Skip to content
AI Policy Generator

ESWhat applies

Algorithmic worker management (shifts, tasks, pay) in Spain: related rules

Systems that assign shifts, tasks, routes or pay, set targets or decide incentives and penalties without a supervisor in each case. They affect working conditions, so platform and algorithmic information laws require transparency and human oversight.

Risk classification

JurisdictionLevelDateNote
European UnionHigh riskDecember 2, 2027Annex III(4): task allocation based on behavior or traits and performance monitoring.
European UnionSector rulesDecember 2, 2026Platform Work Directive 2024/2831: transparency, oversight and human review of automated decisions; transposition by Dec 2, 2026.
SpainSector rulesOctober 5, 2026Workers' Statute Art. 64.4.d and Royal Decree 723/2026 (written notice to each worker).

Obligations related to this use case

Inform worker representatives about algorithms

Workers' Statute Art. 64.4.d (Rider Law)Estatuto de los Trabajadores, arts. 64.4.d) y 64.5In force

Already applicable

When it relates
If you use algorithms or AI to hire, evaluate, assign tasks or shifts, set pay, monitor or dismiss staff, and you have a works council or staff delegates.
What the rule provides
  • Give representatives in writing the system's parameters, rules and instructions and how it affects decisions.
  • Use the Ministry's 20 questions as a guide (which decisions, which data, what technology, human oversight, audits).
  • Update the information when the system changes and open consultation where appropriate.
Typical evidence
  • Written notice with representatives' acknowledgment.
  • Minutes of the information or consultation meeting.
Verification
Verified in the official source on October 31, 2026Consolidated text in the BOE; in force since 2021. The ministry guide's content comes from law firms (Garrigues, Cuatrecasas).

Individual written notice on algorithmic systems

Royal Decree 723/2026Real Decreto 723/2026, arts. 2.2, 3.2.k), 7.3 y disposición transitoria únicaIn force

Applies from October 5, 2026

When it relates
If you use algorithms, AI or automated rules to decide on working hours, tasks, pay, promotion, workplace or dismissal.
What the rule provides
  • Tell each worker in writing that algorithmic or automated decision systems are used.
  • If those systems set or change working conditions, explain their guidelines, criteria and operating rules; referring to the law or collective agreement is not enough. The model itself need not be handed over.
  • New hires: inform at the start. Existing staff: provide the information within 30 working days of a request. Changes: no later than the day they take effect.
  • Deliver on paper or in a storable electronic format, with proof of delivery.
Typical evidence
  • Individual notice template per system.
  • Log of deliveries and requests handled.
Verification
Verified in the official source on November 2, 2026Checked in the BOE (BOE-A-2026-19200): published Sep 15, 2026 and in force Oct 5, 2026. This completes the research, which had not found the publication date.

Using high-risk systems: human oversight, logs and monitoring

AI ActReglamento (UE) 2024/1689, art. 26(1)-(6) y (8)-(12); Anexo III; art. 6(1) y Anexo I; art. 113Adopted, applies later

Applies from December 2, 2027

Deadlines by profile

  • : Annex III high-risk systems
  • : Clinical AI that is a high-risk medical device (Annex I)
When it relates
If you use AI for hiring or managing staff, monitoring workers, credit scoring, life or health insurance pricing, student assessment, biometrics or access to public benefits (Annex III). Also, from Aug 2, 2028, if you use clinical AI that is a medical device subject to notified-body assessment (Annex I).
What the rule provides
  • Use the system according to the provider's instructions.
  • Assign human oversight to people with enough competence, training, authority and support.
  • Ensure input data under your control is relevant and representative.
  • Monitor operation, suspend use when risks appear, and report serious incidents to the provider and the authority.
  • Keep automatically generated logs under your control for at least six months.
  • Public bodies: register the use in the EU database. Systems already in use by public authorities: deadline Aug 2, 2030.
Typical evidence
  • Appointment and training records of human overseers.
  • Log retention policy and sample logs.
  • Monitoring plan and incident log.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i) (Dec 2, 2027 for Annex III). Regulation (EU) 2026/1744 moved the date but not the content of Article 26.

Inform workers and their representatives before using high-risk AI at work

AI ActReglamento (UE) 2024/1689, art. 26(7)Adopted, applies later

Applies from December 2, 2027

When it relates
If you use AI to hire, evaluate, assign tasks, decide promotions or terminations, or monitor staff.
What the rule provides
  • Inform worker representatives and affected workers before putting the system into service.
  • Follow the information and consultation procedures of national labor law.
Typical evidence
  • Dated written notice to representatives and workers.
  • Minutes of the information or consultation meeting.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Inform and explain to people affected by high-risk decisions

AI ActReglamento (UE) 2024/1689, arts. 26(11) y 86Adopted, applies later

Applies from December 2, 2027

When it relates
If you make or support decisions about people with an Annex III high-risk system.
What the rule provides
  • Tell people that a high-risk system is being used on them.
  • On request, give a clear and meaningful explanation of the system's role in the decision and its main elements when the decision has legal or similarly significant effects.
Typical evidence
  • Notices to affected people.
  • Explanation template and log of requests handled.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Fundamental rights impact assessment (FRIA)

AI ActReglamento (UE) 2024/1689, art. 27Adopted, applies later

Applies from December 2, 2027

When it relates
Public bodies and private companies providing public services that use high-risk AI; and any company using AI to assess creditworthiness or price life and health insurance.
What the rule provides
  • Before first use, assess processes, duration and frequency, affected people or groups, specific risks of harm, human oversight measures and risk responses, including complaints.
  • Notify the results to the market surveillance authority using the AI Office form.
  • It can build on an existing data protection impact assessment and must be updated when factors change.
Typical evidence
  • Signed and dated FRIA.
  • Proof of notification to the authority.
Verification
Verified in the official source on November 2, 2026Date checked (Article 113(c)(i)). Scope per Article 27: it does not cover every employer using AI for hiring; some vendor websites wrongly extend it.

Providers of Annex III high-risk systems

AI ActReglamento (UE) 2024/1689, arts. 6(3)-(4), 8-17, 43, 47-49, 72-73Adopted, applies later

Applies from December 2, 2027

When it relates
If you develop or sell under your name an AI system for an Annex III use (employment, credit, life and health insurance, education, biometrics, public services).
What the rule provides
  • Risk management system across the lifecycle and governance of training, validation and test data.
  • Technical documentation, automatic event logging, instructions for use, design for human oversight, and accuracy, robustness and cybersecurity.
  • Quality management system, conformity assessment, EU declaration of conformity, CE marking and registration in the EU database.
  • Post-market monitoring and serious-incident reporting.
  • If you conclude that your Annex III system is not high-risk (Article 6(3)), document the assessment and register it before placing it on the market.
  • Small mid-caps (fewer than 750 employees) get simplified documentation templates.
Typical evidence
  • Technical file and quality management system.
  • EU declaration of conformity and registration number.
  • Post-market monitoring plan.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i). The small mid-cap category comes from secondary sources on Regulation (EU) 2026/1744.

Safeguards against solely automated decisions

GDPRRGPD, arts. 13.2.f), 14.2.g), 15.1.h) y 22; STJUE C-634/21, SCHUFA, 7-dic-2023; STJUE C-203/22, Dun & Bradstreet Austria, 27-feb-2025In force

Already applicable

When it relates
If AI makes, or in practice determines, decisions with legal or similarly significant effects on people without meaningful human involvement: hiring, credit, insurance, education, benefits, pricing or access to services. Diagnostic support reviewed by a clinician is usually not a solely automated decision.
What the rule provides
  • Avoid decisions based solely on automated processing unless needed for a contract, authorized by law or based on explicit consent.
  • Where allowed, provide real human intervention and the ability to give one's view and contest the decision.
  • A third-party score that determines the decision also counts as an automated decision.
  • Disclose that the automated decision exists and, on request, give meaningful information about the logic involved and its consequences. The law does not require a specific letter format.
Typical evidence
  • Human review procedure with timelines and owners.
  • Log of decisions and reviews.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Data protection impact assessment (DPIA)

GDPRRGPD, art. 35In force

Already applicable

When it relates
If you use AI to evaluate or decide about people, monitor, use biometrics, train models on personal data, or process sensitive or children's data.
What the rule provides
  • Carry out the DPIA before starting: description, necessity and proportionality, risks and measures.
  • Consult the authority if residual risk remains high.
  • Review it when the system or model changes.
Typical evidence
  • Signed DPIA, with the data protection officer's opinion if there is one.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Disclose automated monitoring and decision systems

Platform Work DirectiveDirectiva (UE) 2024/2831, arts. 9 y 13-14Adopted, applies later

Applies from December 2, 2026

When it relates
Digital delivery, mobility or gig platforms that organize work with algorithms.
What the rule provides
  • Inform workers, representatives and, on request, authorities in writing about systems that monitor or make decisions and their main criteria.
  • Inform and consult representatives before introducing or substantially changing those systems.
Typical evidence
  • Dated information document delivered.
  • Consultation minutes.
Supporting documents
Verification
Verified in the official source on November 4, 2026Checked in the Official Journal (CELEX 32024L2831): Article 9(1) (inform workers, representatives and, on request, authorities), Article 13 (information and consultation) and Article 14 (direct information where there are no representatives). Transposition deadline checked in Article 29(1) ("by 2 December 2026"). No Spanish transposing law is on record (not checked in the BOE); the obligations become enforceable once national law is passed.

Human oversight and review of algorithmic decisions

Platform Work DirectiveDirectiva (UE) 2024/2831, arts. 10-11Adopted, applies later

Applies from December 2, 2026

When it relates
Digital delivery, mobility or gig platforms that organize work with algorithms.
What the rule provides
  • At least every two years, have competent staff evaluate the impact of automated decisions.
  • Any decision to restrict, suspend or close a person's account must be taken by a human.
  • Explain significant decisions in writing and allow review requests with a timely answer.
Typical evidence
  • Periodic oversight report.
  • Log of review requests and answers.
Verification
Verified in the official source on November 4, 2026Checked in the Official Journal (CELEX 32024L2831): Article 10(1) (evaluation at least every two years), Article 10(5) (account restrictions, suspensions or terminations are decided by a human being) and Article 11 (human review and written reasons). Transposition deadline checked in Article 29(1) ("by 2 December 2026"). No Spanish transposing law is on record (not checked in the BOE); the obligations become enforceable once national law is passed.

Data processing limits and impact assessment

Platform Work DirectiveDirectiva (UE) 2024/2831, arts. 7-8Adopted, applies later

Applies from December 2, 2026

When it relates
Digital delivery, mobility or gig platforms that organize work with algorithms.
What the rule provides
  • Do not process data on emotional or psychological state, private conversations, or data outside working time.
  • Carry out a data protection impact assessment and share it with representatives.
Typical evidence
  • DPIA of algorithmic management.
Verification
Verified in the official source on November 4, 2026Checked in the Official Journal (CELEX 32024L2831): Article 7(1) (emotional or psychological state, private conversations and data outside platform work) and Article 8 (impact assessment provided to representatives). Transposition deadline checked in Article 29(1) ("by 2 December 2026"). No Spanish transposing law is on record (not checked in the BOE); the obligations become enforceable once national law is passed.

Related base documents

Related kits

Includes 5 documents

Platforms and Algorithmic Management Kit

Algorithmic management notice to workers, human oversight, review of decisions on shifts, tasks or pay, a decision log and DPIA.

USD 129USD 215

Complete kit · available to buy

Find out what applies to you (free)Spain