Autonomous vehicles law and regulation in Spain

Spain does not have a regulatory framework that allows the operation of Avs (Levels 3 and beyond), except in tests. The current regulations require the driver to control and be responsible of the vehicle at all times (eyes off is not allowed). Therefore Level 2 would be admissible (Tesla vehicles can be found in Spanish roads), but Level 3 and beyond would not be acceptable, except in authorized tests.

What are the primary commercial applications of AVs currently permitted in your jurisdiction (e.g. ride-hailing, freight transport, last-mile delivery, public transit, etc)?

Currently, there are not allowed primary commercial applications of AVs in Spain (beyond Level 2).

Are there specific restrictions on AV usage, such as geofencing, operational limits, or specific road types where AVs are allowed or prohibited?

As previously mentioned currently in Spain consumers are not permitted to use Avs (beyond Level 2).

Is there any regulation for the operation of AVs on private grounds?

The Spanish Regulation (art. 2 of the Ley sobre Tráfico, Circulación de Vehículos a Motor y Seguridad Vial approved by Legislative Royal Decree 6/2015, as well as art. 1.1 of the Reglamento General de Circulación, approved by Royal Decree 1428/2003) is applicable only to private roads if they are used by an undetermined group of users. If those private roads are only used by the owner of the land, then the said legislation is not applicable.

Are there legal or regulatory safety parameters regarding the testing of AVs (SAE Levels 2-4) on public roads?

Yes, the Instruction VEH 2022/07 (in Spanish Instrucción VEH 2022/07) of the General Subdirectory of Management of the Movility and Technology (in Spain Subdirección General de Gestión de la Movilidad y Tecnología) of the Ministry of Interior.

According to the abovementioned Instruction, there is a procedure for the certification of vehicles for testing purposes in public roads that includes a phase regarding the inspection of security.

Among other security elements, this procedure does mention external projections, interior clearance, condition of wheels or instrumentation/ballast attachment (if applicable). These security elements are required to be able to proceed with the dynamic testing that includes: (i) manual driving testing, (ii) override systems (switching to manual control) testing, and (iii) check of basic functionalities control) and testing of basic functionalities that impact safety for vehicle occupants and other road users.

In Spain there are not specific regulations regarding liability for damages or insurance for the operation of AVs, but the general rules on insurance are applicable.

In cases of accidents resulting from decisions made by crash algorithms, who can be held liable?

According to art. 1 of the Texto refundido de la Ley sobre Responsabilidad Civil y Seguro en la Circulación de Vehículos a Motor (approved by Legislative Royal Decree 8/2004, of 29th October), the driver is always liable. In addition to that, it may happen that the manufacturer was also held liable if the damage was caused by the crash algorithm.

In your jurisdiction, is there a legal basis supporting the lawfulness of autonomous decisions that, in extreme situations, impact the physical integrity or life of passengers or other participants to protect one of the involved parties?

General rules are applicable, as there are no specific regulation. According to the rules mentioned above, the driver will be liable for any decisions taken by the autonomous vehicle, and the manufacturer may be also liable. Furthermore, the vehicle should be homologated, and these autonomous decisions will be taken into account in the homologation process (see Ley sobre Tráfico, Circulación de Vehículos a Motor y Seguridad Vial, Legislative Royal Decree 6/2015, of 30 October).

Are there any legal implications regarding the manufacturer's liability in the event of cyberattacks that affect the operation of AVs (SAE Levels 2-4) or cause harm to passengers?

The manufacturer will be liable of the damages suffered when an appropriate level of cybersecurity has not been provided. Cybersecurity must be considered by design and when providing the AV.

Currently there are not specific regulations on data collection, privacy, and cybersecurity for AVs. The previoulsy mentioned Instruction VEH 2022/07 includes limited provision on cybersecurity.

On data collection and privacy, the General Data Protection Regulation (GDPR), and the Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, in addition to other laws and regulations on this subject matter that could be enacted or develop them, are applicable.

Are there legal grounds authorizing the collection of external data and data from unspecified subjects for system improvement and learning, whether during testing or while in operation?

For personal data, legimate interest (art. 6(1)(f) of the GDPR), and, for safety purposes, the performance of  task carried out in the public interet (art. 6(1)(e) of the GDPR), could be legal grounds authorizing the processing of personal for these purposes.

For non personal data, processsed (obtained, generated or collected) by means of components or operating systems of connected devices, data concerning their performance, use or environment, the Data Act would be applicable.

Is there any obligation for AV operators to collect and provide operation data, e.g. telemetrics?

As a security element of AVs, the Instruction VEH 2022/07 provides that the AV will be equipped with automated driving system data recorder (for recording information and data related to the autonomous driving of the vehicle) or event data recorder (for recording vehicle dynamic and time-series data during the period immediately preceding an event (e.g., vehicle speed versus time) or during an accident).

What incentives, subsidies, or regulatory support exist for businesses developing or deploying AV technology?

Regarding regulatory support, the Ministry of Interior published in 2024 a draft of Royal Decree that would regulate Avs as part of the national strategy on road safety 2030 (in Spanish Estrategia de Seguridad Vial 2030, available in Spanish only here).

We aren’t aware of any incentives or subsidies specifically addressed to AVs.

What major AV projects, pilot programs, or business partnerships are currently active in your jurisdiction?

There are several AVs projects and pilot programs (e.g. the company Avanza put into circulation an autonomous zero-emission bus on the streets of Malaga (AutoMOST) in February 2021).

Ministry of Transport, Mobility and Urban Agenda´s (MITMA) Safe, Sustainable and Connected Mobility Strategy 2030 includes a line of action focused on transport automation and the promotion of connected and autonomous vehicles. This Strategy (available in Spanish only here) is the roadmap that will guide the actions of the MITMA in terms of transport and mobility in the next ten years.

Some private projects, with private investment, in Spain are being conducted (for example: Project 5GVEC - Investors: Ericsson, Tinámica, Tupl, Softcrits, Premo, Top Digital, the Innova IRV Foundation and the University of Malaga; Project R3CAV - Investors: Indra, Gmv, Masermic, Masmóvil, Renault Group, Sigma and Alsa; Project NEVA - Investors: FEM Expert and Nebrija University, through the Green Vehicle Engineering Research Group; Project Diana (SEAT León) - Investors: Seat and the Automotive Technology Center of Galicia (CTAG), and Project STLA AutoDrive 1.0 - Investors: Stellantis).