1. Risk Rating  
  2. AI regulation in your jurisdiction 
  3. Existing Regulatory Frameworks Applicable to AI
  4. Regulatory Oversight of AI 
  5. AI Guidance, Policies, and Strategic Frameworks 
  6. International AI Standards and Guidelines
  7. Forthcoming AI Legislation 
  8. Useful links

jurisdiction

Spain
Add jurisdiction

Risk Rating  

High.

AI regulation in your jurisdiction 

There is no dedicated national legislative act governing AI in Spain. However, Spain is directly subject to the Regulation (EU) 2024/1689 – Artificial Intelligence Act (“EU AI Act”), which establishes harmonised rules for AI across all EU member states. The Act introduces a risk-based approach, banning certain harmful AI practices, and imposes strict obligations on high-risk and general-purpose AI systems.

Existing Regulatory Frameworks Applicable to AI

Spain does not have a dedicated AI law yet, but there are existing legal frameworks that apply to AI systems. The following laws and sectors should be taken into consideration:

  • Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), complementing GDPR in Spain, applies broadly to AI processing personal data. 
  • Law 34/2002 of 11 July on information society services and e‑commerce applies to online AI services. 
  • Law 15/2022 of 12 July on equal treatment and non‑discrimination includes principles relevant to algorithmic bias and transparency, and refers to AI deployments by public/private sectors. 
  • Workers´ Statute and employment laws (including Royal Decree‑Law 9/2021 of 11 May (“Rider Law”)) create algorithmic transparency obligations in platform work and inform labour‑related AI governance. 
  • Product liability and consumer protection (Royal Legislative Decree 1/2007) can apply to AI‑enabled products and defects. 
  • Sectoral frameworks (telecoms, audiovisual, IP, competition) also apply depending on use (e.g., Law 11/2022 of 28 June on Telecommunications; Law 13/2022 of 7 July on Audiovisual Communications; IP Law (approved by Royal Legislative Decree 1/1996 of 12 April); Competition (Law 15/2007 of 3 July)/Unfair Competition (Law 3/1991 of 10 January)). 

Regulatory Oversight of AI 

The Spanish Agency for the Supervision of Artificial Intelligence (in Spanish, Agencia Española de Supervisión de la Inteligencia Artificial), is the main regulator overseeing AI use. However, this Agency has not enforced yet any sanction.

In addition to the above, there are many other national surveillance authorities, including the Spanish Data Protection Authority, the Bank of Spain, the National Stock Market Authority, the National Directorate for Insurance and Pension Funds, the General Council of the Judiciary and a lot of Product Safety bodies in the Spanish State and in each of the 17 Autonomous Communities. No sanction has been imposed yet by them.

AI Guidance, Policies, and Strategic Frameworks 

As a policy document and strategic framework, Spain adopted the Artificial Intelligence Strategy 2024, approved by the Council of Ministers in May 2024, which is structured around three fundamental axes: i) strengthening the key levers for the development of AI, ii) facilitating the expansion of AI in the public and private sectors by promoting innovation and cybersecurity, and iii) developing transparent, responsible, and humanistic AI.

On December 2025, the Spanish Agency for the Supervision of Artificial Intelligence published several guidelines on AI which serve as support for the implementation and compliance with European AI regulations and their applicable obligations. These guidelines will be updated i n line with the development of standards and various guidelines published by the European Commission, and they will be updated once the Digital Omnibus amending the AI Act is approved. The guidelines are avaiable in Spanish only here.

International AI Standards and Guidelines

  • OECD AI Principles
  • Other:
    • European Commission, Ethics guidelines for trustworthy AI (2019).
    • UNESCO, Recommendation on the Ethics of Artificial Intelligence (2021).
    • Council of Europe, Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (2024).

Forthcoming AI Legislation 

In January 2025 a Draft Law for the proper use of and governance of Artificial Intelligence (in Spanish “Anteproyecto de Ley para el buen uso y la gobernanza de la Inteligencia Artificial”).

The Draft Law on AI addresses the following issues:

  1. Assignment of powers for the supervision of AI systems by administrative authorities in regulated sectors: It defines which authorities these will be and what their national governance mechanisms will be.
  2. Ensuring uniform, coordinated, and effective action in the performance of the functions assigned to administrative authorities in regulated sectors: A joint commission for the coordination of market surveillance authorities is created, and the  Spanish Agency for the Supervision of Artificial Intelligence is assigned its presidency, secretariat, and management.
  3. Regulatory development in the field of AI: This is the responsibility of the Ministry for Digital Transformation and Public Administration. Specifically, the Secretariat of State for Digitalization and Artificial Intelligence, through its Directorate General for Artificial Intelligence.
  4. Develops the penalty system: Contributing to the application of the regulatory framework established by the AI Act.
  5. Digital right to disconnect or withdraw from the market AI systems that have caused serious incidents: In a novel way in the European Union, it introduces this digital right that guarantees basic fundamental rights of citizens.
  6. Sanctioning procedure: It introduces special features to the general procedure, such as the initiation of proceedings through the right of complaint, and makes it easier for any citizen, through anonymous information, to initiate sanctioning proceedings. It also provides for the possibility of adopting the necessary precautionary measures to ensure the effectiveness of the sanctioning decision until it becomes enforceable, including the possible precautionary withdrawal of the product or the disconnection or prohibition of the AI system within the territorial scope of the sanctioning market surveillance authority when the continued presence of the AI system on the market during the proceedings poses an unacceptable risk. A specific mechanism is established for SMEs in cases of minor infringements, allowing for a warning to be issued to the entity concerned.

Currently there are not details on the expected timeline of approval of the Draft Law and  submission to Congress for its parliamentary consideration.