On 26 May 2026 the Council of Ministers (Consejo de Ministros) gave the green light to one of the most significant technology laws of recent years. The Council of Ministers approved, for submission to the Congress of Deputies (Congreso de los Diputados), the bill for an Organic Law on the proper use and governance of artificial intelligence (proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial). For any company that develops, markets or simply uses AI systems, this law marks a turning point in regulatory compliance.
In this article we explain what the new AI law in Spain establishes, who it applies to, which practices it prohibits and which penalties it provides for, so that you can get ahead before the text completes its passage through Parliament.
What the new AI Law in Spain is
The law is the missing piece needed to fit Spanish legislation into the European framework. It adapts the Spanish legal system to the European Artificial Intelligence Regulation (Reglamento europeo de Inteligencia Artificial, RIA), in force since August 2024, and seeks to guarantee human oversight of the technology and a trustworthy use of AI.
Regulation (EU) 2024/1689 entered into force on 1 August 2024, but it applies in stages: the prohibitions and general provisions have applied since 2 February 2025; the rules on governance, notified bodies and obligations for providers of general-purpose AI models since 2 August 2025; and the Regulation as a whole, including the high-risk obligations, since 2 August 2026.
We are currently talking about a bill, not a law that is already in force.
The text has been approved by the Government and sent to the Spanish Parliament (Cortes), where it must complete its passage. The European Regulation, by contrast, is directly applicable. Chapter II of the Regulation (prohibited practices) has applied since 2 February 2025; however, the enforcement rules for that chapter are not operational until 2 August 2026, the date by which the national competent authorities must be designated (although this date could change as a result of the “Digital Omnibus on AI” legislative proposal, currently under negotiation, which could postpone the start of application of the high-risk obligations in Annex III until no later than 2 December 2027).
Prohibited AI systems
The heart of the law lies in the list of banned uses. The European Regulation classifies AI systems according to their risk and directly prohibits those it considers unacceptable. The prohibited practices include:
- Subliminal techniques (imperceptible images or sounds) intended to materially distort a person’s behaviour by appreciably impairing their ability to make an informed decision, and which cause, or are reasonably likely to cause, significant harm. The prohibition also covers manipulative or deceptive techniques, not only strictly subliminal ones.
- The exploitation of vulnerabilities linked to age, disability or socio-economic situation in order to seriously alter a person’s behaviour.
- Biometric categorisation that classifies people by their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
- Social scoring, meaning scoring individuals or groups on the basis of their social behaviour or personal characteristics where the resulting score leads to detrimental treatment in social contexts unrelated to the context in which the assessed data were originally generated, or to treatment that is unjustified or disproportionate to that data.
The risk levels of AI
Regulation (EU) 2024/1689, whose approach the future Spanish law adopts, classifies AI systems into four risk categories: (i) unacceptable risk (prohibited practices), (ii) high risk, (iii) transparency risk and (iv) minimal or no risk. The higher the risk, the greater the requirements for providers and deployers.
Transparency: how we will know which content has been generated by AI
The Regulation requires providers of systems that generate synthetic content to ensure that the outputs are marked in a machine-readable format and detectable as artificially generated (using techniques such as watermarks, metadata or others, as technically feasible). In addition, deployers must transparently disclose when content is a deepfake or, in the case of texts on matters of public interest, that it has been generated by AI (with an exception for editorial and artistic uses).
The aim? That citizens, businesses and public authorities can clearly tell what is real and what has been artificially generated or manipulated. In a context of growing disinformation, this identification becomes one of the most practical tools in the whole law and a direct obligation for any company that publishes images, videos, audio or texts created with AI.
The governance framework: who supervises and how the law will be applied
A law is only as effective as its system of control. And here the Spanish bill does three things at once: it shares supervision among several authorities, it brings order to the public administration itself and it opens a safe space for innovation.
Get in touch
Need help?
Who supervises each AI system?
The law does not concentrate control in a single body; instead, it allocates powers according to the field of each system. Products already regulated by sector-specific rules keep their market surveillance authority, while the remaining systems are mainly assigned to the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), the Spanish Data Protection Agency (AEPD) and the General Council of the Judiciary (CGPJ):
| Field of the AI system | Supervisory authority |
|---|---|
| Machinery, toys, vehicles, medical devices and other products that are already regulated | Their current sector-specific market surveillance authority |
| Employment, biometrics, education and other high-risk systems | AESIA, AEPD and CGPJ |
| Single point of contact for supervision | AESIA |
This allocation of powers is the one provided for in the bill sent to the Congress of Deputies; it may be amended during the parliamentary process and is not law in force. For the purposes of the European Regulation, the Member State must designate the national competent authorities and a single point of contact.
The text does not merely transpose the European Regulation; it also brings order to the public use of the technology. It creates an inventory of the AI systems used in administrative procedures and establishes the role of the AI officer, who will have three main functions:
- Coordinating the application of AI regulations within their body.
- Advising on the design of projects that incorporate artificial intelligence.
- Ensuring compliance in public procurement processes.
Both instruments will be implemented by Royal Decree (Real Decreto) and will be accompanied by enhanced training for public employees.
A sandbox to innovate with legal certainty
Finally, the law sets aside a space for companies that want to stay ahead. The text introduces a regulatory sandbox at national level. Its creation responds to the obligation that Regulation (EU) 2024/1689 imposes on all Member States to ensure that at least one national sandbox is operational by 2 August 2026, which may be established jointly with other States or met through equivalent participation. The designation of the specific body that will run it in Spain (foreseeably AESIA) depends on the passage and final approval of the Spanish law.
What is it for, in practice? It allows a company developing AI solutions to validate compliance with the law before launching its product on the market, reducing regulatory uncertainty precisely in the most delicate phase.
How the new AI Law affects your company
If your organisation develops, integrates or uses artificial intelligence systems, it is advisable to start preparing without waiting for final approval.
Some recommended actions are:
- Take inventory of the AI systems the company uses and classify them by risk level.
- Check that none of them involves a prohibited practice.
- Introduce labelling and transparency mechanisms for content generated with AI.
- Document human oversight in processes that affect people’s rights.
- Assign internal responsibilities for compliance and training.
Frequently asked questions about the AI Law in Spain
Regulation (EU) 2024/1689 entered into force on 1 August 2024 and is directly applicable, but in stages: the prohibited practices have applied since 2 February 2025 and the Regulation as a whole, including the high-risk obligations, since 2 August 2026 (although this date could change as a result of the “Digital Omnibus on AI” legislative proposal, currently under negotiation, which could postpone the start of application of the high-risk obligations in Annex III until no later than 2 December 2027).
To public and private entities that act as providers, operators or deployers of AI systems in Spain.
The Regulation (RIA) is the directly applicable European rule. The Spanish law complements it by designating the supervisory authorities, setting the penalty regime, regulating the testing environments and adding measures for the proper use of AI in the public sector.
Yes. The Regulation requires providers of systems that generate synthetic content to ensure that their outputs are marked in a machine-readable format as artificially generated, using techniques such as watermarks, metadata or others, as technically feasible. In addition, those who deploy these systems must transparently disclose when content is a deepfake, subject to exceptions for artistic and editorial uses.
At Supra Legit Lawyers we help companies and self-employed professionals (autónomos) adapt to the new AI regulation: risk analysis of your systems, review of prohibited practices, transparency and the penalty regime. Contact our team and get your business ready before the law completes its passage.
Sources:
- Ministry for Digital Transformation and the Civil Service (Ministerio para la Transformación Digital y de la Función Pública), “The Government approves the bill that will guarantee human oversight and a trustworthy use of AI” (26/05/2026).
- European Commission, “AI Act” (11-05-2026).
Get in touch
