Spain: Government approves the draft Organic Law on the proper use and governance of artificial intelligence

2026-05-28 · Source: Privacy Matters · Field: Legal & Regulatory — Regulatory Affairs & Government Relations, Compliance & Risk Management · Depth: Intermediate, short

Summary

On May 26, 2026, Spain's Council of Ministers approved a draft Organic Law on the proper use and governance of artificial intelligence, aligning national law with Regulation (EU) 2024/1689, the "EU AI Act." This legislation establishes a framework for trustworthy, human-centric AI, balancing regulatory oversight with innovation support. It creates a structured governance framework, designating AESIA as the single point of contact for supervisory matters, alongside the AEPD and CGPJ for specific AI systems. The law introduces a graduated sanctions regime, with fines reaching up to €35 million or 7% of worldwide turnover for very serious infringements, and up to €500,000 or 0.5% for minor cases, while prioritizing corrective measures and protecting SMEs. Additionally, it mandates an inventory of all AI systems in the state public sector, establishes an AI delegate role, and formalizes national AI regulatory sandboxes operated by AESIA to aid compliance.

Key takeaway

For legal professionals advising on AI deployment in Europe, this Spanish law signals a robust national implementation of the EU AI Act. You should assess your organization's AI systems against the new governance framework, particularly regarding compliance with AESIA's oversight and the graduated sanctions regime. Proactively review internal AI use, especially in public sector engagements, and consider participating in national regulatory sandboxes to ensure adherence and mitigate significant financial penalties.

Key insights

Spain's new AI law integrates EU AI Act principles, establishing a comprehensive governance and sanctions framework while fostering innovation.

Principles

• AI governance requires balancing regulatory oversight with innovation support.
• Sanctions regimes should be graduated, flexible, and prioritize correction over penalization.
• Public sector AI transparency benefits from comprehensive system inventories.

In practice

• Designate a single point of contact for AI supervisory matters.
• Implement flexible, graduated sanctions considering company size.
• Create an inventory of all AI systems in administrative proceedings.

Topics

• Spain AI Law
• EU AI Act
• AI Governance
• Regulatory Sandboxes
• Sanctions Regime
• Public Sector AI

Best for: CTO, VP of Engineering/Data, Executive, Legal Professional, Policy Maker, Director of AI/ML

Related on AIssential

• The EU AI Act, Decoded — The EU AI Act establishes a phased, risk-based regulatory framework for AI systems used within Europe.
• The Pope released a 42,000-word document about AI this week and an Anthropic co-founder was sitting next to him — AI ethics require legal frameworks, as private companies cannot effectively self-regulate due to inherent incentives.
• AI regulation in Africa: why copying the European model won’t work — African AI regulation must prioritize local context and implementation capacity over direct transplantation of European models.
• AI Data Transfers: GDPR, SCCs & EU AI Act Rules — GDPR and the EU AI Act create distinct, non-interchangeable compliance obligations for AI data, demanding an integrated approach.
• State AI Law Is the Only AI Law. Everywhere It's Crumbling. — State-level AI regulation efforts are broadly failing, resulting in minimal oversight.
• A Red Line and Oversight Framework for Government AI Contracts — The framework establishes ethical AI use standards and an internal oversight body to manage government contracts and liability.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Privacy Matters.