Skip to content
AI Policy Generator

Companion or social chatbot in Spain: related rules

Chatbots designed to sustain personal relationships or conversations, such as friendship, emotional support or characters. Several US states already require notices, crisis protocols and protections for minors.

Risk classification

JurisdictionLevelDateNote
European UnionTransparencyAugust 2, 2026AI interaction notice (Art. 50); manipulation or exploiting minors' vulnerabilities is a prohibited practice (Art. 5) since Feb 2, 2025.

Obligations related to this use case

New prohibition: non-consensual intimate imagery and child sexual abuse material

AI ActReglamento (UE) 2024/1689, art. 5(1)(ba) y (bb), 5(1a) y 5(1b), añadidos por el Reglamento (UE) 2026/1744Adopted, applies later

Applies from December 2, 2026

When it relates
If you build or distribute systems that generate images, video or audio, or if your staff use generative AI to create content.
What the rule provides
  • Providers: do not place on the market systems whose purpose, or foreseeable output without adequate safeguards, is generating realistic intimate imagery of identifiable people without explicit consent, or child sexual abuse material.
  • Deployers: expressly ban using AI to create such content in the AI use policy.
  • Update the prohibited-practices checklist and safety filters before December 2, 2026.
Typical evidence
  • Checklist updated with the new cases.
  • Description of the generator's safety filters and tests (providers).
  • Use policy with the ban and a record of communicating it to staff.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Provider transparency: disclose AI interaction and mark synthetic content

AI ActReglamento (UE) 2024/1689, art. 50(1)-(2) y art. 111(4)In force

Applies from August 2, 2026

When it relates
If you build or sell under your own name a chatbot, agent, voice assistant or a system that generates text, images, audio or video. If you build your own chatbot on a third-party model and put it into service under your brand, you are usually the provider.
What the rule provides
  • Design systems that interact with people so those people know they are dealing with AI, unless it is obvious.
  • Mark generated or manipulated audio, images, video and text in a machine-readable format, using effective and interoperable techniques.
  • Generative systems placed on the market before Aug 2, 2026: complete technical marking by Dec 2, 2026 at the latest.
  • The Commission's Code of Practice on transparency of AI-generated content can serve as a reference.
Typical evidence
  • Wording and placement of the AI-interaction notice in each channel.
  • Technical specification of marking (watermarks, metadata) and detection tests.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Deployer transparency: deepfakes, public-interest text and emotion recognition

AI ActReglamento (UE) 2024/1689, art. 50(3)-(4)In force

Applies from August 2, 2026

When it relates
If you use chatbots, agents, generated marketing content, voice or likeness cloning, or emotion recognition or biometric categorization.
What the rule provides
  • Clearly disclose that an image, audio or video is a deepfake (content that imitates real people, places or events). For artistic or satirical works a disclosure that does not spoil the work is enough.
  • Disclose that text published to inform the public on matters of public interest was AI-generated, unless it went through human editorial review with someone accountable.
  • Inform people exposed to emotion recognition or biometric categorization.
  • Check that any third-party chatbot or agent you use discloses that it is AI; if you configure and publish it under your brand, take on the provider duties.
Typical evidence
  • Synthetic-content labeling procedure with approved examples.
  • Screenshots of notices on web, app, phone and social media.
  • Log of AI-assisted published pieces and their labels.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Data protection impact assessment (DPIA)

GDPRRGPD, art. 35In force

Already applicable

When it relates
If you use AI to evaluate or decide about people, monitor, use biometrics, train models on personal data, or process sensitive or children's data.
What the rule provides
  • Carry out the DPIA before starting: description, necessity and proportionality, risks and measures.
  • Consult the authority if residual risk remains high.
  • Review it when the system or model changes.
Typical evidence
  • Signed DPIA, with the data protection officer's opinion if there is one.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Related base documents

Related kits

Includes 5 documents

Customer Service Chatbot Kit

AI interaction notice, right to reach a human, explanations, complaints and incidents for a customer-facing chatbot or voice assistant.

USD 109USD 175

Complete kit · available to buy

Includes 5 documents

Education and Minors Kit

Chatbot protocol for minors and crises, DPIA, AI notices, human oversight in assessment and a check for prohibited practices such as emotion recognition.

USD 109USD 175

Complete kit · available to buy

Find out what applies to you (free)Spain