AI Strategy & Frameworks·March 29, 2026
🇪🇸
AI in Spain
Spain has crossed from "AI pilot country" to "AI operating country" in the last 18 months. The clearest signal is in the 200-to-2,000-employee mid-market: CFOs and COOs in Madrid, Cataluña and Andalucía are buying process automation as an operating-model upgrade, not as a chatbot. The winning stack pairs RPA for deterministic steps with a generative-AI judgment layer on EU-region data residency. AESIA's 2026 sandbox is the practical entry path for higher-risk pilots in financial services, legal, and hospitality.
Regulation and compliance
EU Regulation 2024/1689 (the AI Act) is the primary framework. It sets risk tiers (unacceptable, high, limited, minimal) and obligations for providers and deployers, including transparency, logging, and conformity assessment for high-risk systems. Article 6 governs how a system gets classified as high-risk — by Annex III use case or by being a safety component under existing product legislation. Article 26 then attaches the deployer obligations: human oversight, input data quality, monitoring, and instruction-fidelity records. Prohibitions on unacceptable-risk systems have applied since February 2025; the General-Purpose AI (GPAI) Code of Practice obligations activated August 2025; full high-risk obligations come online August 2026. AESIA (Agencia Española de Supervisión de la Inteligencia Artificial), based in A Coruña, is the national authority and is opening sandbox enrollment cohorts for 2026 high-risk pilots under RD 817/2023. The AEPD updated its guidance on automated decision-making in 2025, sharpening the GDPR Article 22 + AI Act overlap that matters most for legal intake, scoring, and customer-facing agents. GDPR and LOPDGDD continue to apply on data protection, with Banco de España, CNMV, and CNMC handling sector overlays.
Last reviewed: 2026-06-10
Recommended reading
Frequently asked questions
When does the EU AI Act take full effect?
The Act entered into force August 1, 2024. Bans on unacceptable-risk systems apply from February 2025; GPAI obligations from August 2025; full high-risk obligations apply from August 2026 (with longer transitions for some embedded high-risk systems).
What does AESIA actually do?
AESIA is Spain's AI supervisory authority. It oversees compliance with the AI Act in Spain, manages the Spanish regulatory sandbox, and coordinates with sector regulators (Banco de España, CNMV, AEPD).
Are there Spanish-language AI agents that work as well as English ones?
Yes for top-tier models, but quality varies sharply across smaller models. We benchmark every Spanish deployment with a held-out evaluation set drawn from real customer interactions, never trusting model cards.
Operating in Spain?
Let's talk about deploying AI while staying compliant with local rules and measuring ROI from quarter one.