Skip to content
AI Policy Generator

ESWhat applies

Biometrics, facial or emotion recognition in Spain: related rules

Identifying or verifying people by physical or behavioral traits, biometric categorization and emotion recognition. It is the most restricted use: bans in the EU and Peru, written consent in several US states and sensitive data across Latin America.

Risk classification

JurisdictionLevelDateNote
European UnionProhibited practiceFebruary 2, 2025Banned: untargeted facial scraping, categorization by sensitive traits, emotion recognition at work and in education, and real-time remote identification by law enforcement except in narrow cases.
European UnionHigh riskDecember 2, 2027Remote biometric identification and emotion recognition outside banned settings (Annex III(1)); one-to-one verification is excluded.
European UnionTransparencyAugust 2, 2026Inform people exposed to emotion recognition or biometric categorization (Art. 50(3)).
SpainData protection—Biometric data used for identification is a special category (GDPR Art. 9); the AEPD requires an impact assessment and is very restrictive.

Obligations related to this use case

Workers' digital rights when AI is used for monitoring

LOPDGDDLOPDGDD, arts. 87-91; Estatuto de los Trabajadores, art. 20 bisIn force

Already applicable

When it relates
If you monitor employees with digital tools, cameras, geolocation or biometrics.
What the rule provides
  • Set criteria for using digital devices with the participation of worker representatives, and inform staff.
  • Give prior, express and clear notice of video surveillance and geolocation.
  • Respect privacy and the right to digital disconnection; the AEPD rejects continuous visual monitoring of the whole working day.
Typical evidence
  • Device use policy and staff communication.
  • Monitoring DPIA.
Verification
Verified in the official source on October 31, 2026Consolidated text in the BOE (Spain's official gazette). In force since 2018; no new dates to confirm.

Prohibitions on biometrics and emotion recognition

AI ActReglamento (UE) 2024/1689, art. 5(1)(e), (f) y (g)In force

Applies from February 2, 2025

When it relates
If you use biometrics, facial or emotion recognition, monitor workers or assess students.
What the rule provides
  • Confirm that no monitoring or assessment tool infers the emotions of employees or students. Measuring a customer's tone is outside the ban; measuring the agent's tone is not.
  • Rule out biometric categorization that infers sensitive traits and facial databases built by mass image scraping.
  • Document why each permitted biometric system falls outside the prohibitions.
Typical evidence
  • Record for each biometric or monitoring system with its Article 5 analysis.
  • Vendor contract or specification confirming which features are enabled.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Deployer transparency: deepfakes, public-interest text and emotion recognition

AI ActReglamento (UE) 2024/1689, art. 50(3)-(4)In force

Applies from August 2, 2026

When it relates
If you use chatbots, agents, generated marketing content, voice or likeness cloning, or emotion recognition or biometric categorization.
What the rule provides
  • Clearly disclose that an image, audio or video is a deepfake (content that imitates real people, places or events). For artistic or satirical works a disclosure that does not spoil the work is enough.
  • Disclose that text published to inform the public on matters of public interest was AI-generated, unless it went through human editorial review with someone accountable.
  • Inform people exposed to emotion recognition or biometric categorization.
  • Check that any third-party chatbot or agent you use discloses that it is AI; if you configure and publish it under your brand, take on the provider duties.
Typical evidence
  • Synthetic-content labeling procedure with approved examples.
  • Screenshots of notices on web, app, phone and social media.
  • Log of AI-assisted published pieces and their labels.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Using high-risk systems: human oversight, logs and monitoring

AI ActReglamento (UE) 2024/1689, art. 26(1)-(6) y (8)-(12); Anexo III; art. 6(1) y Anexo I; art. 113Adopted, applies later

Applies from December 2, 2027

Deadlines by profile

  • : Annex III high-risk systems
  • : Clinical AI that is a high-risk medical device (Annex I)
When it relates
If you use AI for hiring or managing staff, monitoring workers, credit scoring, life or health insurance pricing, student assessment, biometrics or access to public benefits (Annex III). Also, from Aug 2, 2028, if you use clinical AI that is a medical device subject to notified-body assessment (Annex I).
What the rule provides
  • Use the system according to the provider's instructions.
  • Assign human oversight to people with enough competence, training, authority and support.
  • Ensure input data under your control is relevant and representative.
  • Monitor operation, suspend use when risks appear, and report serious incidents to the provider and the authority.
  • Keep automatically generated logs under your control for at least six months.
  • Public bodies: register the use in the EU database. Systems already in use by public authorities: deadline Aug 2, 2030.
Typical evidence
  • Appointment and training records of human overseers.
  • Log retention policy and sample logs.
  • Monitoring plan and incident log.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i) (Dec 2, 2027 for Annex III). Regulation (EU) 2026/1744 moved the date but not the content of Article 26.

Inform and explain to people affected by high-risk decisions

AI ActReglamento (UE) 2024/1689, arts. 26(11) y 86Adopted, applies later

Applies from December 2, 2027

When it relates
If you make or support decisions about people with an Annex III high-risk system.
What the rule provides
  • Tell people that a high-risk system is being used on them.
  • On request, give a clear and meaningful explanation of the system's role in the decision and its main elements when the decision has legal or similarly significant effects.
Typical evidence
  • Notices to affected people.
  • Explanation template and log of requests handled.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Fundamental rights impact assessment (FRIA)

AI ActReglamento (UE) 2024/1689, art. 27Adopted, applies later

Applies from December 2, 2027

When it relates
Public bodies and private companies providing public services that use high-risk AI; and any company using AI to assess creditworthiness or price life and health insurance.
What the rule provides
  • Before first use, assess processes, duration and frequency, affected people or groups, specific risks of harm, human oversight measures and risk responses, including complaints.
  • Notify the results to the market surveillance authority using the AI Office form.
  • It can build on an existing data protection impact assessment and must be updated when factors change.
Typical evidence
  • Signed and dated FRIA.
  • Proof of notification to the authority.
Verification
Verified in the official source on November 2, 2026Date checked (Article 113(c)(i)). Scope per Article 27: it does not cover every employer using AI for hiring; some vendor websites wrongly extend it.

Providers of Annex III high-risk systems

AI ActReglamento (UE) 2024/1689, arts. 6(3)-(4), 8-17, 43, 47-49, 72-73Adopted, applies later

Applies from December 2, 2027

When it relates
If you develop or sell under your name an AI system for an Annex III use (employment, credit, life and health insurance, education, biometrics, public services).
What the rule provides
  • Risk management system across the lifecycle and governance of training, validation and test data.
  • Technical documentation, automatic event logging, instructions for use, design for human oversight, and accuracy, robustness and cybersecurity.
  • Quality management system, conformity assessment, EU declaration of conformity, CE marking and registration in the EU database.
  • Post-market monitoring and serious-incident reporting.
  • If you conclude that your Annex III system is not high-risk (Article 6(3)), document the assessment and register it before placing it on the market.
  • Small mid-caps (fewer than 750 employees) get simplified documentation templates.
Typical evidence
  • Technical file and quality management system.
  • EU declaration of conformity and registration number.
  • Post-market monitoring plan.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i). The small mid-cap category comes from secondary sources on Regulation (EU) 2026/1744.

Data protection impact assessment (DPIA)

GDPRRGPD, art. 35In force

Already applicable

When it relates
If you use AI to evaluate or decide about people, monitor, use biometrics, train models on personal data, or process sensitive or children's data.
What the rule provides
  • Carry out the DPIA before starting: description, necessity and proportionality, risks and measures.
  • Consult the authority if residual risk remains high.
  • Review it when the system or model changes.
Typical evidence
  • Signed DPIA, with the data protection officer's opinion if there is one.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Related base documents

Find out what applies to you (free)Spain