AI Governance for Spanish Companies: EU AI Act, AEPD and the Regulatory Framework

The Spanish regulatory context for AI

Spanish companies operate at the epicentre of the European AI regulatory ecosystem. As an EU Member State, Spain is directly subject to the EU AI Act. But beyond the European framework, Spain has its own regulatory ecosystem that interacts with the EU AI Act: the AEPD with its competences over data protection and AI, AESIA as the new AI supervisory authority, and the sectoral supervisors, the Banco de España and the CNMV, for the financial sector.

AESIA: the new Spanish AI supervisory authority

Spain created the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) in response to the requirement in the EU AI Act to designate a market surveillance authority. AESIA has competences to supervise compliance with the EU AI Act in Spain, promote the responsible use of AI, manage the AI regulatory sandbox established by Royal Decree 817/2023 of 8 November, and coordinate with other national and European authorities.

For Spanish companies, the creation of AESIA means there is a dedicated interlocutor for AI governance matters in Spain. Companies with questions about the classification of their AI systems or the applicable requirements can approach AESIA, especially through the regulatory sandbox for innovative systems that need regulatory clarification.

The AEPD and the GDPR-AI intersection

The Spanish Data Protection Agency has been one of the most active European data protection authorities on AI. The AEPD has issued specific guidance on: the compliance of AI systems with the GDPR, requirements for automated decision-making under Article 22 of the GDPR, data protection impact assessments (DPIAs) for AI systems, and the processing of special category data in AI systems.

For Spanish data controllers, the guidance from the AEPD is the starting point for assessing the GDPR compliance of their AI systems. The AEPD has shown a willingness to act: its rulings on automated systems and profiling set precedents for every data controller in Spain.

Sectoral supervision: Banco de España and the CNMV

Spanish financial institutions (banks, credit institutions, investment firms, pension funds) sit at the intersection of multiple AI regulatory frameworks. The Banco de España has issued communications on technology risk management that apply to AI, with specific expectations for credit scoring models and fraud detection systems. The CNMV supervises the use of AI in financial advice, algorithmic trading and client communications in the securities sector.

The National AI Strategy: incentives for responsible governance

Spain has a National Artificial Intelligence Strategy (ENIA), updated in 2024, which includes incentives for the responsible adoption of AI. Companies that demonstrate solid AI governance practices can access: the regulatory sandbox managed by AESIA, CDTI funding programmes for AI projects with a governance framework, and recognition within the European trustworthy AI ecosystem. This means that AI governance is not just a compliance cost for Spanish companies; it can be a lever for access to public resources and competitive advantage.