Spain
EU AI Act implementation, 2026
Spain has the EU's first dedicated AI supervisory agency (AESIA, operating since 2023), a completed national sandbox cohort and 16 compliance guides, but its implementing Organic Law lapsed on 6 October 2026 when the Cortes were dissolved for the 29 November 2026 general election, leaving no national penalty regime or statutory authority allocation.
- Implementing law
- Draft billMay 2026
- Penalty regime (Art. 99)
- Not adopted
- Regulatory sandbox
- Operational
- Readiness rank
- 13 of 27score 60 / 100
Key findings
- Spain is institutionally the most advanced of the nine (AESIA since 2023, sandbox cohort completed, 16 guides) but legislatively back to square one after the bill lapsed on 6 October 2026.
- No national Article 99 penalty regime exists; AESIA's enforcement powers against operators remain limited until an organic law is re-tabled by the next legislature (new Cortes convene 23 December 2026).
- AESIA is the de facto single point of contact and the notified Spanish lead to the Commission; the sectoral allocation (AEPD, CGPJ, financial regulators) was only in the draft.
- The sandbox is genuinely operational - Spain ran the EU's first and its outputs feed AESIA guidance - though a second call had not been announced.
- The 2024 AI Strategy (EUR 1.5 billion, ALIA language models, AESIA's role) remains the governing policy document.
National authorities
AESIA - Agencia Española de Supervisión de la Inteligencia Artificial
Central AI supervisory agency (A Coruña, created 2023) and single point of contact; general market surveillance authority and operator of the mandatory national sandbox under the lapsed bill; currently focused on guidance, training and the sandbox
espanadigital.gob.es (opens in new tab)Sectoral authorities (AEPD and regional DPAs, CGPJ, Banco de España, CNMV, DGSFP)
Proposed sectoral market surveillance authorities in the lapsed Proyecto de Ley Orgánica: data protection authorities for biometric, migration and border systems, the CGPJ for justice, and the financial regulators for creditworthiness and life/health insurance; AESIA for AI in democratic processes (via a LOREG amendment). Roles not fixed in law
ecija.com (opens in new tab)Not designated or not confirmed as of 21 Oct 2026.
AESIA - Agencia Española de Supervisión de la Inteligencia Artificial
Implementing law, penalties and sandbox
Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial (121/000096) - lapsed on dissolution of the Cortes
May 2026
congreso.es (opens in new tab)No national penalty rules under Article 99 are in force; regulators rely on existing powers.
Spain's AI regulatory sandbox, created by Real Decreto 817/2023 and run with the European Commission, completed its first cohort: 11 high-risk systems finished the programme at a closing event on 12 June 2026 and the resulting technical guides are published by AESIA. AESIA announced further calls under the (now lapsed) AI law framework; no second call date was found.
digital.gob.es (opens in new tab)Estrategia de Inteligencia Artificial 2024
2024
digital.gob.es (opens in new tab)Notable developments
-
Anteproyecto de Ley de buen uso y gobernanza de la IA approved in first reading
The Council of Ministers approved the preliminary draft on 11 March 2025, naming AESIA as lead authority and sandbox operator, a Directorate-General for AI as notifying authority, whistleblower protection and an AI delegate figure; the CGPJ later issued its report on the text.
esmartcity.es (opens in new tab) -
AESIA publishes 16 AI Act compliance guides
On 5 February 2026 AESIA released 16 guides (introductory, 13 technical guides on high-risk requirements, and a checklist manual) to support compliance ahead of the high-risk obligations.
mondaq.com (opens in new tab) -
Government sends the Organic Law bill to Congress
Approved by the Council of Ministers on 26 May 2026 and registered as Proyecto 121/000096; the Mesa del Congreso agreed on 8 June and the text was published in the BOCG on 12 June 2026 and assigned to the Economy, Trade and Digital Transformation Committee. It names AESIA as market surveillance authority and single point of contact, the Dirección General de IA as notifying authority (with ENAC support), sets up a single complaints window and adds a chapter on AI in the state public sector.
ecija.com (opens in new tab) -
First EU AI sandbox cohort concludes
The Ministry for Digital Transformation closed the first national AI regulatory sandbox on 12 June 2026, with 11 systems completing it and AESIA outlining a roadmap of new sandbox calls under the draft AI law.
digital.gob.es (opens in new tab) -
Cortes dissolved; AI bill lapses
Real Decreto 806/2026 of 5 October (BOE 6 October 2026) dissolved Congress and Senate and called elections for 29 November 2026. After six extensions of the amendment deadline the bill never reached committee report and is recorded as 'caducada' with last movement on 6 October 2026.
terceracamara.es (opens in new tab)
Analysis
Spain built its AI Act institutions before it wrote its AI Act law. AESIA, headquartered in A Coruña, has existed since 2023 as Europe's first dedicated AI supervisory agency and is treated by the government and by the artificialintelligenceact.eu tracker as Spain's single point of contact. The Real Decreto 817/2023 sandbox, run with the European Commission, graduated eleven high-risk systems on 12 June 2026, and AESIA turned that work into 16 published compliance guides in February 2026. On capacity, guidance and sandboxing, Spain leads this group.
The legislative track has been far less fortunate. The anteproyecto of March 2025 became a Proyecto de Ley Orgánica approved by the Council of Ministers on 26 May 2026 and published in Congress on 12 June 2026. It would have fixed AESIA as general market surveillance authority, created a Directorate-General for AI as notifying authority, allocated sectoral roles to the data protection authorities, the CGPJ and the financial regulators, set up a single complaints portal and transposed the Article 99 fine tiers into Spanish administrative law. Instead, the amendment deadline was extended six times through the summer, and when Real Decreto 806/2026 dissolved the Cortes on 6 October 2026 the bill lapsed without ever reaching committee.
The result is a split verdict: Spain is 'partial' with a relatively high score because the regulator, sandbox and guidance are real and working, but it has no statutory penalty regime, no formally designated notifying authority and no legal allocation of sectoral competences, and cannot have one before a new government re-tables a bill in 2027. The Digital Omnibus on AI, which moved Annex III high-risk obligations to 2 December 2027, gives the next legislature a window, but the November 2026 election makes the content and timing of a new text entirely open.
EU AI Act 2026 Q3 Report
All 27 member-state profiles including Spain, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.
Sources
- AESIA - Agencia Española de Supervisión de la Inteligencia Artificial (opens in new tab) espanadigital.gob.es
- Sectoral authorities (AEPD and regional DPAs, CGPJ, Banco de España, CNMV, DGSFP) (opens in new tab) ecija.com
- Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial (121/000096) - lapsed on dissolution of the Cortes (opens in new tab) congreso.es
- Regulatory sandbox (opens in new tab) digital.gob.es
- Estrategia de Inteligencia Artificial 2024 (opens in new tab) digital.gob.es
- Anteproyecto de Ley de buen uso y gobernanza de la IA approved in first reading (opens in new tab) esmartcity.es
- AESIA publishes 16 AI Act compliance guides (opens in new tab) mondaq.com
- Cortes dissolved; AI bill lapses (opens in new tab) terceracamara.es