Spain readies AI enforcement as operator deadlines near

Spain is further ahead than most EU countries in building an AI enforcement regime. AESIA, created by Royal Decree 729/2023 and operational since June 2024, is positioned as the national competent authority for Regulation (EU) 2024/1689, with powers covering market surveillance, complaints, audits, inspections, sandbox oversight and penalties.

Several EU AI Act duties already apply in Spain, including Article 5 prohibited practices and Article 4 AI literacy obligations since 2 February 2025. Article 50 transparency rules and Article 26 high-risk deployer duties currently apply from 2 August 2026, although a Digital Omnibus provisional agreement reached on 7 May 2026 would move the Annex III high-risk deadline to 2 December 2027 if formally adopted.

Spain’s draft Organic Law on AI governance, approved by the Council of Ministers on 26 May 2026, would formalize AESIA’s role, coordinate sector regulators and introduce a public-sector AI register. Operators also face a changing liability landscape: Directive (EU) 2024/2853 applies to products placed on the market after 9 December 2026 and expressly covers software and AI systems, adding a civil liability route alongside administrative penalties that can reach EUR 35 million or 7 per cent of global turnover.