Spain: AI and data protection regulation
The EU AI Act applies directly in Spain, but the national penalties bill lapsed; Spanish employment and customer-service rules already apply.
GROU LLC · built on AI Business Core, by Vreinn · · How we verify sources
Summary
Companies in Spain must comply with the EU AI Act and the GDPR as in the rest of the EU. AESIA is the AI supervisory authority, but the bill setting national penalties lapsed in October 2026 when Parliament was dissolved: obligations remain enforceable and the penalty regime is pending. Spain also has its own rules: inform worker representatives and each worker about algorithms (Workers' Statute Art. 64.4.d and Royal Decree 723/2026) and guarantee human customer service from December 28, 2026 (Law 10/2025). The AEPD is especially active on AI, with guidance on agents and on hiring.
- Binding AI law today?
- Yes
- Obligations verified in the official source
- 100 %
- Information as of
Authorities
- Spanish Agency for the Supervision of Artificial Intelligence (AESIA)
Market surveillance authority for the EU AI Act; runs the regulatory sandbox and publishes technical guidance
- Spanish Data Protection Agency (AEPD)
Enforces the GDPR and LOPDGDD, including AI use with personal data
- Labor and Social Security Inspectorate
Enforces algorithmic information duties toward workers and representatives
- Bank of Spain
Supervises AI and technology vendors at credit institutions (DORA, consumer credit)
- Directorate-General for Insurance and Pension Funds (DGSFP)
Supervises insurers, including AI governance
- National Securities Market Commission (CNMV)
Supervises investment firms and markets
- Spanish Agency of Medicines and Medical Devices (AEMPS)
Medical device authority, including AI medical software
- Consumer authorities (national and regional)
Enforce Law 10/2025 on customer service
Rules covered
National rules
| Rules | Status | Obligations and dates |
|---|---|---|
| Spanish Data Protection and Digital Rights Act (LOPDGDD) LOPDGDD | In force | 3 |
| AEPD guidance on artificial intelligence AEPD AI guides | Regulator guidance | 2 |
| AEPD guidance on agentic AI AEPD agentic AI guide | Regulator guidance | 1 |
| AEPD warning on using AI to screen CVs AEPD CV-screening warning | Regulator guidance | 1 |
| Workers' Statute, Art. 64.4.d: algorithm information for worker representatives Workers' Statute Art. 64.4.d (Rider Law) | In force | 1 |
| Royal Decree 723/2026 on worker information, including algorithms Royal Decree 723/2026 | In force | 1 |
| Customer Service Act Law 10/2025 | In force | 1 |
| Equal Treatment and Non-Discrimination Act, Art. 23: artificial intelligence Law 15/2022, Art. 23 | In force | 1 |
| Spanish AI Good Use and Governance Bill (lapsed) Spanish AI bill (lapsed) | Lapsed or superseded | 2 |
European Union rules that apply in Spain
Key dates
- National measures apply · CCD2
- New prohibitions (intimate imagery, child abuse) and end of the technical-marking grace period · AI Act
- Transposition deadline · Platform Work Directive
- Transposition and application to new products · Product Liability Directive
- End of adaptation period · Law 10/2025
- End of switching charges · Data Act
- General application date and deadline for key implementing acts · EHDS
- Deadline for general-purpose models placed on the market before Aug 2025 · AI Act
- Annex III high-risk (employment, credit, education, biometrics…) · AI Act
- Full application · CRA
- Annex I high-risk (regulated products) · AI Act
- Secondary use and exchange of first data categories begin · EHDS
- Deadline for high-risk systems already used by public authorities · AI Act
- Second wave of data categories (imaging, lab results, discharge reports) · EHDS
Show past dates (33)
- Lapses on dissolution of Parliament · Spanish AI bill (lapsed)
- Entry into force · Royal Decree 723/2026
- Warning published · AEPD CV-screening warning
- Published in the BOE · Royal Decree 723/2026
- Data access by design (Article 3(1)) for new products · Data Act
- Reporting obligations · CRA
- General application: Article 50 transparency, supervision and penalties · AI Act
- Digital Omnibus (Reg. 2026/1744) enters into force · AI Act
- Commission guidelines on Article 50 · AI transparency code
- Commission finds the Code adequate · AI transparency code
- Public consultation closes · High-risk guidelines (Art. 6)
- Published in the Parliamentary Gazette · Spanish AI bill (lapsed)
- Final Code published · AI transparency code
- Approved by the Council of Ministers · Spanish AI bill (lapsed)
- Draft published · High-risk guidelines (Art. 6)
- Entry into force · Law 10/2025
- Transposition deadline · CCD2
- Application date · Data Act
- Published · EIOPA AI Opinion
- General-purpose AI model obligations · AI Act
- MDCG 2025-6 guidance on MDR/IVDR and the AI Act · MDR/IVDR
- Entry into force · EHDS
- Prohibitions and AI literacy · AI Act
- Application date · DORA
- Entry into force · AI Act
- Entry into force · Law 15/2022, Art. 23
- Ministry of Labor guide on algorithmic information · Workers' Statute Art. 64.4.d (Rider Law)
- IVDR applies · MDR/IVDR
- Letter d) enters into force · Workers' Statute Art. 64.4.d (Rider Law)
- Application date · EBA loan origination guidelines
- MDR applies · MDR/IVDR
- Entry into force · LOPDGDD
- Application date · GDPR
Use cases with their own obligations in Spain
- Employees use generative AI (ChatGPT, Copilot, Gemini…)
- Customer service chatbot or assistant
- Companion or social chatbot
- AI agents that take actions
- Generated or synthetic marketing content
- Voice or likeness cloning
- Hiring, evaluation or termination of staff
- Algorithmic worker management (shifts, tasks, pay)
- Worker monitoring
- Credit or creditworthiness scoring
- Insurance pricing or underwriting
- Diagnosis, triage or clinical support
- Admissions, grading or exam proctoring
- Biometrics, facial or emotion recognition
- Training or fine-tuning models on own data
- Selling software or services that include AI
- Access to public services or benefits
- Other automated decisions with significant effects (housing, pricing, access to services)
Regulatory change alerts by country
Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.
- Changes to the rules of the countries you pick, when we add them to the registry.
- New application dates.
- No more than one email a week. Unsubscribe at any time.
It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.