Current position
Overview
AI legislation has been enacted.
Key legislation & sources
EU AI Act (Regulation 2024/1689)
AESIA (Spanish Agency for the Supervision of AI)
EU AI Act National Implementation Tracker
Royal Decree 729/2023 — AESIA Statute
Council of Europe Framework Convention on AI (CETS 225)
EU AI ACT
The EU AI Act (Regulation 2024/1689) applies directly across all member states. Prohibitions on unacceptable-risk AI systems have been in force since 2 February 2025; GPAI model rules since 2 August 2025. High-risk AI obligations are due from 2 August 2026, subject to the Digital Omnibus proposal which may defer enforcement. For the full implementation timeline, governance structure, and current status, see the European Union overview.
Spain was the first EU member state to establish a dedicated AI supervisory body: the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), operational since 2024. AESIA is positioned as Spain's primary market surveillance authority under the Act.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
ruling
Data Protection Agency issued a preventive warning to a company over data protection safeguards in a planned AI-based CV screening tool (EXP202600427)
Source: Digital Policy Alert · View update ↗
adoption
Data Protection Agency published guide on protecting privacy while using AI tools
Source: Digital Policy Alert · View update ↗
On 27 January 2026, the Spanish Data Protection Agency (AEPD) released a guide on protecting privacy while using AI tools. The guide provides ten recommendations, including advising users not to upload personal data and, in particular, to avoid sensitive data such as health, financial, contractual, geolocation and travel or accommodation data. Further, the guide advises users to review AI service terms and select safer versions, noting data flows including cookies, IP addresses, tracking and usage data, metadata, device data, contacts and location. Users should respect the privacy of third parties, especially minors, and not use images of other people to generate content, while avoiding inputting confidential professional information. Users are advised to seek specialised professional, emotional or psychological support from professionals rather than AI, should they require advice with personal situations.
adoption
Data Protection Agency published information note analysing risks arising from using third-party images in artificial intelligence systems
Source: Digital Policy Alert · View update ↗
On 13 January 2026, the Spanish Data Protection Agency (AEPD) published an information note analysing the data protection implications of using third parties’ images in Artificial Intelligence (AI) systems. The note applies to AI providers, platforms, and users that upload, generate, modify, or disseminate images or videos of identifiable persons. It highlights visible risks, including sexualisation and synthetic intimate content, attribution of false events with reputational effects, decontextualisation, wide dissemination, and heightened impact on minors and vulnerable persons. It also identifies less visible risks arising merely from uploading images, including effective loss of control due to third-party processing, hidden retention and copies, involvement of multiple actors, additional provider purposes, metadata and internal inferences, persistent identification across generated content, information asymmetry limiting the exercise of rights, and exposure through errors or security incidents. The note clarifies that some uses may fall outside the General Data Protection Regulation in strictly personal or household contexts, that images of deceased persons are generally excluded, and that other legal regimes, including image rights and criminal law, may apply. The note signals particular supervisory attention where risks are amplified, including loss of control over one’s image, generation of plausible but false content, sexualisation, humiliation or discredit, involvement of minors or vulnerable individuals, and dissemination with significant personal, social, or professional impact.
investigation
Data Protection Authority fined World 2 Meet EUR 70’000 for unnecessary collection of personal data
Source: Digital Policy Alert · View update ↗
On 22 August 2025, the Spanish Data Protection Authority (AEPD) fined World 2 Meet EUR 70’000 for the unnecessary collection of personal data. The amount was reduced by 20 per cent to EUR 56’000 for acknowledgement of liability, and by a further 20 per cent to EUR 42’000 for voluntary payment. World 2 Meet, the travel division of the Iberostar Group, required a complainant to submit a copy of his identity document to complete traveller registration. The complainant argued this was unnecessary, as he had already provided the required data for himself and his travel party. The company maintained that copies of the full documents were needed to communicate with the Civil Guard. The AEPD noted that World 2 Meet was notified of the claim on 5 December 2024. On 5 August 2024, the company responded that the information was required to verify customer identities in line with Article 4.3 of Royal Decree 933/2021. However, the AEPD found that compliance with Article 4.3 could be achieved by having customers complete a form limited to the data required under sections A.3 and B.3 of Annexe I of the Royal Decree. Verification of authenticity, the AEPD explained, could be carried out either in person by visually checking the information against the identity document or virtually using mechanisms such as digital certificates.
investigation
National Commission for Markets and Competition expanded investigation into Apple regarding possible anti-competitive practices in its App Store
Source: Digital Policy Alert · View update ↗
On 29 July 2025, the National Commission for Markets and Competition (CNMC) expanded its investigation into Apple for potential anti-competitive practices in its App Store. The CNMC is now investigating whether Apple may have established a pricing schedule that developers are required to follow in order to distribute their apps in its stores. The action would constitute a restrictive practice of competition among businesses, thereby expanding the scope of the case to include Article 1 of the Spanish Competition Act (LDC) and Article 101 of the Treaty on the Functioning of the European Union (TFEU). The investigation focuses on allegations that Apple may be imposing unfair trading conditions on developers distributing applications via the App Store. Such practices would violate Article 2 of Law 15/2007 on the Defense of Competition (LDC) and Article 102 of the Treaty on the Functioning of the European Union (TFEU).
Showing 5 of 11 available API entries. Dates and summaries are supplied by Digital Policy Alert.