Quick answer

Spain is among the most advanced EU Member States on AI Act implementation in 2026. AESIA (Agencia Española de Supervisión de la Inteligencia Artificial), headquartered in A Coruña, became the competent national authority in 2024 and runs Europe's first operational AI regulatory sandbox. Businesses in Spain get earlier guidance than most Member States, but also face regulator engagement with shorter notice periods.

AESIA: who they are and what they do

AESIA was set up by Royal Decree in 2023 and took over AI Act supervision in Spain ahead of the August 2025 general application date. The agency is responsible for supervising AI system providers and deployers established in Spain, coordinating with other EU Member State authorities, running Spain's AI sandbox, and maintaining Spanish versions of AI Act guidance.

Practical implications: Spain-based companies need to register with AESIA as high-risk AI providers before placing systems on market (Article 49 registration in the EU-wide database, routed through AESIA). AESIA also runs awareness and training programmes for SMEs.

The Spanish AI sandbox

Spain launched the EU's first operational AI regulatory sandbox in late 2022, under Royal Decree 817/2023, and refined it through 2024-2025. By 2026 the sandbox is in its third cohort and has processed 20+ AI systems end-to-end.

Who it's for: providers developing high-risk AI systems who want to test conformity before full market placement. Benefits: supervised testing with regulator guidance, reduced procedural risk, preferred reference treatment for notified bodies, and public credibility.

Who it's not for: deployers of third-party AI (those are supervised normally); minimal-risk systems (sandbox not relevant); large providers with established compliance — they can self-assess.

National penalty regime

The AI Act sets EU-wide maximum fines (Article 99), but Member States define the national penalty regime and procedures. Spain's law transposing enforcement (Ley de supervisión de la IA, consolidated 2024-2025) specifies:

Up to €35m or 7% of global turnover for prohibited AI (highest tier).
Up to €15m or 3% for high-risk provider obligations.
Up to €7.5m or 1% for information/transparency obligations.
SME adjustment (Article 99(6)): lower of the two thresholds.
Daily accruing fines for ongoing non-compliance.

Spanish-language obligations

Information provided to users of AI systems in Spain must be in Spanish (or co-official regional language where applicable — Catalan, Galician, Basque, Valencian). This covers: instructions for use, transparency notices, incident reporting, and customer complaint channels. GPAI model documentation can remain in English for technical users but consumer-facing explanations must be in Spanish.

What Spain-based businesses need to do differently

Engage AESIA early — Spain's regulator is more interactive than most EU Member States. Pre-submission meetings for high-risk providers are common and helpful.
Consider the sandbox — if you are placing a high-risk system on market, the sandbox is a competitive advantage.
Translate user-facing material into Spanish (and co-official languages where applicable).
Maintain an AESIA point of contact — register with the agency's communication channels; they notify of guidance updates faster than the Commission does.
Monitor Spanish enforcement cases — Spain will likely be among the earliest jurisdictions with publicly-reported enforcement actions. Useful precedent.

EU AI Act Implementation in Spain (2026)