{"id":12516,"date":"2026-08-24T09:30:00","date_gmt":"2026-08-24T08:30:00","guid":{"rendered":"https:\/\/lawwwing.com\/?p=12516"},"modified":"2026-07-23T13:14:58","modified_gmt":"2026-07-23T12:14:58","slug":"spain-ai-governance-draft","status":"publish","type":"post","link":"https:\/\/lawwwing.com\/en\/spain-ai-governance-draft\/","title":{"rendered":"What Is the Draft Organic Law on the Responsible Use and Governance of Artificial Intelligence?"},"content":{"rendered":"\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>On 12 June 2026, the Draft Organic Law on the Responsible Use and Governance of Artificial Intelligence was published.<\/p>\n\n\n\n<p>The AI Act is directly applicable in all European Union Member States and, unlike a directive, does not require transposition into national law. However, while the Regulation establishes a harmonised legal framework, it does not designate specific national authorities or lay down the detailed rules governing enforcement procedures and sanctions within each Member State. For that reason, national legislation is needed to develop these aspects.<\/p>\n\n\n\n<p>As explained in the explanatory memorandum accompanying the draft, the purpose of the law is to establish the governance framework and the national enforcement regime applicable to AI systems in Spain. It also regulates the governance of AI regulatory sandboxes and introduces measures to promote the responsible use of artificial intelligence within the public sector.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Spanish context<\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>The draft law forms part of a broader strategy that Spain has been developing over the past several years. This includes the 2021 Charter of Digital Rights, the successive Spain Digital plans, the National Artificial Intelligence Strategy (ENIA) and its 2024 update, as well as the creation of the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) under Real Decreto 729\/2023.<\/p>\n\n\n\n<p>Accordingly, the purpose of this draft legislation is to consolidate the legal and institutional framework that Spain has progressively built around artificial intelligence.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">What Does the Draft Law Regulate?<\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>The future law is intended to apply to AI system providers, deployers, manufacturers, authorised representatives, importers, and distributors. In other words, the entire value chain involved in bringing an AI system to market and into use.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Who Will Oversee AI in Spain?<\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>The draft law distinguishes between two types of authorities:<\/p>\n\n\n\n<ol style=\"list-style-type:lower-alpha\" class=\"wp-block-list\">\n<li>The <strong>notifying authority<\/strong>, responsible for assessing and supervising the bodies that certify the conformity of high-risk AI systems. This role is assigned to the Directorate-General for Artificial Intelligence, within the Secretary of State for Digitalisation and Artificial Intelligence.<\/li>\n\n\n\n<li>The <strong>market surveillance authorities<\/strong>, which are responsible for carrying out inspections, requiring corrective measures, and, where appropriate, imposing sanctions. Depending on the sector involved, different authorities will have jurisdiction:\n<ul class=\"wp-block-list\">\n<li><strong>AESIA <\/strong>(Spanish Agency for the Supervision of Artificial Intelligence) acts as the default market surveillance authority for most high-risk AI systems and prohibited AI practices.<\/li>\n\n\n\n<li>The <strong>Spanish Data Protection Agency<\/strong> (AEPD) and the regional data protection authorities are responsible for supervising biometric AI systems and AI systems used in migration and border management.<\/li>\n\n\n\n<li>The <strong>General Council of the Judiciary<\/strong> (CGPJ) oversees AI systems used within the administration of justice.<\/li>\n\n\n\n<li>The <strong>Bank of Spain, the Spanish National Securities Market Commission <\/strong>(CNMV), and the Directorate-General for Insurance and Pension Funds each supervise AI systems used within their respective sectors, including systems for assessing creditworthiness, credit risk, and life and health insurance.<br><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p>In addition, AESIA will serve as Spain's <strong>single point of contact<\/strong> with the European Commission, the European AI Office, and the authorities of other Member States. It will also operate as a one-stop shop, allowing individuals and businesses to submit complaints where they believe an AI system does not comply with the AI Act.<\/p>\n\n\n\n<p>The draft law also includes provisions to <strong>protect whistleblowers<\/strong>, in line with Law 2\/2023, guaranteeing confidentiality and protection against retaliation for anyone who reports a suspected breach of the legislation.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">AI Regulatory Sandboxes<\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>The draft law also seeks to regulate AI regulatory sandboxes\u2014controlled testing environments where companies and institutions can develop and test AI systems before placing them on the market, under the legal and technical supervision of the competent authorities.<\/p>\n\n\n\n<p>Under the proposed legislation, AESIA is required to establish the national reference sandbox, although other competent authorities may also create additional testing environments. The objective of these sandboxes is to encourage innovation without compromising regulatory oversight, particularly in high-risk or sensitive sectors.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">The Consequences of Non-Compliance: Infringements and Penalties<\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>The draft law classifies infringements into three categories, following the framework established by the AI Act:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Very serious infringements<\/strong>: These include engaging in prohibited AI practices\u2014such as social scoring systems or subliminal manipulation\u2014as well as failing to report serious incidents involving AI systems.<\/li>\n\n\n\n<li><strong>Serious infringements<\/strong>: These cover failures to comply with the technical, safety, or registration requirements applicable to high-risk AI systems, as well as providing false or misleading information to the competent authorities.<\/li>\n\n\n\n<li><strong>Minor infringements<\/strong>: These involve formal or easily remediable breaches, such as submitting incomplete information in response to an official request.<\/li>\n<\/ul>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Type of infringement<\/strong><\/td><td><strong>Maximum fine<\/strong><\/td><\/tr><tr><td>Very serious (prohibited practices)<\/td><td>\u20ac35,000,000 or 7% of global revenue<\/td><\/tr><tr><td>Very serious (other cases)<\/td><td>15,000,000 \u20ac or 3% of global revenue<\/td><\/tr><tr><td>Serious<\/td><td>\u20ac7,500,000 or 1% of global revenue<\/td><\/tr><tr><td>Mild<\/td><td>500,000 \u20ac or 0.5% of global revenue<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>In line with the AI Act, the applicable penalty will be the higher of the fixed monetary amount or the percentage of the company's global annual turnover. However, as a proportionality measure, small and medium-sized enterprises (SMEs) and start-ups will be subject to the lower of the two amounts.<\/p>\n\n\n\n<p>Beyond financial penalties, the draft law also provides for additional enforcement measures, including the withdrawal of products from the market, the deactivation of AI systems, and prohibitions on their use where a system poses an unacceptable risk. It also introduces periodic penalty payments to compel compliance with final administrative decisions.<\/p>\n\n\n\n<p>It is important to remember that this is still a draft law and must complete the legislative process before it can be enacted and published in BOE. Furthermore, because certain provisions are classified as matters requiring an Organic Law, their approval will require an absolute majority in the Spanish Congress of Deputies.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>This draft law does not create a new catalogue of rights and obligations relating to artificial intelligence. Instead, it provides the essential framework needed to make the AI Act fully operational in Spain. It defines which authorities are responsible for supervision, which bodies have enforcement powers, how the various sector-specific authorities will coordinate their activities, and what the consequences of non-compliance will be.<\/p>\n\n\n\n<p>For businesses that develop or deploy AI systems\u2014and for public authorities themselves\u2014this is essential reading. It establishes the institutional framework with which they will need to engage once the legislation enters into force.<\/p>\n\n\n\n<div style=\"height:50px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Why Should This Matter to My E-commerce Business?<\/h2>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>All of this has a direct impact on every e-commerce website. Today, many online stores already use AI-powered chatbots, virtual shopping assistants, product recommendation engines, and AI tools for generating product images. As a result, these AI systems are not only subject to the AI Act, but will also fall within the scope of Spain's future Organic Law on AI Governance once it is enacted.<\/p>\n\n\n\n<p>The legal framework governing e-commerce websites is becoming increasingly comprehensive. Businesses must now comply with the GDPR, the e-Commerce Directive (and its national implementing legislation), cookie regulations, the European Accessibility Act, the AI Act, and the forthcoming Spanish AI legislation.<\/p>\n\n\n\n<p>That's why, at Lawwwing, we make compliance simple. We automatically generate and keep your legal documents and AI Policy up to date, ensuring they remain aligned with the latest legal and regulatory requirements.<\/p>\n\n\n\n<p>Don't wait any longer and stay compliant with <strong>Lawwwing<\/strong>.<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-1 wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-background wp-element-button\" href=\"https:\/\/lawwwing.com\/en\/blog\/\" style=\"background:linear-gradient(135deg,rgb(132,206,249) 0%,rgb(219,180,255) 100%)\">DIGITAL LAW AND DATA PROTECTION BLOG<\/a><\/div>\n<\/div>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>On 12 June 2026, the Draft Organic Law on the Responsible Use and Governance of Artificial Intelligence was published. The AI Act is directly applicable in all European Union Member States and, unlike a directive, does not require transposition into national law. However, while the Regulation establishes a harmonised legal framework, it does not designate [&hellip;]<\/p>\n","protected":false},"author":22,"featured_media":12517,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"categories":[452,453,579],"tags":[451,654,845],"class_list":["post-12516","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-2","category-artificial-intelligence","category-spain-2","tag-ai","tag-artificial-intelligence","tag-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/posts\/12516","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/comments?post=12516"}],"version-history":[{"count":1,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/posts\/12516\/revisions"}],"predecessor-version":[{"id":12520,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/posts\/12516\/revisions\/12520"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/media\/12517"}],"wp:attachment":[{"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/media?parent=12516"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/categories?post=12516"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/tags?post=12516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}