The AESIA's 16 AI Act guides, explained and put in order
AESIA, the Spanish agency that supervises AI, has published 16 guides to help companies comply with the AI Act. They are useful, but there are many. Here is what each one is, the order to read them in and which of your company's documents they touch.
What these guides are (and are not)
They are support material from Spain's Ministry for Digital Transformation and Public Service, which AESIA publishes on its website. They were built with the Spanish regulatory sandbox, with real companies taking part. The first version dates from December 2025 and they were updated in June–July 2026 for the Digital Omnibus. They are not binding: the documents themselves say they neither replace nor develop the law. Use them as a reference for how the Spanish authority thinks, not as a list of new obligations.
Besides the guides there are 12 Excel checklists, one per requirement, to self-assess and build your adaptation plan. Guide 16 explains how to use them. The guides carry a Creative Commons Attribution 4.0 license, so they can be cited and reused with credit to the Ministry. We do not copy them here: we order them and connect them to the text of the Regulation. The checklists carry a confidentiality notice on the cover, so we do not redistribute them either: download them from AESIA's website.
How they are organized
- To start (01 and 02): what the Regulation says and practical cases. Read these first if the AI Act is new to you.
- Company processes (03 and 04): how conformity is shown and how quality is organized.
- System requirements (05 to 14): risk, human oversight, data, transparency, accuracy, robustness, cybersecurity, logs, post-market monitoring and incidents.
- Documentation and self-assessment (15 and 16): technical documentation and the manual for using the 12 checklists.
Correspondence matrix: guide, article and document
This table links each guide to the article of the Regulation it develops and, where one exists, to one of our templates covering that work. We checked the articles against the text of each guide; the templates are ours and are not part of the official guides.
| Guide | Topic | AI Act article | AESIA checklist | Related template |
|---|---|---|---|---|
| 01 | Introduction to the AI Act | Overview | — | — |
| 02 | Practical guide and examples | Overview (use cases) | — | — |
| 03 | Conformity assessment | Art. 43 | — | — |
| 04 | Quality management system | Art. 17 | Yes | Acceptable AI Use Policy |
| 05 | Risk management | Art. 9 | Yes | Risk Classification Checklist |
| 06 | Human oversight | Art. 14 | Yes | Human Oversight Procedure |
| 07 | Data and data governance | Art. 10 | Yes | Art. 10 Compliance Pack |
| 08 | Transparency | Art. 13 | Yes | Model Card Template |
| 09 | Accuracy | Art. 15 | Yes | Drift Detection & Monitoring |
| 10 | Robustness | Art. 15 | Yes | Fairness Testing & Red-Teaming |
| 11 | Cybersecurity | Art. 15 | Yes | Encryption & Key Management Policy |
| 12 | Record-keeping (logs) | Art. 12 | Yes | AI Systems Registry |
| 13 | Post-market monitoring | Art. 72 | Yes | Post-Market Monitoring Plan |
| 14 | Incident management | Art. 73 | Yes | — |
| 15 | Technical documentation | Art. 11 and Annex IV | Yes | Technical Documentation (Annex IV) |
| 16 | Manual for the requirements-guides checklists | Using the 12 checklists | — | — |
Which order to read them in
If you use third-party AI (you are a "deployer"): start with 01, 02, 06 and 12. They are closest to what you must do: oversee, keep logs and inform.
If you build or sell a high-risk AI system (you are a "provider"): read all of them, in this order: 01, 05, 07, 15, 04, 03, then the rest. Use 16 to run the checklists.
If you do not know what you are yet: build the inventory of your systems first. Without it no guide helps. See how to do it and the free diagnostic.
Which deadline applies
The guides describe requirements for high-risk systems. After the Digital Omnibus, those Annex III obligations were postponed to December 2027, so there is time. Documentation and logs still take months. Details in the updated timeline.
What to do this week
- Inventory your AI systems and classify them by risk.
- Download from AESIA only the guides that fit your case.
- Run the checklist for each guide (04 to 15) to see what is missing.
- Prioritize the gaps: documentation, human oversight and logs usually come first.
If you prefer to start from ready-made documents: AI Act Starter Kit. Templates support the guides; they do not replace them or guarantee compliance.