On 12 June 2026, the Draft Organic Law on the Responsible Use and Governance of Artificial Intelligence was published.
The AI Act is directly applicable in all European Union Member States and, unlike a directive, does not require transposition into national law. However, while the Regulation establishes a harmonised legal framework, it does not designate specific national authorities or lay down the detailed rules governing enforcement procedures and sanctions within each Member State. For that reason, national legislation is needed to develop these aspects.
As explained in the explanatory memorandum accompanying the draft, the purpose of the law is to establish the governance framework and the national enforcement regime applicable to AI systems in Spain. It also regulates the governance of AI regulatory sandboxes and introduces measures to promote the responsible use of artificial intelligence within the public sector.
The draft law forms part of a broader strategy that Spain has been developing over the past several years. This includes the 2021 Charter of Digital Rights, the successive Spain Digital plans, the National Artificial Intelligence Strategy (ENIA) and its 2024 update, as well as the creation of the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) under Real Decreto 729/2023.
Accordingly, the purpose of this draft legislation is to consolidate the legal and institutional framework that Spain has progressively built around artificial intelligence.
The future law is intended to apply to AI system providers, deployers, manufacturers, authorised representatives, importers, and distributors. In other words, the entire value chain involved in bringing an AI system to market and into use.
The draft law distinguishes between two types of authorities:
In addition, AESIA will serve as Spain's single point of contact with the European Commission, the European AI Office, and the authorities of other Member States. It will also operate as a one-stop shop, allowing individuals and businesses to submit complaints where they believe an AI system does not comply with the AI Act.
The draft law also includes provisions to protect whistleblowers, in line with Law 2/2023, guaranteeing confidentiality and protection against retaliation for anyone who reports a suspected breach of the legislation.
The draft law also seeks to regulate AI regulatory sandboxes—controlled testing environments where companies and institutions can develop and test AI systems before placing them on the market, under the legal and technical supervision of the competent authorities.
Under the proposed legislation, AESIA is required to establish the national reference sandbox, although other competent authorities may also create additional testing environments. The objective of these sandboxes is to encourage innovation without compromising regulatory oversight, particularly in high-risk or sensitive sectors.
The draft law classifies infringements into three categories, following the framework established by the AI Act:
| Type of infringement | Maximum fine |
| Very serious (prohibited practices) | €35,000,000 or 7% of global revenue |
| Very serious (other cases) | 15,000,000 € or 3% of global revenue |
| Serious | €7,500,000 or 1% of global revenue |
| Mild | 500,000 € or 0.5% of global revenue |
In line with the AI Act, the applicable penalty will be the higher of the fixed monetary amount or the percentage of the company's global annual turnover. However, as a proportionality measure, small and medium-sized enterprises (SMEs) and start-ups will be subject to the lower of the two amounts.
Beyond financial penalties, the draft law also provides for additional enforcement measures, including the withdrawal of products from the market, the deactivation of AI systems, and prohibitions on their use where a system poses an unacceptable risk. It also introduces periodic penalty payments to compel compliance with final administrative decisions.
It is important to remember that this is still a draft law and must complete the legislative process before it can be enacted and published in BOE. Furthermore, because certain provisions are classified as matters requiring an Organic Law, their approval will require an absolute majority in the Spanish Congress of Deputies.
This draft law does not create a new catalogue of rights and obligations relating to artificial intelligence. Instead, it provides the essential framework needed to make the AI Act fully operational in Spain. It defines which authorities are responsible for supervision, which bodies have enforcement powers, how the various sector-specific authorities will coordinate their activities, and what the consequences of non-compliance will be.
For businesses that develop or deploy AI systems—and for public authorities themselves—this is essential reading. It establishes the institutional framework with which they will need to engage once the legislation enters into force.
All of this has a direct impact on every e-commerce website. Today, many online stores already use AI-powered chatbots, virtual shopping assistants, product recommendation engines, and AI tools for generating product images. As a result, these AI systems are not only subject to the AI Act, but will also fall within the scope of Spain's future Organic Law on AI Governance once it is enacted.
The legal framework governing e-commerce websites is becoming increasingly comprehensive. Businesses must now comply with the GDPR, the e-Commerce Directive (and its national implementing legislation), cookie regulations, the European Accessibility Act, the AI Act, and the forthcoming Spanish AI legislation.
That's why, at Lawwwing, we make compliance simple. We automatically generate and keep your legal documents and AI Policy up to date, ensuring they remain aligned with the latest legal and regulatory requirements.
Don't wait any longer and stay compliant with Lawwwing.
