Spain is governed by the directly applicable EU AI Act and has built a specialized national supervisory architecture around AESIA. Royal Decree 729/2023 establishes AESIA, and Royal Decree 817/2023 created an AI regulatory sandbox. A May 2026 Organic AI Governance Bill would organize national supervision and sanctions but remains proposed legislation. Data protection and equality law apply in parallel.
The EU AI Act applies directly in Spain and introduces risk-based obligations, prohibited practices, high-risk system duties, transparency rules and general-purpose AI requirements on a phased schedule.
The decree establishes Spain's specialized AI supervisory agency and its institutional mandate.
The decree creates a controlled testing environment for high-risk AI systems and supports preparation for EU AI Act compliance.
The bill would organize national supervisory responsibilities and sanctions around the EU AI Act. It is before Parliament and is not yet law.
Yes. The EU AI Act applies directly in Spain on its phased timetable. Spain also has binding institutional and sandbox decrees.
AESIA is the specialized national AI supervisory agency, working alongside the Spanish Data Protection Agency and sector authorities.
No. The government approved it for parliamentary consideration in May 2026, but it remains proposed legislation.
Organizations should track the EU AI Act's phased obligations, AESIA guidance and the parliamentary progress of the national governance bill.
Get an answer grounded in this baseline and the wider Nomos catalogue.