--- authoritative: false representation: annotated-page publisher: AstroKube methodology: https://ai-act.astrokube.com/about/ source_verified_on: '2026-09-15' site_content_updated_on: '2026-09-15' title: 'Spain: AESIA, the AEPD guides and the national layer | AstroKube' description: 'What Spain adds to the EU AI Act: AESIA and the statute that created it, the governance bill still in parliament, the AEPD guidance and the regime it actually interprets, and where harmonised standards stand.' language: en source: https://ai-act.astrokube.com/spain/ --- 1. [Start](https://ai-act.astrokube.com/) 2. Spain National layer # Spain The Regulation is directly applicable, so nothing here replaces it. What a Member State adds is an authority, a penalties regime and guidance, and each of those is read against the EU provision it sits beside. ## The rule this page follows National guidance never carries a claim on this site by itself. Every entry names the EU provision it interprets, because the Spanish text of the Regulation is authentic law while a regulator's guide is that regulator's reading of it. ## Authorities, law and guidance ### AESIA, and what it is for Article 70 makes every Member State designate at least one notifying authority and at least one market surveillance authority, exercising their powers independently. Spain created the Agencia Española de Supervisión de Inteligencia Artificial by Real Decreto 729/2023, which approves its statute. When Spanish copy on this site refers to the market surveillance authority, this is the body it means. Worth knowing The agency’s own site did not respond when the corpus was built, so no AESIA publication is captured here. Its founding statute is, and a claim on this page rests on that statute and on the EU provision beside it, never on national guidance alone. [EU Art. 70(1)](https://ai-act.astrokube.com/law/art-70/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [ES RD 729/2023](https://www.boe.es/eli/es/rd/2023/08/22/729 "Real Decreto 729/2023, de 22 de agosto, por el que se aprueba el Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial") ### The governance bill, and what it is not A Proyecto de Ley Orgánica para el buen uso y la gobernanza de la Inteligencia Artificial is in parliamentary procedure. It is not a transposition: this Regulation is directly applicable, and nothing national is needed to make it bind. What a national law does here is fill the room the Regulation leaves to Member States, and the largest of those rooms is Article 99(1), which tells Member States to lay down the rules on penalties and other enforcement measures. Worth knowing The bill was not published in the Boletín Oficial del Estado and is not in force when this page was last reviewed. Until it is, it states an intention, not law. [EU Art. 99(1)](https://ai-act.astrokube.com/law/art-99/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 70(1)](https://ai-act.astrokube.com/law/art-70/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [ES Proyecto de Ley Orgánica 121/000096](https://www.congreso.es/ "Proyecto de Ley Orgánica para el buen uso y la gobernanza de la Inteligencia Artificial (expediente 121/000096)") ### The AEPD guides, and the regime they actually interpret The Spanish data protection authority has published the most detailed engineering-facing material any Spanish regulator has put out on AI systems. Read it, and place it correctly: it interprets data protection law, not this Regulation. Article 2(7) keeps the two regimes separate and both applicable. Where they meet is specific and useful: a deployer uses the Article 13 information to carry out its GDPR impact assessment, and a fundamental rights impact assessment may cross-reference that assessment where it already covers the same ground. | Guide | What it is useful for | | --- | --- | | Adecuación al RGPD de tratamientos que incorporan IA | The baseline treatment of AI processing under data protection law. | | Requisitos para auditorías de tratamientos que incluyan IA | What an auditor will ask for, which overlaps heavily with the evidence an operator keeps anyway. | | Exactitud, idoneidad y calidad de los datos en IA | Data quality expectations, next to the Article 10 data governance requirements. | | Orientaciones sobre IA agéntica | The most detailed European regulator treatment of agentic systems so far: memory compartmentalisation, tool allowlists, autonomy levels. | | Listas de tratamientos que requieren evaluación de impacto | The criteria that make a data protection impact assessment mandatory. | Worth knowing National guidance never carries a claim on this site by itself. Every row above is read against the EU provision cited with it. [EU Art. 2(7)](https://ai-act.astrokube.com/law/art-2/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 26(9)](https://ai-act.astrokube.com/law/art-26/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 27(4)](https://ai-act.astrokube.com/law/art-27/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [ES AEPD, adecuación al RGPD](https://www.aepd.es/guias "Adecuación al RGPD de tratamientos que incorporan Inteligencia Artificial (AEPD)") [ES AEPD, requisitos para auditorías](https://www.aepd.es/guias "Requisitos para auditorías de tratamientos que incluyan IA (AEPD)") [ES AEPD, calidad de los datos](https://www.aepd.es/guias "Exactitud, idoneidad y calidad de los datos en Inteligencia Artificial (AEPD)") [ES AEPD, IA agéntica](https://www.aepd.es/guias "Orientaciones sobre IA agéntica desde la perspectiva de protección de datos (AEPD)") [ES AEPD, listas de EIPD](https://www.aepd.es/guias "Lista de tratamientos que requieren evaluación de impacto (artículo 35.4 RGPD) (AEPD)") ### The regulatory sandbox Article 57 makes Member States ensure that their competent authorities establish at least one AI regulatory sandbox at national level, operational by the date the article sets, either alone or jointly with other Member States. A sandbox is a controlled framework in which a provider develops, trains, validates and tests an innovative system under a sandbox plan agreed with the authority, for a limited time and under supervision. Applies from Deferred 2 Aug 2027 [EU Art. 57(1)](https://ai-act.astrokube.com/law/art-57/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 3(55)](https://ai-act.astrokube.com/law/art-3/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [ES RD 729/2023](https://www.boe.es/eli/es/rd/2023/08/22/729 "Real Decreto 729/2023, de 22 de agosto, por el que se aprueba el Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial") ## Harmonised standards ### Harmonised standards, and what they buy you Article 40 is the only place in this Regulation where following a standard has a legal effect. A high-risk system or a general-purpose AI model that conforms to a harmonised standard whose reference has been published in the Official Journal is presumed to be in conformity with the requirements that the standard covers, and no further. The chain has three links, and the middle one is the one people skip: a standard exists, its reference is published in the Official Journal, and only then does the presumption attach. - The standards for this Regulation are being drafted by CEN-CENELEC JTC 21, on a Commission standardisation request. - They are sold through national standardization bodies, UNE in Spain. They are not free, and this site does not mirror them. - Until a reference is published in the Official Journal, conformity with a draft buys engineering confidence, not a presumption of conformity. - Where harmonised standards are missing or insufficient, the Commission may adopt common specifications instead. Worth knowing This site records no harmonised standard cited in the Official Journal for this Regulation as of its last source verification. That is a statement about what the corpus holds, not a claim about what was published this week: check the Official Journal before relying on it. [EU Art. 40(1), (2)](https://ai-act.astrokube.com/law/art-40/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") [EU Art. 41](https://ai-act.astrokube.com/law/art-41/ "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)") EU CEN-CENELEC JTC 21