AI Governance in Spain: A Comprehensive Overview
Spain is making significant strides in the realm of artificial intelligence (AI) governance by establishing Europe’s first AI regulator, the Spanish Agency for the Supervision of Artificial Intelligence (AESIA). The country has also implemented a regulatory sandbox and is in the process of drafting a national AI law that aligns with the EU AI Act.
Legal Framework for AI Regulation
Spain is committed to building a comprehensive regulatory framework for AI. The upcoming legislation titled ‘Good Use and Governance of Artificial Intelligence’ aims to implement and supplement the EU AI Act while establishing a domestic sanctioning regime. The first draft of this law was approved by the Council of Ministers on March 11, 2025.
In addition to the draft law, Spain has adopted several soft law instruments, including the Charter of Digital Rights and the updated National Artificial Intelligence Strategy 2024, which embed ethical and human-centric principles to guide regulatory efforts.
Regulatory Sandbox
As part of its digital transformation strategy, Spain enacted Royal Decree 817/2023, establishing the first European regulatory sandbox for AI. This controlled environment allows participants to test high-risk AI systems in compliance with the EU AI Act. In April 2025, twelve AI projects were selected to participate, and the results will inform future national AI regulations.
Role of AESIA
Operational since June 2024, AESIA will oversee the implementation of AI regulations in Spain. Once the EU AI Act and the national AI law are fully enforced, AESIA will serve as the market-surveillance authority for AI, possessing inspection and sanctioning powers.
Furthermore, the Artificial Intelligence Advisory Council complements AESIA by providing independent advice and recommendations to the Ministry of Digital Transformation, promoting public policy discourse.
International Compliance and Standards
Spain subscribes to international soft law instruments, including the OECD Principles on Artificial Intelligence, which guide national policy without imposing binding obligations. Furthermore, Spain’s National AI Strategy emphasizes participation in international forums to align with EU initiatives.
Risk-Based Approach to AI Regulation
The forthcoming Draft Spanish AI Law adopts a risk-based model, categorizing AI systems into four tiers of risk: unacceptable risk (prohibited), high risk (subject to detailed compliance), limited risk (mainly transparency duties), and low or minimal risk (not subject to new obligations).
This model aims to identify, assess, and mitigate risks associated with health, safety, and fundamental rights. The goal is to foster an innovative yet reliable AI ecosystem that adheres to EU standards.
Sectoral and Territorial Scope
The Draft Spanish AI Law will apply throughout Spain to any AI system placed on the market, utilized in Spain, or producing effects within the country, regardless of the provider’s location. The law is designed to be cross-sectoral, affecting all economic sectors and public bodies, with specific exclusions for defense, personal use, and closed R&D activities.
Enforcement and Compliance
AESIA will have full sanctioning powers once the new laws are enacted. Compliance duties will be scaled according to the AI system’s risk level, incorporating requirements from the EU AI Act without restating them in the national legislation.
Regional Initiatives
In addition to national regulations, Spain’s autonomous communities are developing their own AI strategies to address regional socioeconomic needs. Notably, Galicia has enacted Law 2/2025 on the Development and Promotion of Artificial Intelligence, marking a pioneering move in regional AI legislation.
These regional frameworks aim to promote a trustworthy and ethically grounded approach to AI while ensuring algorithmic transparency and accountability.
Conclusion
Spain’s proactive approach to AI governance positions it as a leader in Europe’s regulatory landscape. By establishing a comprehensive legal framework, creating a regulatory sandbox, and empowering AESIA, Spain aims to unlock the economic and social benefits of AI while safeguarding fundamental rights and promoting responsible innovation.
