Source: Adlanter

The Draft Organic Law for the Proper Use and Governance of Artificial Intelligence adapts the European AI Regulation into Spanish law and establishes a comprehensive framework for supervising, controlling and sanctioning AI use in Spain. The regulation adopts a risk-based approach that classifies AI systems as unacceptable (prohibited), high-risk (subject to control and supervision) and limited/minimal risk (subject to transparency obligations). It introduces a sanctioning regime that in the most serious cases may reach up to €35 million or 7% of global turnover, and identifies sanctionable conduct such as use of prohibited systems, lack of effective human oversight, and breaches of transparency requirements.

The law explicitly expands responsibility to include both developers and entities that use or implement AI systems, meaning companies can be sanctioned for non-compliant systems even if developed by third parties. Prohibited uses include systems that manipulate human decisions, exploit vulnerabilities, or carry out certain surveillance or biometric classification; the Government also forbids AI-generated sexual deepfakes and child pornography content. High-risk applications highlighted for business impact include recruitment, candidate evaluation, promotion decisions and other HR-related automated decision-making, which will face enhanced requirements on transparency, traceability, data control and ongoing supervision. Governance will be multi-level, coordinated by the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) with sectoral roles for bodies such as the Spanish Data Protection Agency, the Bank of Spain and the General Council of the Judiciary. The article concludes with recommended company actions: identify AI systems in use, assess high-risk status, implement human oversight, strengthen governance and review recruitment and automated decision processes; Adlanter offers advisory support for designing compliance models.