Skip to content
AI Policy Generator

ESWhat applies

Spain · Guidance

AEPD guidance on artificial intelligence

Regulator guidanceAEPD AI guides

Summary

The AEPD has its own set of guides on using AI with personal data: how to align processing with the GDPR, which controls to audit, a map linking the GDPR, the AI Act and the Data Act, and its own generative AI policy as a model. They are not laws, but they show what the AEPD will check in an inspection.

Who it applies to

Controllers and processors using AI with personal data, and developers.

Penalties

The rule has no penalty regime of its own, or it does not apply.

Official name
Adecuación al RGPD de tratamientos que incorporan Inteligencia Artificial (2020); Requisitos para Auditorías de Tratamientos que incluyan IA (2021); Tratamientos que incluyen IA, mapa de referencia (2025); Política general para el uso de IA generativa de la AEPD
Official reference
Agencia Española de Protección de Datos, guías de 2020 y 2021, mapa de referencia de junio de 2025 y política interna de IA generativa
Regulator
Spanish Data Protection Agency (AEPD)
Official source
Check the sourceHow we verify sources

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Review and audit AI processing against AEPD criteriaAEPD, Adecuación al RGPD de tratamientos con IA (2020); Requisitos para auditorías (2021)Regulator guidanceAlready applicableIf you use AI with personal data.Verified in the official source on October 31, 2026
Internal generative AI use policyAEPD, Política general para el uso de IA generativaRegulator guidanceAlready applicableIf your staff use ChatGPT, Copilot, Gemini or coding assistants.Verified in the official source on October 31, 2026

Review and audit AI processing against AEPD criteria

AEPD, Adecuación al RGPD de tratamientos con IA (2020); Requisitos para auditorías (2021)Regulator guidance

Already applicable

When it relates
If you use AI with personal data.
What the rule provides
  • Document the AI component's lifecycle, data quality and model accuracy.
  • Apply the audit guide's control objectives: transparency, minimization, bias, security and oversight.
  • Repeat the review when the model or use changes.
Typical evidence
  • Audit plan and reports for AI processing.
Related base documents
Verification
Verified in the official source on October 31, 2026Guides published on aepd.es (official sources cited in the research). The exact day of the 2025 map (June) was not confirmed.

Internal generative AI use policy

AEPD, Política general para el uso de IA generativaRegulator guidance

Already applicable

When it relates
If your staff use ChatGPT, Copilot, Gemini or coding assistants.
What the rule provides
  • Define which tools are approved and what information must not be entered.
  • Anonymize or pseudonymize data before sending it to external systems.
  • Review outputs before using them in decisions or official documents.
Typical evidence
  • Approved policy and list of authorized tools.
Verification
Verified in the official source on October 31, 2026Document published on aepd.es (cited in the research).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)