decentralized approach to AI Act enforcement. While AESIA serves as the primary supervisor for most high-risk AI systems, sector-specific authorities retain oversight within their domains:

• CNMC (Comision Nacional de los Mercados y la Competencia) — Competition and market aspects of AI systems
• AEPD (Agencia Espanola de Proteccion de Datos) — AI systems processing personal data, GDPR/LOPDGDD intersection
• Central Electoral Commission — AI systems affecting democratic processes
• AEMPS (Agencia Espanola de Medicamentos y Productos Sanitarios) — AI medical devices

Implementation Timeline

Spanish organizations must track both EU-level deadlines and Spain-specific milestones. The Spanish government’s proactive approach means certain obligations—particularly around AI content labeling—may apply earlier than in other member states.

Spain’s AI Regulatory Sandbox

Spain launched Europe’s first AI regulatory sandbox in June 2022, predating the EU AI Act’s final adoption. This pioneering initiative provides organizations a controlled environment to test high-risk AI systems with regulatory supervision before full market deployment.

Sandbox Structure and Benefits

Established under Royal Decree 817/2023, the sandbox creates a collaborative space between regulators and innovators:

Current Sandbox Cohort

In April 2025, twelve AI projects were selected for sandbox participation. These span high-risk categories including healthcare diagnostics, financial services risk assessment, and employment-related AI. Results will be synthesized into public guidance informing future national regulations.^[4]

The sandbox runs for 36 months from November 2023 or until the EU AI Act becomes fully applicable in Spain—whichever comes first. Organizations interested in future sandbox participation should monitor AESIA announcements for subsequent cohort calls.

High-Risk AI Categories for the Spanish Market

While the EU AI Act’s Annex III defines high-risk categories uniformly across member states, certain categories have particular relevance to Spain’s economic structure and regulatory priorities.

Tourism and Hospitality

Spain’s tourism sector—one of Europe’s largest—increasingly deploys AI for dynamic pricing, personalized recommendations, and customer service automation. High-risk considerations include:

• Biometric identification at hotels: Facial recognition for check-in or access control falls under Annex III Category 1
• Dynamic pricing algorithms: May trigger essential services scrutiny if affecting accommodation access
• AI chatbots and virtual concierges: Limited-risk transparency obligations under Article 50

Financial Services

Spain’s banking sector (Santander, BBVA, CaixaBank) and fintech ecosystem face significant high-risk exposure:

• Creditworthiness assessment: Annex III Category 5(a)—any AI evaluating natural persons’ credit eligibility
• Insurance pricing and underwriting: Annex III Category 5(b)—risk assessment and premium calculation
• Fraud detection systems: May require conformity assessment if used for access decisions

Healthcare

Spain’s public health system (SNS) and private healthcare providers deploying AI face dual regulatory oversight from AESIA and AEMPS:

• Clinical decision support systems: AI assisting diagnosis or treatment recommendations
• Medical imaging AI: Radiology, pathology, dermatology analysis systems
• Patient triage and prioritization: Emergency dispatch falls under Annex III Category 5(c)

Public Administration

Spanish public sector AI deployment requires particular attention given government scale and citizen impact:

• Benefits eligibility determination: Social security, unemployment, housing assistance
• Permit and license processing: AI-assisted decisions on applications
• Public service resource allocation: Scheduling, queue management, service prioritization

Employment

Spain’s significant gig economy and traditional employment sectors face extensive high-risk obligations:

• Recruitment and CV screening: Annex III Category 4(a)—any AI influencing hiring decisions
• Performance monitoring: Particularly relevant for platform/gig workers
• Biometric attendance systems: Spain’s draft AI law specifically penalizes use without proper human oversight^[2]

Article 12 Logging Requirements

Article 12 of the EU AI Act mandates that high-risk AI systems maintain automatic logging capabilities ensuring traceability throughout the system lifecycle. AESIA’s December 2025 guidance provides Spain-specific implementation templates.^[5]

Core Logging Requirements

Spain-Specific Considerations

Spanish organizations must align Article 12 logging with domestic data protection requirements under LOPDGDD (Spain’s GDPR implementation). Key considerations:

• Data minimization: Log only what’s necessary for traceability—avoid excessive personal data capture
• AEPD coordination: Where logging involves personal data, ensure GDPR-compliant processing basis
• Cross-border transfers: If logs are stored outside Spain/EU, apply appropriate transfer mechanisms

Sector-Specific Considerations

Healthcare AI in Spain

Healthcare AI operates at the intersection of AESIA oversight and existing medical device regulation under AEMPS. Organizations should:

• Determine whether AI constitutes a medical device under MDR (Regulation 2017/745)
• Coordinate conformity assessment between AEMPS notified bodies and AI Act requirements
• Implement clinical validation protocols aligned with both frameworks
• Note extended August 2027 deadline for AI as medical device safety components

Financial Services AI

Spanish financial institutions face overlapping requirements from AESIA, Bank of Spain, and CNMV. Key alignment areas:

• AI Act high-risk requirements for credit and insurance decisions
• EBA guidelines on machine learning in credit institutions
• Consumer protection requirements under Spanish banking law
• Algorithmic transparency obligations for automated decisions affecting consumers

Public Sector AI

Spanish public administration AI requires coordination with general administrative law and digital government frameworks:

• Law 40/2015 requirements for automated administrative decisions
• Transparency obligations under Spain’s access to information law
• Fundamental rights impact assessments for AI affecting citizens
• Public procurement considerations for AI system acquisition

Conformity Assessment Pathway

Spanish organizations with high-risk AI systems must complete conformity assessment before the August 2026 deadline. AESIA’s guidance documents provide implementation templates aligned with Articles 43-44.^[5]

Assessment Pathways

Spanish Notified Bodies

Spain is designating notified bodies for AI Act conformity assessments. Organizations requiring third-party assessment should:

• Monitor AESIA announcements for designated notified body lists
• Consider EU-wide notified bodies if Spanish capacity is constrained
• Initiate engagement 6-9 months before the August 2026 deadline

Enforcement & Penalties

Spain’s draft AI law establishes a domestic penalty regime aligned with—and in some areas exceeding—EU AI Act requirements. AESIA gains full sanctioning authority from August 2025.^[2][3]

Penalty Structure

Additional Enforcement Measures

Beyond fines, Spain’s draft AI law authorizes:^[2]

• System adaptation orders: Mandatory modifications to achieve compliance
• Commercialization prohibition: Barring market placement of non-compliant systems
• Public warnings: Reputational impact through official announcements
• System destruction: In extreme cases involving serious harm
• Temporary operation prohibition: Government authority to halt any AI system causing death or serious harm

AESIA’s Enforcement Approach

Director Belda has indicated AESIA will prioritize warnings and guidance before imposing fines. This creates opportunity for organizations demonstrating good-faith compliance efforts:^[3]

• Document compliance efforts thoroughly to evidence good faith
• Engage proactively with AESIA guidance and sandbox learnings
• Implement corrective actions promptly when issues are identified

Compliance Roadmap for Spanish Organizations

Given Spain’s advanced implementation status, organizations should accelerate compliance timelines compared to other EU markets. The following roadmap accounts for Spain-specific requirements and AESIA’s active enforcement posture.

Spain Compliance Roadmap

EU AI Act Spain Implementation

1

AI System Inventory & AESIA Alignment (Month 1)

Catalog all AI systems operating in Spain or serving Spanish customers. Classify per Annex III high-risk categories. Review AESIA’s 16 guidance documents for Spain-specific interpretation. Identify any systems potentially triggering prohibited AI provisions (already enforceable since February 2025). Prioritize content-generating AI for Spain’s labeling requirements.

2

Content Labeling Implementation (Month 1-2)

Spain’s national AI law prioritizes transparency for AI-generated content. Implement clear disclosure mechanisms for synthetic media, chatbots, and AI-assisted communications. Ensure labeling meets Spain’s specific requirements—penalties reach 35M EUR for serious non-compliance. Review deepfake and manipulated content detection capabilities.

3

Article 12 Logging Infrastructure (Month 2-4)

Implement automated logging per Article 12 requirements and AESIA guidance. Ensure traceability of inputs, outputs, and decisions. Document human oversight interventions. Align with LOPDGDD/GDPR data protection requirements. Establish tamper-evident storage and appropriate retention periods. Prepare for AESIA information requests upon enforcement authority activation in August 2025.

4

Risk Management & Technical Documentation (Month 3-6)

Establish continuous risk management per Article 9. Prepare Annex IV technical documentation using AESIA’s templates. Conduct bias assessments for Spanish market context (demographic, linguistic, cultural considerations). Document data governance practices per Article 10. Generate evidence of control execution—not just policy documentation.

5

Quality Management & Conformity Assessment (Month 4-9)

Establish Article 17 quality management system. For systems requiring notified body assessment, initiate engagement by Q1 2026 to ensure completion before August 2026 deadline. Prepare EU declaration of conformity and CE marking documentation. Coordinate with sector-specific regulators (AEMPS for healthcare, Bank of Spain for financial services) on overlapping requirements.

6

AESIA Readiness & Post-Market Monitoring (Ongoing)

Prepare for AESIA information requests and inspections. Establish Article 73 serious incident reporting procedures. Implement post-market monitoring tracking performance and user feedback. Maintain living documentation updated with system changes. Consider sandbox participation for future high-risk system development. Engage with AESIA guidance updates and emerging best practices.

Spain-specific insight: AESIA’s proactive enforcement stance means compliance delays carry higher risk than in other member states. However, the agency’s guidance-first approach rewards organizations that demonstrate good-faith efforts. Document everything—evidence of compliance intent can influence enforcement outcomes.

How GLACIS Supports Article 12 Compliance

Article 12’s logging requirements present a significant technical challenge: organizations must prove their AI controls actually execute—not just document that policies exist. GLACIS addresses this gap with cryptographic evidence generation.

The Article 12 Evidence Challenge

Traditional compliance approaches rely on policy documentation and periodic audits. But AESIA, like other market surveillance authorities, can request evidence that controls are actively functioning. This requires:

• Continuous monitoring: Real-time verification that controls execute as designed
• Tamper-evident records: Cryptographic proof that logs haven’t been modified
• Audit-ready documentation: Evidence packages formatted for regulatory review

GLACIS Continuous Attestation

GLACIS generates cryptographic evidence that AI governance controls execute correctly. This addresses Article 12 requirements by providing:

Frequently Asked Questions

References