SpainAI regulation

Regulation Status

• As an EU member state Spain applies the EU AI Act through AESIA; it has no standalone comprehensive national AI law yet in force, with a draft Organic Law on AI governance progressing through Parliament.
• Spain was the first EU country to establish a dedicated AI regulator, the Spanish Agency for the Supervision of AI (AESIA), created by Royal Decree in August 2023, and set up the EU's first AI regulatory sandbox via Royal Decree 817/2023; AESIA has since issued guidance and templates for high-risk AI systems under the EU AI Act (2025).
• The Spanish Data Protection Agency (AEPD) has been highly active, clarifying it can enforce against prohibited AI systems under the EU AI Act and publishing guidance on AI-generated image risks, agentic AI, and privacy when using AI tools (2025-2026); the competition regulator CNMC has sought to extend product-safety rules to AI (2026).
• Spain is advancing dedicated legislation: a 2025 draft law setting large fines for failing to label AI-generated content and providing a right to withdraw harmful AI systems, and in May 2026 the Council of Ministers approved a draft Organic Law on AI governance, now sent to Parliament, alongside bills curbing deepfakes and tightening image-consent rules.