Spain makes progress on AI regulation: key points of the new Organic Law on governance

The Artificial Intelligence (AI) Regulation, in force since August 2024, is a pioneering piece of legislation at international level that promotes the classification of AI systems according to their potential risk to individuals, establishing specific obligations for their deployment or placing on the European market. In this context, on 26 May, the Council of Ministers initiated the parliamentary process in the Spanish Parliament for the Draft Organic Law on the Proper Use and Governance of AI, which implements the AI Regulation by adapting it to the national framework.

The legislative proposal places Spain at the forefront of algorithmic governance in an ethical, humanistic and trustworthy manner. The country has a significant track record, including the adoption of the Charter of Digital Rights, the launch of Europe’s first state-run AI supervisory agency, and the development of a regulatory sandbox that served as a benchmark for the European regulatory framework.

Governance framework

The governance architecture designed for the supervision of AI places the Spanish Artificial Intelligence Supervisory Agency (AESIA) at the heart of the system. Conceived as a public-law body with managerial autonomy, the AESIA will assume the functions of a market surveillance authority and act as a single point of contact with the institutions of the European Union. However, the legislation maintains a coordinated model of sectoral supervision for those markets already subject to specific legislation. Consequently, bodies such as the Bank of Spain, the National Securities Market Commission, the Directorate General of Insurance and Pension Funds, the General Council of the Judiciary and the Central Electoral Commission will retain their respective regulatory powers. Within this institutional framework, the Spanish Data Protection Agency is designated as the market supervisory authority for AI systems used in border management and, by virtue of its sector-specific expertise, also for biometric identification and categorisation systems.

Furthermore, AESIA assumes the chairmanship and management of the Joint Coordination Committee of Market Surveillance Authorities, a body designed to ensure the uniform application of supervisory criteria and to prevent interpretative discrepancies between the various sectoral administrations.

Sanctions regime

The draft organic law sets out the system of penalties and other enforcement measures, such as warnings or non-financial measures, applicable in the event of a breach of the legislation. In a similar way to the AI Regulation, and to ensure a graduated response to non-compliance, infringements are classified as very serious, serious and minor. The most serious infringements may incur penalties of up to € 35 million or 7 per cent of annual turnover.

To mitigate the impact of these sanctions on the business ecosystem, the text introduces the principle of proportionality and preferential corrective measures. In the case of small and medium-sized enterprises (SMEs) and start-ups, fines will be calculated by applying the lower of the amounts provided for by law. In addition, significant reductions are provided for in the event of early payment, and priority will be given to the adoption of immediate corrective measures by the offender.

As a feature unique to Spanish law, the draft organic law introduces a new section aimed at regulating the "proper use" of AI in the state public sector. This provision provides for the creation of a comprehensive inventory of all AI systems used in administrative procedures and the appointment of an AI Officer responsible for overseeing public procurement and coordinating the implementation of the legislation. Furthermore, sanctions for public administrations will be limited to warnings and internal disciplinary measures, excluding financial penalties.

Sandboxes and regulated innovation

Building on the success of the AI sandbox, through which Spain took the lead in implementing European requirements, the new law now consolidates the governance model for these testing environments and sets out a package of support measures at national level designed to help AI system providers comply with current regulations.

These controlled environments will enable start-ups and large companies to test their systems under real-world conditions before launching them onto the market, thereby reducing regulatory uncertainty and fostering investment in responsible AI within Spain.

Osborne Clarke comment

The draft organic law represents a key step in the implementation of the AI Regulation within the Spanish legal system, by establishing a governance and supervisory framework based on multiple notifying and market surveillance authorities, with a central coordinating role assigned to the AESIA as the single point of contact.

This institutional architecture, while ambitious, is also complex: the coexistence of various sectoral authorities with potentially overlapping powers will require effective coordination through the various mechanisms provided for in the draft organic law, including the market surveillance authorities' joint coordination committee, the operational details of which are yet to be finalised.

For businesses, the text confirms a demanding regulatory compliance landscape, as it sets out at national level the governance, supervision and penalty regime relating to non-compliance with the substantive obligations laid down in the AI Regulation, including those concerning transparency, the registration of high-risk systems and human oversight.

In this context, organisations already operating AI systems should anticipate a review of their solutions, their automated decision-making flows and their documentation and control mechanisms, in order to align them both with the requirements of the AI Regulation and with the supervisory and penalty framework resulting from the finally approved text of the draft organic law.