AI Act in Spain: Competent Authorities, National Implementation Law and Sandbox

Spain has no national AI Act implementation law as of 24 October 2026: bill 121/000096 lapsed on 6 October 2026, when Real Decreto 806/2026 dissolved the Cortes. Without that law, Spain has no market surveillance authority, notifying authority or single point of contact designated in law, and no national AI Act penalty rules. General elections follow on 29 November 2026, and the new Cortes convene on 23 December 2026.

The AI Act is Regulation (EU) 2024/1689 (OJ L, 2024/1689, 12.7.2024), in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 since 27 July 2026. As a regulation, the EU AI Act applies in Spain without any national act, so its Article 5 prohibitions and Article 50 transparency duties bind operators in Spain on the EU dates. National law only adds the Spanish layer: who supervises, who notifies conformity assessment bodies and which penalty rules apply. AESIA, the Spanish AI supervisory agency created by Real Decreto 729/2023, exists but holds no AI Act designation by law.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text, the BOE and the Congreso record; how we check every statement: methodology.

What Is the Status of the AI Act in Spain on 24 October 2026?

No AI Act designation and no national AI Act penalty rules are published in the BOE as of 24 October 2026; AESIA exists as an agency, the RD 817/2023 sandbox pilot has concluded and the AI Act applies directly. Seven functions make up the Spanish layer, each with its legal basis or official record:

The AI Act applies directly because a regulation is binding in every Member State without national law (Article 288 TFEU); national acts only implement or supplement it. Spain lacks that national layer: designated authorities under Article 70 and penalty rules under Article 99(1).

Which Authorities Supervise the AI Act in Spain?

No Spanish authority holds an AI Act designation by law as of 24 October 2026, because Spain has no national AI Act implementation law. Under Article 70, every Member State had to designate AI Act national competent authorities by 2 August 2025.

AESIA, the Spanish AI Supervisory Agency

AESIA (Agencia Española de Supervisión de Inteligencia Artificial, aesia.digital.gob.es) is a public-law entity created by Real Decreto 729/2023 and seated in A Coruña, with this statute, seat, legal nature and head:

• Statute: Real Decreto 729/2023, de 22 de agosto, published in BOE núm. 210 of 2 September 2023 (BOE-A-2023-18911) and in force since 3 September 2023.
• Seat: A Coruña, in the edificio La Terraza (Article 2 of the Statute).
• Legal nature: entidad de derecho público, attached through the Secretaría de Estado de Digitalización e Inteligencia Artificial (Article 1 of the Statute).
• Head: Director Alberto Gago Fernández, appointed by the Consejo Rector on 18 December 2025 with effect from 7 January 2026 (BOE-A-2026-389); BOE-A-2026-21891 of 21 October 2026 corrects the title to "Director".

The Commission lists AESIA as Spain's single point of contact with an asterisk, marking the "national designation decision still pending final adoption", on its page last updated on 7 September 2026. That listing is a Commission record, while the Spanish designation itself would have come from bill 121/000096, which lapsed.

AESIA publishes 16 numbered guides (01 to 16) and a "Checklists y ejemplos" set on its guides page. AESIA states that these guides were developed in the Spanish sandbox pilot.

Designations Spain Still Has to Make under Article 70

Article 70 required every Member State to designate at least one notifying authority and one market surveillance authority, and to make one of them the single point of contact, by 2 August 2025. Article 70(2) also required the contact details of these authorities to be public by the same date, and the Commission publishes the list of single points of contact. The powers of market surveillance under the AI Act, such as access to documentation and training data sets, sit in Article 74.

Spain has made none of these designations in law. A designation needs a Spanish legal act, and the bill that would have made it lapsed on 6 October 2026. The Commission page notes that an infringement procedure is possible when a Member State fails to designate.

Two further allocation rules apply from 2 August 2026: for high-risk AI systems of regulated financial institutions, the financial supervisor is the market surveillance authority (Article 74(6)), and for Annex III, point 1 in law enforcement, border management, justice and democracy and points 6, 7 and 8, Member States must designate the data protection authorities or another authority meeting Articles 41 to 44 of Directive (EU) 2016/680 (Article 74(8)). Spain has made no such designation in law. Article 77(2) separately required every Member State to identify its public authorities protecting fundamental rights by 2 November 2024.

Which AI Act Application Dates Apply in Spain without a National Law?

The AI Act applies in Spain on the same dates as in every Member State, because a regulation is directly applicable without national law. Every date of the EU AI Act timeline applies in Spain unchanged, since the Digital Omnibus on AI moved the high-risk dates for all 27 Member States at once. Eight dates of that timeline apply in Spain:

1. 1 August 2024: the AI Act enters into force (Article 113).
2. 2 February 2025: Chapters I and II apply, including the Article 5(1) prohibitions in points (a), (b) and (c) to (h) (Article 113, third paragraph, point (a)).
3. 2 August 2025: governance, notified bodies, general-purpose AI models and penalties apply (Article 113, third paragraph, point (b)).
4. 2 August 2026: general date of application, including Article 50 transparency (Article 113, second paragraph).
5. 2 December 2026: the new prohibitions of Article 5(1), points (ba) and (bb), and Article 5(1a) and (1b) apply (Article 113, third paragraph, point (a), as amended).
6. 2 December 2026: generative AI systems placed on the market before 2 August 2026 comply with Article 50(2) (Article 111(4)).
7. 2 December 2027: Chapter III, Sections 1 to 3, apply to Annex III high-risk AI systems (Article 113, third paragraph, point (c)(i)).
8. 2 August 2028: Chapter III, Sections 1 to 3, apply to Annex I high-risk AI systems (Article 113, third paragraph, point (c)(ii)).

General-purpose AI model providers face enforcement by the Commission, not by Spain, from 2 August 2026 (Article 101(1)). That Commission enforcement needs no Spanish law.

Penalties for AI Act Infringements in Spain

No national AI Act penalty rules are in force in Spain as of 24 October 2026; Article 99 sets the maximum fines that national penalty rules must provide for (Article 99(1)). The penalties chapter applies since 2 August 2025 (Article 113, third paragraph, point (b)), and its highest maximum, for prohibited practices, is EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher:

Article 99(1) leaves the penalty rules, including administrative fines, warnings and non-monetary measures, to each Member State, and those rules must be effective, proportionate and dissuasive. The EU AI Act penalties of Article 99 are the maxima those national rules must respect, with the Article 5 maximum at EUR 35 million, while the Commission fines providers of general-purpose AI models under Article 101 and the AI Office fines AI systems under its exclusive competence (Article 75c(4)).

The lapsed bill would have set four tiers in its Article 30(1): very serious infringements of Article 5 up to EUR 35 million or 7 %, other very serious infringements up to EUR 15 million or 3 %, serious infringements up to EUR 7.5 million or 1 %, and minor infringements up to EUR 500 000 or 0.5 %. Its Article 32 would have set limitation periods of one year for minor, three years for serious and five years for very serious infringements, but the bill never entered into force.

What Happened to the Spanish AI Bill 121/000096?

The Spanish AI bill did not pass: Proyecto de Ley Orgánica 121/000096 lapsed ("Concluido (Caducado)") on 6 October 2026 with the dissolution of the Cortes. Its full title was Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial.

Bill 121/000096 from the Council of Ministers to the Lapse

Bill 121/000096 existed for 133 days, from Council of Ministers approval on 26 May 2026 to its lapse on 6 October 2026, in six procedural steps:

The bill text as published is available as a PDF in the BOCG Serie A núm. 97-1 of 12 June 2026. A lapsed bill has no legal effect, so the text serves only as a record of what the government proposed.

Which Bodies the Lapsed Bill Would Have Assigned to Each Prohibited Practice and Annex III Point

The lapsed bill 121/000096 (BOCG Serie A núm. 97-1, 12 June 2026) would have shared AI Act market surveillance among AESIA, the data protection authorities, the CGPJ and three financial supervisors, but it never entered into force. For the prohibited AI practices under Article 5, the lapsed bill would have named three bodies, AESIA, the data protection authorities and the CGPJ, each with its own Article 5(1) points and Annex III points:

The lapsed bill would have made the Dirección General de Inteligencia Artificial (SEDIA), supported by ENAC, the notifying authority (Article 4 of the bill). AESIA would have been the single point of contact (Article 6 of the bill). AESIA would also have acted as the default authority for every case the bill assigned to no other body (Article 5(9) of the bill).

The lapsed bill would have had AESIA establish the mandatory Article 57(1) sandbox (Article 11(2) of the bill) and would have repealed Real Decreto 817/2023. The Annex III high-risk use cases themselves stay as the AI Act lists them, whichever Spanish body supervises them.

What Comes Next: Elections, the New Cortes and the Digital Omnibus Dates

General elections take place on 29 November 2026 and the new Cortes convene on 23 December 2026 (Real Decreto 806/2026). Any future Spanish implementation law supplements the AI Act as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026. That amended text fixes the dates such a law meets: a national sandbox by 2 August 2027, and Chapter III, Sections 1 to 3, from 2 December 2027 for Annex III high-risk AI systems and from 2 August 2028 for Annex I high-risk AI systems.

The Spanish Sandbox Pilot under RD 817/2023 and the 2 August 2027 Deadline

Spain ran an AI sandbox pilot under Real Decreto 817/2023, and the Ministry's sandbox page shows the pilot as concluded as of 24 October 2026. The decree opened the pilot to "proveedores" and "usuarios" resident or established in Spain, for high-risk AI systems, general-purpose AI systems and foundation models. The call for participants followed by Resolución SEDIA of 20 December 2024:

Spain must have at least one national AI regulatory sandbox operational by 2 August 2027 under Article 57(1) as amended by Regulation (EU) 2026/1744. Participants in such a sandbox face no administrative fines when they follow the sandbox plan and the authority's guidance in good faith, while liability for damage to third parties remains (Article 57(12)). The rules for AI regulatory sandboxes under Article 57 govern any future Spanish sandbox.

How Spain's Status Compares across the Member States

Spain is one of the Member States without an AI Act implementation law as of 24 October 2026, while the AI Act applies uniformly in all of them. Each Member State designates its own authorities under Article 70 and lays down its own penalty rules under Article 99(1), on its own timetable.

The overview of national competent authorities in all 27 Member States, each status dated, shows which states have designated authorities in law.

AI Act in Spain: Related Questions

Article 2(1), Article 50 and Article 74(8) settle the reach of the AI Act beyond Spain, the labelling of AI-generated content and the role of the AEPD.

Does the AI Act Apply to Companies outside Spain?

Yes: the AI Act applies on the same terms to companies in every Member State, and it reaches providers established outside the EU when they place AI systems on the Union market or when the output is used in the Union (Article 2(1), points (a) and (c)). The guide to the EU AI Act for non-EU companies sets out when an authorised representative is needed.

Which Article 50 Labelling Rules Apply to AI-Generated Content in Spain?

The labelling and marking duties of Article 50 of the AI Act apply in Spain since 2 August 2026, with no national AI Act implementation law needed. A deep fake under Article 3(60) is image, audio or video content only, and its disclosure falls on the deployer under Article 50(4).

The transparency obligations under Article 50 split into marking by providers (Article 50(2)) and labelling by deployers (Article 50(4)), with generative systems placed before 2 August 2026 given until 2 December 2026 for marking (Article 111(4)).

Is the AEPD an AI Act Authority in Spain?

Not by law: the Agencia Española de Protección de Datos (AEPD) holds no AI Act designation as of 24 October 2026. The lapsed bill would have given the AEPD and the regional data protection authorities Article 5(1), points (e) and (g), and Annex III, points 1(a), 1(b), 1(c) in migration and 7.

Article 74(8) requires Member States to designate the data protection authorities, or another authority meeting the conditions of Directive (EU) 2016/680, for certain Annex III, point 1 uses and points 6 to 8, one area where the AI Act vs GDPR rules overlap.