Spain’s organic AI law: the bill, AESIA and what may change for your company
Spain’s Congress is processing an organic bill on the good use and governance of AI. It is still a bill, not law in force: it specifies how the AI Act would be applied in Spain, which authority would supervise and which fines could be imposed. This article summarises what is known as of June 2026 and what you can do now.
What it is and what it is not
The AI Act is an EU Regulation: it applies directly in every Member State. What each country must decide is who supervises it and how it is sanctioned. Spain’s organic bill addresses exactly that. Published in the Official Gazette of the Cortes on 12 June 2026, its amendment period ended on 30 June. Until it is published in the BOE, it is not law in force.
What the bill foresees
- AESIA as authority: market-surveillance authority and single point of contact.
- Regulated sandboxes to test AI systems in a controlled environment.
- Penalty regime with the same tiers as the AI Act: up to €35M or 7% for prohibited practices; €15M/3%, €7.5M/1% and €500,000/0.5% below that.
What may change for your company
Probably who you deal with (a single contact), how inspections are handled and how fines are graduated in Spain. What the AI Act requires of you does not change: classify your systems, document them, supervise the people using them and, where relevant, tell users when they interact with an AI.
What to do now, even if it is not passed
- Make an inventory of the AI systems you use or build, including tools staff use on their own.
- Classify the risk of each (prohibited, high, transparency, minimal).
- Assign an owner and write down who decides and who answers.
- Check the calendar: under the Digital Omnibus (Regulation 2026/1744), high-risk obligations for Annex III systems move to 2 December 2027; Article 50 transparency duties have applied since 2 August 2026.
- Follow the bill: check Congress and the BOE; this article reflects the status as of June 2026.
Frequently asked questions
Is the organic AI law in force in Spain?
No. It is a bill in process. We could not confirm its status after June 2026.
What would AESIA’s role be?
Market-surveillance authority and single point of contact.
Should I wait for it to pass before preparing?
No: the AI Act already applies directly. An inventory and a risk classification help in any scenario.
Informational content, not legal advice. Consult a professional for your case.
What's your Data Governance maturity?
Free assessment with your priority gaps, plus the self-assessment quiz and savings calculator on the Data Governance path.