Source: Privacy Matters (DLA Piper)

On 26 May 2026 Spain’s Council of Ministers approved a draft Organic Law on the proper use and governance of artificial intelligence to align national rules with Regulation (EU) 2024/1689 (the EU AI Act). The draft creates a structured governance framework with designated notifying and market surveillance authorities and designates the Spanish AI Supervisory Agency (AESIA) as the single point of contact for supervisory matters, while maintaining sector-specific supervision for AI-enabled products already covered by existing product regimes.

For AI systems not covered by sectoral product frameworks — such as those in employment, biometrics or education — supervisory responsibility will primarily fall to AESIA, the Spanish Data Protection Agency (AEPD) and the General Council of the Judiciary (CGPJ), depending on the area. The law formalises national-level regulatory sandboxes (with AESIA operating the mandatory national sandbox) and allows sector-specific sandboxes with mandatory participation of authorities responsible for sectoral public policy and fundamental rights. It establishes a graduated sanctions regime (very serious, serious, minor) with fines up to €35 million or 7% of worldwide turnover for the gravest infringements and up to €500,000 or 0.5% of turnover for the least serious, while granting authorities flexibility to adapt penalties and to prioritise corrective measures, early-payment reductions and considerations of company size to protect SMEs and start-ups. Additional measures for the state public sector include creating an inventory of AI systems used in administrative proceedings, establishing an AI delegate role, and promoting training and awareness among public employees. The law also emphasises accountability for AI systems using prohibited practices (noting the EU decision of 7 May to add two prohibited systems), mandates human oversight where fundamental rights may be affected, promotes algorithmic transparency and contains specific protections for minors. Spain frames the legislation within its digital leadership, referencing two EU AI factories and a gigafactory project, and the draft seeks to embed the EU AI Act into national law while balancing safeguards with support for safe innovation through coordinated supervision and regulatory sandboxes.