EU AI Act enforcement in Spain: AESIA first-mover advantage

AESIA and the Spanish supervisory structure

AESIA is the lead AI Act authority in Spain, established by Royal Decree 729/2023 and operational since 2024. AEPD (Agencia Española de Protección de Datos) handles AI Act elements overlapping with GDPR. CNMC (Comisión Nacional de los Mercados y la Competencia) handles AI in regulated markets. Bank of Spain handles fintech AI. AESIA coordinates and is the single point of contact for the European AI Office.

Spanish enforcement approach

AESIA published its 2026 supervisory plan in early 2026. Priority areas: AI in employment and HR (matching EU-wide patterns), AI in essential services (credit scoring, insurance), and AI in public administration. AESIA has a regulatory sandbox programme that allows SaaS to test compliance approaches with supervisor input before going to market - a unique European feature. AEPD's GDPR enforcement history (frequent six and seven-figure fines) signals the cultural baseline for AI Act enforcement.

Spain's AI Act sandbox

Spain's regulatory sandbox is the EU's most developed AI Act test environment. Selected participants (typically Spanish SaaS startups and EU companies with Spanish operations) get six to twelve months of structured engagement with AESIA to refine compliance approaches. Output is sandbox-tested compliance documentation that satisfies AESIA's standards. The 2026 cohort selection closed in March 2026; 2027 cohort applications open in October 2026.

Spanish national AI strategy

Spain's ENIA (Estrategia Nacional de Inteligencia Artificial) emphasizes both innovation support and rights protection. The 2024-2026 update includes specific commitments on AI Act enforcement readiness, public-sector AI procurement standards, and SME compliance support. Spain has aligned closely with European Commission positions on Article 50 and Article 5 enforcement.

Spanish public procurement

Plataforma de Contratación del Sector Público is the Spanish public tender platform. Since January 2026, AI-touching tenders require an AESIA-compatible compliance attestation. The attestation format follows AESIA's template (published October 2025). Autonomous community procurement (regional governments) follows similar patterns. For SaaS selling into Spanish government, ministries, regional councils, or public universities, AESIA-format attestation is now non-negotiable.

Frequently asked questions

What is AESIA?

Agencia Española de Supervisión de la Inteligencia Artificial - Spain's dedicated AI supervisory agency, established in 2023 and operational since 2024. First of its kind in the EU.

How does the Spanish AI sandbox work?

Selected SaaS get six to twelve months of structured engagement with AESIA to refine compliance approaches. Output is sandbox-tested compliance documentation. Cohorts of 30-50 companies, application-based.

Is Spanish AEPD enforcement aggressive?

Yes - AEPD has issued among the highest per-violation GDPR fines in the EU. AI Act enforcement is expected to follow the same pattern, with AESIA leading and AEPD handling overlap.

What does AESIA-format attestation require?

A standardized declaration covering Article 5 screening, Annex III classification, Article 50 implementation, Article 10 governance, Article 13 instructions, Article 14 oversight, and Article 73 incident workflow. AESIA published the template in October 2025.

Does Spain have sectoral AI rules?

Yes - stricter rules for AI in healthcare (Spanish Medicines Agency overlay), AI in fintech (Bank of Spain overlay), and AI in essential services. Catalonia and Madrid have published regional AI guidance for public sector procurement.

Sources

• https://www.aesia.gob.es/
• https://www.aepd.es/
• https://contrataciondelestado.es/