Skip to content
AI Policy Generator

ESWhat applies

AI agents that take actions in Spain: related rules

Systems that, given a goal, plan and execute actions in other tools: sending emails, purchasing, changing records or approving requests. Their risk depends on the permissions they hold and whether they decide about people without human involvement.

Risk classification

JurisdictionLevelDateNote
European UnionTransparencyAugust 2, 2026Interaction notice if it deals with people; if the agent decides in an Annex III area, it will be high-risk from Dec 2, 2027; the draft guidelines treat multi-agent systems as one system.
SpainData protection—The AEPD issued guidance on agentic AI (2026): memory, autonomy, permissions and GDPR Art. 22 if the agent decides about people.

Obligations related to this use case

Offer human service whenever the customer asks

Law 10/2025Ley 10/2025, arts. 2, 3.11, 8, 9.2 y 10.3; disposición transitoria únicaAdopted, applies later

Applies from December 28, 2026

When it relates
If you serve consumers with chatbots, voicebots or agents and you are a basic service company (utilities, telecom, passenger transport, postal, financial) or a large company. Mid-size firms above EUR 50M turnover or EUR 43M balance sheet are also covered.
What the rule provides
  • Do not use automated systems as the only service channel.
  • Allow customers to request personal service from the start and at any point in the bot conversation.
  • The person must answer in real time and identify themselves at the start; 95% of requests must be answered, on average, in under three minutes.
  • Properly train staff who design and manage automated tools.
  • In financial services sector rules apply first and this law applies as a supplement.
Typical evidence
  • Escalation-to-human protocol with target times.
  • Response-time metrics.
  • Training records for the team managing the bots.
Verification
Verified in the official source on November 2, 2026Checked in the BOE. Note: the preamble mentions six months, but the sole transitional provision sets twelve months from entry into force; the operative text prevails (Dec 28, 2026). Insurance is assumed to fall under financial services; confirm case by case.

Provider transparency: disclose AI interaction and mark synthetic content

AI ActReglamento (UE) 2024/1689, art. 50(1)-(2) y art. 111(4)In force

Applies from August 2, 2026

When it relates
If you build or sell under your own name a chatbot, agent, voice assistant or a system that generates text, images, audio or video. If you build your own chatbot on a third-party model and put it into service under your brand, you are usually the provider.
What the rule provides
  • Design systems that interact with people so those people know they are dealing with AI, unless it is obvious.
  • Mark generated or manipulated audio, images, video and text in a machine-readable format, using effective and interoperable techniques.
  • Generative systems placed on the market before Aug 2, 2026: complete technical marking by Dec 2, 2026 at the latest.
  • The Commission's Code of Practice on transparency of AI-generated content can serve as a reference.
Typical evidence
  • Wording and placement of the AI-interaction notice in each channel.
  • Technical specification of marking (watermarks, metadata) and detection tests.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Deployer transparency: deepfakes, public-interest text and emotion recognition

AI ActReglamento (UE) 2024/1689, art. 50(3)-(4)In force

Applies from August 2, 2026

When it relates
If you use chatbots, agents, generated marketing content, voice or likeness cloning, or emotion recognition or biometric categorization.
What the rule provides
  • Clearly disclose that an image, audio or video is a deepfake (content that imitates real people, places or events). For artistic or satirical works a disclosure that does not spoil the work is enough.
  • Disclose that text published to inform the public on matters of public interest was AI-generated, unless it went through human editorial review with someone accountable.
  • Inform people exposed to emotion recognition or biometric categorization.
  • Check that any third-party chatbot or agent you use discloses that it is AI; if you configure and publish it under your brand, take on the provider duties.
Typical evidence
  • Synthetic-content labeling procedure with approved examples.
  • Screenshots of notices on web, app, phone and social media.
  • Log of AI-assisted published pieces and their labels.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Related base documents

Related kits

Includes 8 documents

AI Agents Kit

Six base documents for agents that act in systems: autonomy and permissions policy, integration map, adversarial testing, human oversight, rollback and incident response.

USD 169USD 292

Complete kit · available to buy

Find out what applies to you (free)Spain