Spain occupies an unusual position in Europe's emerging AI governance architecture. Years before the EU AI Act imposed continent wide transparency duties on employers using artificial intelligence, Spain had already legislated a narrower but concrete right: the right of workers' representatives to know how the algorithms managing gig and platform workers actually operate. That right, created by the so called Ley Rider (Rider Law), is now colliding and in places reinforcing the AI Act's own employment provisions, while Spain's data protection authority and its new AI supervisory agency both claim a piece of the oversight terrain. This piece sets out what the Ley Rider actually requires, how it has been enforced, and what it means in practice for platform companies operating in Spain today.

What the Ley Rider actually is

The "Ley Rider" is the informal name for Real Decreto-ley 9/2021, of 11 May, which amended the consolidated text of Spain's Workers' Statute (Estatuto de los Trabajadores, approved by Real Decreto Legislativo 2/2015). It was published in the Boletín Oficial del Estado on 12 May 2021 and entered into force three months later, on 12 August 2021, under a transitional period built into this particular decree to give platforms time to adjust their operations before the new rules took effect. That delay was a specific, negotiated feature of this law rather than a general rule for decree laws of this kind, which in Spain are justified by urgency and typically enter into force immediately upon publication. It was subsequently ratified by Spain's Congress and converted into ordinary legislation as Ley 12/2021, of 28 September 2021, giving it durable statutory status beyond the provisional decree law mechanism.

The reform did two distinct things. First, it inserted a new twenty third additional provision into the Workers' Statute creating a legal presumption of employment status for people who provide paid delivery or distribution services on behalf of employers exercising organizational, directive and control powers, directly, indirectly or implicitly, "through the algorithmic management of the service or of working conditions, via a digital platform." In practice this reversed the burden of proof that platforms had relied on to classify delivery riders as self employed contractors rather than employees, as summarized in contemporaneous legal commentary from Garrigues.

Second, and of most interest for AI governance purposes, the decree added a new letter d) to Article 64.4 of the Workers' Statute. This provision grants the works council (comité de empresa) the right to be informed by the company of "the parameters, rules and instructions on which the algorithms or artificial intelligence systems are based that affect decision making that may affect working conditions, access to and maintenance of employment, including the elaboration of profiles." This is Europe's first dedicated statutory algorithmic transparency duty aimed specifically at the employment relationship, and it predates the EU AI Act's equivalent provisions by roughly three years.

Scope and limits

The presumption of employment is narrowly drawn. It applies to the delivery or distribution of consumer products or merchandise where algorithmic management is used to organize the work, which in practice has meant food and parcel delivery riders working for platforms such as Glovo, Deliveroo and Just Eat. Ride hailing platforms such as Uber and Cabify fall outside the presumption's direct scope because they provide passenger transport rather than delivery of goods, a distinction legal commentators have repeatedly flagged as a gap in the law's coverage.

The algorithmic information duty under Article 64.4.d, by contrast, is drafted more broadly and is not limited to delivery platforms. It applies to any company whose algorithms or AI systems influence decisions on working conditions, hiring, or continued employment, and employment law commentary, including analysis published by Giménez-Salinas, has read the duty as potentially reaching a wide range of workplace systems, such as scheduling software, productivity tracking tools, recruitment screening systems and performance scoring, not solely platform work. The precise boundaries of which systems fall within the duty are best confirmed against the statutory text and any implementing case law rather than assumed from commentary alone. The duty, however, runs to workers' collective representatives rather than to individual employees, and it is expressly balanced against trade secret protection and data protection law: companies may withhold strategic or technically sensitive details provided they give the works council a functional explanation sufficient to understand the algorithm's impact on the workforce, rather than the code or training data itself.

Enforcement so far

Enforcement to date has centered overwhelmingly on the employment status presumption rather than on stand alone breaches of the information duty. Spain's Labour and Social Security Inspectorate (Inspección de Trabajo y Seguridad Social, ITSS) sanctioned Glovo with a fine of approximately 57 million euros in January 2023, covering false self employment findings affecting more than 7,000 riders in Madrid together with penalties for employing foreign workers without permits, bringing the company's cumulative fines from labour inspection actions nationwide to more than 205 million euros, according to reporting by elDiario.es and tracked by the Eurofound Platform Economy Repository. In January 2024, press accounts reported a further ITSS sanction proposal against Glovo covering 49 riders in Asturias, which Infobae described as the first case explicitly framed around the rider law's employment presumption in that region.

The cumulative regulatory and litigation pressure appears to have driven a change in business model rather than continued contestation. By December 2024, Glovo announced it would transition its Spanish delivery workforce, reported at roughly 15,000 riders across more than 900 locations, to direct employment status, a shift the Eurofound repository links to the accumulated legal uncertainty and financial exposure created by repeated inspection findings.

More recently, enforcement attention appears to be broadening beyond delivery riders. Legal commentary from Legalia describes a Labour Inspectorate campaign extending scrutiny of algorithmic management, invoking Article 64.4.d specifically, toward platforms operating in the ride hailing and logistics sectors, with inspectors reportedly requesting documentation on the algorithms used in hiring, scheduling and performance evaluation. The specific companies and inspection details described in that commentary could not be independently corroborated here, so this should be read as an emerging enforcement direction worth monitoring rather than a fully confirmed campaign. If accurate, it would suggest the information duty, largely dormant relative to the employment status presumption during the law's first years, is becoming an active enforcement vector in its own right.

Where AEPD fits

The Ley Rider's algorithmic transparency duty does not operate in isolation from Spain's data protection regime. The Agencia Española de Protección de Datos (AEPD) treats algorithmic management of workers as squarely within its remit under the GDPR and Spain's Ley Orgánica de Protección de Datos, particularly where profiling or automated decision making affecting individual workers is involved, engaging Article 22 GDPR rights that operate alongside, and independently of, the collective information right created by Article 64.4.d. The AEPD first issued a practical guide titled "Protección de datos y relaciones laborales" (Data protection and labour relations) in 2021, developed with input from the Ministry of Labour, employer associations and trade unions, according to the AEPD's own press release announcing that guide, which at the time framed it around workplace questions including social media checks, whistleblowing systems, time registration and wearable monitoring devices. The guide was updated again in December 2025, and industry coverage of that revision by Lefebvre links the update to a growing volume of workplace questions concerning automated decisions, algorithms, artificial intelligence and monitoring technologies, though the exact wording AEPD used to frame the December 2025 update should be confirmed directly against the agency's current materials rather than the original 2021 announcement. The practical distinction platform companies need to track is that the Workers' Statute duty concerns disclosure of the algorithm's logic to collective representatives, while AEPD's remit concerns the lawfulness of the underlying personal data processing and any automated decisions taken about identifiable individuals. Both regulators can act on the same underlying algorithmic system from different legal angles simultaneously.

Where the EU AI Act fits

The EU AI Act (Regulation (EU) 2024/1689) layers a third, directly applicable framework on top of the domestic picture. Annex III of the Regulation classifies as high risk AI systems used for "employment, workers' management and access to self employment," a category covering recruitment and candidate screening as well as systems used to decide on promotion, termination, task allocation or the monitoring and evaluation of performance and behaviour in a work relationship, per the official text summarized on the European Commission's AI Act Service Desk. Draft Commission guidelines on high risk classification, discussed in 2026 legal commentary from DLA Piper, are described by that commentary as extending this category to freelancers, independent professionals and platform workers regardless of contractual status wherever an AI system mediates or conditions their access to work. That specific characterization of the draft guidelines should be verified against the Commission's own published text, but if accurate it would bring gig platform algorithms within the AI Act's employment category even for workers who are not classified as employees under national law.

Article 26(7) of the AI Act separately requires deployers that are employers to inform workers' representatives and affected workers, before putting a high risk AI system into use at the workplace, that they will be subject to it, following applicable national rules on worker information and consultation, as set out on the AI Act Service Desk's Article 26 page. In Spain, that national procedural channel already exists in the form of Article 64.4.d, meaning Spanish works councils arguably had a functioning algorithmic disclosure mechanism to plug into years before the AI Act's obligations reach practical application. Because Annex III high risk obligations, including Article 26, were deferred under the Digital Omnibus to 2 December 2027, while the AI Act's general transparency obligations under Article 50 remain on track to apply from 2 August 2026, platform companies in Spain face two, not one, live transparency regimes running on different clocks well before the AI Act's employment specific machinery becomes binding.

AESIA and the push for a Spanish AI at work law

Spain's dedicated AI supervisory agency, AESIA (Agencia Española de Supervisión de Inteligencia Artificial), created in 2023 as the EU's first dedicated national AI regulator, is expected to coordinate with the Labour Inspectorate and the AEPD on algorithmic oversight in employment settings as its enforcement mandate under the AI Act matures. Separately, and notably, Spain's Ministry of Labour under Vice President Yolanda Díaz has signalled an intention to press for a Spanish specific regulatory framework on algorithmic management at work that would go beyond the AI Act's own minimum standards and would not wait for the Regulation's 2027 high risk compliance deadline, according to reporting by LawAndTrends on the measures under discussion. Whether that reporting frames the Ley Rider explicitly as the precedent for this push is a detail worth confirming against the original coverage directly, though the parallel fits naturally with Spain's track record on algorithmic transparency at work. This sits alongside the broader Proyecto de Ley Orgánica de IA still before the Spanish Congress, which as of this writing had not been enacted. Platform companies should treat the current rider law framework as a floor rather than a ceiling on what Spain may require of workplace algorithms.

Practical implications for platform companies

For platform and gig economy companies operating in Spain, the layered structure described above creates several concrete obligations that compound rather than substitute for one another. Companies should maintain a current inventory of every algorithm or AI system that touches hiring, scheduling, task allocation, performance scoring, or account suspension and termination, together with functional, non technical explanations of what each system optimizes for and what data it uses, sufficient to satisfy a works council information request under Article 64.4.d without disclosing trade secrets. They should be able to produce documentary evidence that such disclosures were actually made and understood, since inspectors have shown willingness to request that evidence directly. Separately, data protection compliance, including lawful basis analysis for profiling and any Article 22 GDPR automated decision making, needs to be tracked as a distinct workstream from the labour law disclosure, since the AEPD and the Labour Inspectorate can each act independently on the same system. Companies should also anticipate that the AI Act's Article 50 transparency obligations become binding from August 2026 regardless of a system's high risk status, well ahead of the Annex III employment provisions that will apply from December 2027, and that Spain's political direction points toward supplementary national rules rather than reliance on the EU floor alone. Given the Labour Inspectorate's demonstrated willingness to impose large fines and legal commentary suggesting its scrutiny is extending beyond delivery platforms toward ride hailing and logistics, treating the rider law's information duty as a low priority compliance item would be a misreading of where enforcement is actually heading.

Primary sources

Related articles