Skip to content
AI Policy Generator

ESWhat applies

Hiring, evaluation or termination of staff in Spain: related rules

Using AI to target job ads, screen resumes, interview, score candidates or evaluate performance, promotions and terminations. It is the use case with the most laws in force worldwide because of its impact on the right to work and the risk of discrimination.

Risk classification

JurisdictionLevelDateNote
European UnionHigh riskDecember 2, 2027Annex III(4): hiring, promotion, termination and evaluation; the Art. 6(3) exception does not apply to candidate screening.
European UnionProhibited practiceFebruary 2, 2025Inferring emotions of candidates or workers is banned (Art. 5(1)(f)), except for medical or safety purposes.
SpainSector rulesOctober 5, 2026Workers' Statute Art. 64.4.d (informing worker representatives) and Royal Decree 723/2026 (written notice to each worker from Oct 5, 2026).
SpainData protection—GDPR Arts. 22 and 35; AEPD warning (Oct 2026): human oversight must also cover rejected candidates.

Obligations related to this use case

Inform worker representatives about algorithms

Workers' Statute Art. 64.4.d (Rider Law)Estatuto de los Trabajadores, arts. 64.4.d) y 64.5In force

Already applicable

When it relates
If you use algorithms or AI to hire, evaluate, assign tasks or shifts, set pay, monitor or dismiss staff, and you have a works council or staff delegates.
What the rule provides
  • Give representatives in writing the system's parameters, rules and instructions and how it affects decisions.
  • Use the Ministry's 20 questions as a guide (which decisions, which data, what technology, human oversight, audits).
  • Update the information when the system changes and open consultation where appropriate.
Typical evidence
  • Written notice with representatives' acknowledgment.
  • Minutes of the information or consultation meeting.
Verification
Verified in the official source on October 31, 2026Consolidated text in the BOE; in force since 2021. The ministry guide's content comes from law firms (Garrigues, Cuatrecasas).

Individual written notice on algorithmic systems

Royal Decree 723/2026Real Decreto 723/2026, arts. 2.2, 3.2.k), 7.3 y disposición transitoria únicaIn force

Applies from October 5, 2026

When it relates
If you use algorithms, AI or automated rules to decide on working hours, tasks, pay, promotion, workplace or dismissal.
What the rule provides
  • Tell each worker in writing that algorithmic or automated decision systems are used.
  • If those systems set or change working conditions, explain their guidelines, criteria and operating rules; referring to the law or collective agreement is not enough. The model itself need not be handed over.
  • New hires: inform at the start. Existing staff: provide the information within 30 working days of a request. Changes: no later than the day they take effect.
  • Deliver on paper or in a storable electronic format, with proof of delivery.
Typical evidence
  • Individual notice template per system.
  • Log of deliveries and requests handled.
Verification
Verified in the official source on November 2, 2026Checked in the BOE (BOE-A-2026-19200): published Sep 15, 2026 and in force Oct 5, 2026. This completes the research, which had not found the publication date.

Using high-risk systems: human oversight, logs and monitoring

AI ActReglamento (UE) 2024/1689, art. 26(1)-(6) y (8)-(12); Anexo III; art. 6(1) y Anexo I; art. 113Adopted, applies later

Applies from December 2, 2027

Deadlines by profile

  • : Annex III high-risk systems
  • : Clinical AI that is a high-risk medical device (Annex I)
When it relates
If you use AI for hiring or managing staff, monitoring workers, credit scoring, life or health insurance pricing, student assessment, biometrics or access to public benefits (Annex III). Also, from Aug 2, 2028, if you use clinical AI that is a medical device subject to notified-body assessment (Annex I).
What the rule provides
  • Use the system according to the provider's instructions.
  • Assign human oversight to people with enough competence, training, authority and support.
  • Ensure input data under your control is relevant and representative.
  • Monitor operation, suspend use when risks appear, and report serious incidents to the provider and the authority.
  • Keep automatically generated logs under your control for at least six months.
  • Public bodies: register the use in the EU database. Systems already in use by public authorities: deadline Aug 2, 2030.
Typical evidence
  • Appointment and training records of human overseers.
  • Log retention policy and sample logs.
  • Monitoring plan and incident log.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i) (Dec 2, 2027 for Annex III). Regulation (EU) 2026/1744 moved the date but not the content of Article 26.

Inform workers and their representatives before using high-risk AI at work

AI ActReglamento (UE) 2024/1689, art. 26(7)Adopted, applies later

Applies from December 2, 2027

When it relates
If you use AI to hire, evaluate, assign tasks, decide promotions or terminations, or monitor staff.
What the rule provides
  • Inform worker representatives and affected workers before putting the system into service.
  • Follow the information and consultation procedures of national labor law.
Typical evidence
  • Dated written notice to representatives and workers.
  • Minutes of the information or consultation meeting.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Inform and explain to people affected by high-risk decisions

AI ActReglamento (UE) 2024/1689, arts. 26(11) y 86Adopted, applies later

Applies from December 2, 2027

When it relates
If you make or support decisions about people with an Annex III high-risk system.
What the rule provides
  • Tell people that a high-risk system is being used on them.
  • On request, give a clear and meaningful explanation of the system's role in the decision and its main elements when the decision has legal or similarly significant effects.
Typical evidence
  • Notices to affected people.
  • Explanation template and log of requests handled.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Fundamental rights impact assessment (FRIA)

AI ActReglamento (UE) 2024/1689, art. 27Adopted, applies later

Applies from December 2, 2027

When it relates
Public bodies and private companies providing public services that use high-risk AI; and any company using AI to assess creditworthiness or price life and health insurance.
What the rule provides
  • Before first use, assess processes, duration and frequency, affected people or groups, specific risks of harm, human oversight measures and risk responses, including complaints.
  • Notify the results to the market surveillance authority using the AI Office form.
  • It can build on an existing data protection impact assessment and must be updated when factors change.
Typical evidence
  • Signed and dated FRIA.
  • Proof of notification to the authority.
Verification
Verified in the official source on November 2, 2026Date checked (Article 113(c)(i)). Scope per Article 27: it does not cover every employer using AI for hiring; some vendor websites wrongly extend it.

Providers of Annex III high-risk systems

AI ActReglamento (UE) 2024/1689, arts. 6(3)-(4), 8-17, 43, 47-49, 72-73Adopted, applies later

Applies from December 2, 2027

When it relates
If you develop or sell under your name an AI system for an Annex III use (employment, credit, life and health insurance, education, biometrics, public services).
What the rule provides
  • Risk management system across the lifecycle and governance of training, validation and test data.
  • Technical documentation, automatic event logging, instructions for use, design for human oversight, and accuracy, robustness and cybersecurity.
  • Quality management system, conformity assessment, EU declaration of conformity, CE marking and registration in the EU database.
  • Post-market monitoring and serious-incident reporting.
  • If you conclude that your Annex III system is not high-risk (Article 6(3)), document the assessment and register it before placing it on the market.
  • Small mid-caps (fewer than 750 employees) get simplified documentation templates.
Typical evidence
  • Technical file and quality management system.
  • EU declaration of conformity and registration number.
  • Post-market monitoring plan.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i). The small mid-cap category comes from secondary sources on Regulation (EU) 2026/1744.

Safeguards against solely automated decisions

GDPRRGPD, arts. 13.2.f), 14.2.g), 15.1.h) y 22; STJUE C-634/21, SCHUFA, 7-dic-2023; STJUE C-203/22, Dun & Bradstreet Austria, 27-feb-2025In force

Already applicable

When it relates
If AI makes, or in practice determines, decisions with legal or similarly significant effects on people without meaningful human involvement: hiring, credit, insurance, education, benefits, pricing or access to services. Diagnostic support reviewed by a clinician is usually not a solely automated decision.
What the rule provides
  • Avoid decisions based solely on automated processing unless needed for a contract, authorized by law or based on explicit consent.
  • Where allowed, provide real human intervention and the ability to give one's view and contest the decision.
  • A third-party score that determines the decision also counts as an automated decision.
  • Disclose that the automated decision exists and, on request, give meaningful information about the logic involved and its consequences. The law does not require a specific letter format.
Typical evidence
  • Human review procedure with timelines and owners.
  • Log of decisions and reviews.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Data protection impact assessment (DPIA)

GDPRRGPD, art. 35In force

Already applicable

When it relates
If you use AI to evaluate or decide about people, monitor, use biometrics, train models on personal data, or process sensitive or children's data.
What the rule provides
  • Carry out the DPIA before starting: description, necessity and proportionality, risks and measures.
  • Consult the authority if residual risk remains high.
  • Review it when the system or model changes.
Typical evidence
  • Signed DPIA, with the data protection officer's opinion if there is one.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Related base documents

Related kits

Includes 5 documents

HR and AI Recruiting Kit

AI hiring policy, notice to workers and representatives, meaningful human oversight, DPIA and decision review for candidates and employees.

USD 129USD 215

Complete kit · available to buy

Find out what applies to you (free)Spain