Loading
Spain governs AI mainly through the EU AI Act, applied directly, and the GDPR, enforced by the AEPD. Unlike most EU members, Spain already has a dedicated AI regulator in place: AESIA, created in 2023 and headquartered in A Coruna, the EU's first national AI supervisory agency. What Spain has not finished is its own national AI statute: a government bill has been before Congress since May 2026 but remains in committee, not yet enacted. This page sets out the instruments, the dates, and which ones are binding versus guidance, with links to the primary sources.
Last reviewed: 23 July 2026 · A factual snapshot; AI policy is evolving, so confirm against the primary sources linked below
For an organisation in Spain, the binding rules on AI come from the EU AI Act, applied directly without national transposition, and the GDPR as implemented by Organic Law 3/2018 and enforced by the AEPD. Spain has not enacted its own comprehensive AI statute yet, but it is further along than most EU members: a Government bill, the Proyecto de Ley Organica para el buen uso y la gobernanza de la inteligencia artificial, has been before Congress since 26 May 2026.
Spain is unusual in already having a functioning national AI agency. AESIA, the Agencia Espanola de Supervision de Inteligencia Artificial, was created by Real Decreto 729/2023 and has operated since 2023 as the EU's first dedicated national AI supervisor, running the EU's first AI regulatory sandbox and acting as Spain's single point of contact with the European Commission. The pending bill would formalise AESIA's role, the AEPD's data-protection competence, and the CGPJ's oversight of judicial AI in statute, alongside a national sanctioning regime, but as of late July 2026 it remains in Congress committee, not yet law.
Spain's 2022 General State Budget Law (Ley 22/2021) authorised the Government to create the Agencia Espanola de Supervision de Inteligencia Artificial (AESIA) as a State Agency with its own legal personality, making Spain the first EU member state to legislate a dedicated national AI supervisory body.
Real Decreto 729/2023 approved AESIA's statute, published in the BOE on 2 September and in force from 3 September 2023. AESIA was attached to the Secretary of State for Digitalisation and AI and headquartered in A Coruna, with functions covering supervision, sanctioning, promotion, and acting as Spain's single point of contact with EU AI authorities.
Real Decreto 817/2023 established Spain's controlled testing environment, the legal basis for a regulatory sandbox developed with the European Commission to test compliance with the then-draft EU AI Act, ahead of any other member state.
The Government and the European Commission activated Spain's AI regulatory sandbox, the first of its kind in the EU, to test high-risk AI system requirements before the AI Act's application dates.
The Council of Ministers approved the anteproyecto de ley, a preliminary draft for the good use and governance of AI, opening mandatory pre-legislative consultation and advisory review by bodies including the CGPJ and CES. This was a preliminary stage, not a bill before Parliament.
General-purpose AI model obligations under the EU AI Act took effect, and AESIA gained the power to sanction prohibited AI practices under Article 5, which had itself entered into application on 2 February 2025.
The Council of Ministers approved the definitive Proyecto de Ley Organica para el buen uso y la gobernanza de la inteligencia artificial and referred it to the Cortes Generales, moving the instrument from preliminary draft to a formal Government bill designating AESIA, the AEPD and the CGPJ as competent authorities and setting national fines of up to 35 million euros or 7% of global turnover.
The bill was qualified by the Congress bureau and published in the Boletin Oficial de las Cortes Generales as Proyecto de Ley 121/000096, opening a fifteen-working-day amendment period later extended to 2 September 2026. The same day, Spain's AI sandbox pilot concluded successfully, having supported 25 organisations and produced sixteen practical compliance guides.
The Council of the EU gave final approval to the Digital Omnibus on AI, postponing standalone high-risk obligations under Annex III from 2 August 2026 to 2 December 2027 (and embedded-product obligations to 2 August 2028); the act was signed 8 July 2026 and awaits Official Journal publication. This EU-level change applies in Spain automatically as a Regulation.
The Proyecto de Ley remains in the Comision de Economia, Comercio y Transformacion Digital, past its (extended) amendment deadline but without a committee report, dictamen, or Pleno vote yet held. As an Organic Law it needs an absolute majority in Congress plus Senate passage before it can reach the BOE. It is not yet enacted or in force.
Most of what binds AI in Spain today is EU-derived law applied directly, plus AESIA's own statute. The table below sorts the main instruments by whether they carry legal force now or are guidance, strategy, or still proposed.
| Instrument | Status | Applies to / owner |
|---|---|---|
| EU AI Act (Regulation 2024/1689) | Binding | Providers and deployers of AI in Spain, applied directly |
| GDPR and Organic Law 3/2018 (LOPDGDD) | Binding | Any organisation processing personal data via AI, enforced by the AEPD |
| Ley Rider (Ley 12/2021, Art. 64.4.d Estatuto de los Trabajadores) | Binding | Employers whose algorithms affect working conditions, employment access, or profiling |
| AESIA (Real Decreto 729/2023) | Binding (agency operating) | Spain's AI Act market-surveillance authority and EU single point of contact |
| CGPJ Instruction 2/2026 on AI in judicial activity | Binding (internal) | Judges and courts using AI systems |
| Proyecto de Ley Organica para el buen uso y la gobernanza de la IA | Proposed, not enacted | Would set the national sanctioning regime and formalise AESIA/AEPD/CGPJ roles |
| AEPD guidance (RGPD-AI adequacy, audits, biometric processing) | Guidance on the GDPR | Organisations developing or auditing AI that processes personal data |
| ENIA national strategy and Espana Digital 2026 | Strategy, not a rule | Whole-of-government direction, not an obligation on firms |
For the wider picture across jurisdictions, see our AI regulation by country comparison and the neighbouring France and Germany references, which face the same EU AI Act.
The binding obligations today come from the EU AI Act and the GDPR as applied in Spain, supervised by an already-operating AESIA, not from a national AI statute. The AEPD has shown it will enforce firmly against biometric AI systems that lack a genuine legal basis or a proportionate design, and employers should remember the Ley Rider duty to inform works councils about any algorithm affecting working conditions or employment access.
The practical watch item is the Proyecto de Ley Organica's progress through Congress: it will not change what AESIA does day to day, but it will fix the national sanctioning regime and confirm the multi-authority structure in statute once passed. Our AI GRC guide covers how those pieces fit together, and a short governance assessment benchmarks where an organisation stands against a structured model.
Not yet. The Proyecto de Ley Organica para el buen uso y la gobernanza de la inteligencia artificial was approved by the Council of Ministers on 26 May 2026 and sent to Congress, where it remains in committee as of late July 2026, past its amendment deadline but without a committee report or floor vote. As an Organic Law it still needs an absolute majority in Congress, Senate passage, and BOE publication before it takes effect. Until then, the binding rules on AI in Spain come from the EU AI Act, applied directly.
AESIA, the Agencia Espanola de Supervision de Inteligencia Artificial, already exists and operates: created by Real Decreto 729/2023 and headquartered in A Coruna, it is the EU's first dedicated national AI supervisory agency and acts as Spain's AI Act market-surveillance authority and single point of contact with the European Commission. The AEPD covers data-protection aspects of AI, and the CGPJ covers judicial uses. The pending national bill would formalise this structure in statute; today it operates under AESIA's own statute and the EU AI Act.
Yes. The AEPD fined Aena, the state airport operator, just over 10 million euros in November 2025 and ordered it to suspend a facial-recognition boarding programme at eight airports after finding its impact assessment failed to justify enrolling nearly 40,000 travellers' biometric data. The AEPD separately fined a private university 650,000 euros for making AI facial-recognition mandatory in online exams. A Catalan labour inspectorate also fined Amazon for withholding algorithm information from a works council under the Ley Rider.
A controlled testing environment established by Real Decreto 817/2023, the first AI regulatory sandbox in the EU. Launched in April 2025 with the European Commission, it supported 25 organisations (18 SMEs, six start-ups and one French company) through training, compliance analysis and verification, and concluded successfully in June 2026, producing sixteen practical guides now used to support EU AI Act compliance.
The Ley Rider, in force since 2021, gives works councils and employee representatives the right to be informed of the parameters, rules and instructions behind any algorithm or AI system that affects working conditions, access to employment, or profiling, at any company, not only platforms. It is actively enforced: a national labour-inspectorate campaign launched in September 2025 has examined algorithmic management at major platform employers, and a long line of court rulings, including against Glovo and Deliveroo, has found that algorithmic direction of work can establish an employment relationship.
The Estrategia Nacional de Inteligencia Artificial (ENIA), the AI axis of the Espana Digital 2026 agenda, funded through the EU Recovery, Transformation and Resilience Plan. It covers six strategic axes and roughly thirty measures with a budget above 600 million euros, funding AESIA, the regulatory sandbox, university AI chairs and regional AI projects. It is strategy and public investment, not a binding rule.
A short, free assessment benchmarks where your organisation stands against a structured AI governance model, a practical first step toward EU AI Act and GDPR alignment in Spain.
This page is general information describing the state of Spain AI policy as at 23 July 2026, not legal or compliance advice. The national AI bill is still moving through Congress; always confirm the current position against the primary sources linked above and obtain advice from your own qualified counsel before relying on it.