Governance in Spain

In Spain, supervision of the AI Act is organised around the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), whose Statute was approved by Royal Decree 729/2023. When an AI system processes personal data, the Spanish Data Protection Agency (AEPD), the GDPR supervisory authority in Spain, is also involved.

The draft Organic Law on the good use and governance of artificial intelligence was approved by the Council of Ministers on 26 May 2026 and published in the Official Gazette of the Spanish Parliament on 12 June 2026 (series A, no. 97-1). It lapsed on 6 October 2026 when Parliament was dissolved (Royal Decree 806/2026). There is currently no Spanish law setting out penalties for infringements of the EU AI Act.

Royal Decree 817/2023 set up a controlled testing environment to trial compliance with what was then the proposed AI Regulation. Article 57(1) of the AI Act, as amended by Regulation (EU) 2026/1744, requires each Member State to have at least one AI regulatory sandbox in operation by 2 August 2027.

The articles in this section, written in Spanish, analyse the AESIA guidelines, the draft organic law, the sandbox and the role of the Spanish authorities.

In the guide to the safe use of AI in companies (in Spanish): La IA en España: normativa, AESIA y ayudas · La AESIA y sus guías, explicadas · Gobernanza de la IA en la empresa: comité, inventario y responsables

Sources: Real Decreto 729/2023; BOCG, Congreso, serie A, núm. 97-1; Real Decreto 817/2023; Reglamento (UE) 2026/1744. Checked on 20 October 2026.