Skip to content
AI Policy Generator

ESWhat applies

Selling software or services that include AI in Spain: related rules

Organizations that build and sell AI-enabled products or services to businesses or consumers. They take on provider duties and, above all, customer demands for evidence of governance, security and transparency before buying.

Risk classification

JurisdictionLevelDateNote
European UnionTransparencyAugust 2, 2026Providers must design systems to disclose interaction and mark synthetic content (Art. 50); grace until Dec 2, 2026 for existing systems.
European UnionHigh riskDecember 2, 2027If the product has an Annex III purpose, the provider takes on a risk management system, technical documentation and conformity assessment.
European UnionSector rulesSeptember 11, 2026Cyber Resilience Act: reporting of exploited vulnerabilities for products with digital elements (pure SaaS is usually out of scope).

Obligations related to this use case

Provider transparency: disclose AI interaction and mark synthetic content

AI ActReglamento (UE) 2024/1689, art. 50(1)-(2) y art. 111(4)In force

Applies from August 2, 2026

When it relates
If you build or sell under your own name a chatbot, agent, voice assistant or a system that generates text, images, audio or video. If you build your own chatbot on a third-party model and put it into service under your brand, you are usually the provider.
What the rule provides
  • Design systems that interact with people so those people know they are dealing with AI, unless it is obvious.
  • Mark generated or manipulated audio, images, video and text in a machine-readable format, using effective and interoperable techniques.
  • Generative systems placed on the market before Aug 2, 2026: complete technical marking by Dec 2, 2026 at the latest.
  • The Commission's Code of Practice on transparency of AI-generated content can serve as a reference.
Typical evidence
  • Wording and placement of the AI-interaction notice in each channel.
  • Technical specification of marking (watermarks, metadata) and detection tests.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Report exploited vulnerabilities and severe incidents within 24/72 hours

CRAReglamento (UE) 2024/2847, art. 14In force

Applies from September 11, 2026

When it relates
If you make or sell AI software or devices as a product (not only as a cloud service). Distributors only take on this duty if they place the product on the market under their own name or substantially modify it.
What the rule provides
  • Early warning within 24 hours, notification within 72 hours and a final report, via ENISA's single reporting platform.
  • Inform affected users and the mitigation measures.
Typical evidence
  • Vulnerability handling and reporting procedure.
  • Notification log.
Related base documents
Verification
Verified in the official source on October 31, 2026Reporting date confirmed on the Commission's official CRA reporting page (cited in the research).

Essential product cybersecurity requirements

CRAReglamento (UE) 2024/2847, arts. 12-14 y Anexo IAdopted, applies later

Applies from December 11, 2027

When it relates
If you make or sell AI software or devices as a product.
What the rule provides
  • Design secure by default, assess risks and handle vulnerabilities during the support period.
  • Technical documentation, EU declaration of conformity and CE marking.
  • High-risk AI systems that meet the CRA are deemed to meet the AI Act's cybersecurity requirements.
  • Since Sep 11, 2026, Article 14 already applies: report actively exploited vulnerabilities and severe incidents affecting the product's security.
Typical evidence
  • Cybersecurity risk assessment.
  • Software bill of materials (SBOM).
Verification
Verified in the official source on November 4, 2026Checked in the Official Journal (CELEX 32024R2847): Article 71(2) ("shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026"), Article 12 (high-risk AI systems), Article 13, Annex I and Article 64(2) (fines up to EUR 15M or 2.5%).

Prepare for claims over software or AI defects

Product Liability DirectiveDirectiva (UE) 2024/2853, arts. 4, 7-11 y 22Adopted, applies later

Applies from December 9, 2026

When it relates
If you sell or import software or AI products in the EU.
What the rule provides
  • Document safety testing, regulatory compliance and update management for each version.
  • Keep technical documentation: a court can order its disclosure.
  • Keep providing security updates while the product is under your control.
Typical evidence
  • Version and testing history.
  • Model card.
Verification
Verified in the official source on November 2, 2026Transposition and application date checked on the Commission's official product liability page. Spanish transposition has not been verified.

Let customers switch cloud or AI providers

Data ActReglamento (UE) 2023/2854, arts. 23-31In force

Applies from September 12, 2025

When it relates
If you offer AI or software as a cloud service to EU customers.
What the rule provides
  • Include in contracts the right to switch and export data, with notice and transition periods.
  • Remove technical and commercial barriers; charge only the direct cost of switching until Jan 12, 2027 and nothing after.
Typical evidence
  • Switching and exit contract clauses.
  • Export format documentation.
Verification
Verified in the official source on November 4, 2026Checked in the Official Journal (CELEX 32023R2854): Article 50 ("It shall apply from 12 September 2025"), Articles 23-31 (switching) and Article 29 (reduced charges capped at direct costs until Jan 12, 2027; none from that date).

Related base documents

Related kits

Includes 6 documents

B2B Vendor Kit for Customer Questionnaires

Base documents on topics that procurement questionnaires from banks and US clients often cover: policy, inventory, impact assessment, incidents, vendors and security.

USD 169USD 274

Complete kit · available to buy

Includes 6 documents

AI Integrators Kit

Six base documents for integrating third-party models through APIs or RAG: due diligence, model provenance, architecture, integration map, adversarial security and service level agreement.

USD 119USD 194

Complete kit · available to buy

Includes 7 documents

Self-Hosted and Open-Weight Models Kit

Seven base documents for hosting in-house or open-weight models: provenance, security baseline, adversarial testing, architecture, model card, life cycle and rollback.

USD 149USD 233

Complete kit · available to buy

Find out what applies to you (free)Spain