Employees use generative AI (ChatGPT, Copilot, Gemini…) in Spain: related rules
Staff use of generative AI assistants to draft, summarize, translate, analyze or research in daily work, with approved or unapproved tools (shadow AI). The risk lies in the data entered, reliance on wrong outputs and ownership of what is generated.
Entering personal data into an external tool requires a legal basis, a processor agreement (GDPR Art. 28) and transfer controls; the AEPD published a model generative AI policy.
Obligations related to this use case
New prohibition: non-consensual intimate imagery and child sexual abuse material
AI ActReglamento (UE) 2024/1689, art. 5(1)(ba) y (bb), 5(1a) y 5(1b), añadidos por el Reglamento (UE) 2026/1744Adopted, applies later
Applies from December 2, 2026
When it relates
If you build or distribute systems that generate images, video or audio, or if your staff use generative AI to create content.
What the rule provides
Providers: do not place on the market systems whose purpose, or foreseeable output without adequate safeguards, is generating realistic intimate imagery of identifiable people without explicit consent, or child sexual abuse material.
Deployers: expressly ban using AI to create such content in the AI use policy.
Update the prohibited-practices checklist and safety filters before December 2, 2026.
Typical evidence
Checklist updated with the new cases.
Description of the generator's safety filters and tests (providers).
Use policy with the ban and a record of communicating it to staff.
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.
Five base documents to roll out copilots and assistants in order: rollout guide, unauthorized AI regularization, usage rules, tool adoption and training.