Spain and the AI Act: what AESIA and the AEPD expect from companies
Spain created AESIA, the EU's first national AI supervisory agency. What companies must prepare, with the AEPD and the LOPDGDD, as the AI Act phases in.
Spain did not wait for Brussels to get organised. In August 2023, the government approved by royal decree the statute of the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA), based in A Coruña. That made Spain the first country in the European Union to set up a national agency dedicated to supervising artificial intelligence, even before the EU AI Act was formally adopted.
For Spanish companies, this matters. They now face two regulators: AESIA for AI systems, and the Agencia Española de Protección de Datos (AEPD) for personal data. Both are already paying attention to what employees type into ChatGPT, Copilot or Gemini every day.
An agency built for the AI Act
AESIA grew out of a clear political choice: to have an authority ready on the day European obligations kicked in. It started working on site in A Coruña in early 2025. The organic bill on the good use and governance of AI, under review in the Congress of Deputies in 2026, makes it the main market surveillance authority, with sanctioning powers, a single complaints window and responsibility for the national regulatory sandbox.
The bill follows the AI Act ceilings. For prohibited practices, fines can reach 35 million euros or 7% of worldwide turnover. For SMEs, the lower of the two amounts applies. The bill also adds a very serious infringement for failing to report a serious incident.
The AEPD and the LOPDGDD remain on the front line
AESIA's arrival takes nothing away from the AEPD. As soon as a prompt contains a name, a DNI, an IBAN or a medical record, the GDPR applies, complemented in Spain by the Ley Orgánica 3/2018 on the protection of personal data and the guarantee of digital rights, better known as the LOPDGDD.
This law has a feature that IT leaders should keep in mind: it sets out digital rights at work, such as privacy when using devices provided by the employer and the right to disconnect. In practice, any way of monitoring AI use must be proportionate, announced to staff and backed by written rules. Watching everything without telling anyone is not an option.
The timeline: what already applies, what is coming
The AI Act applies in stages, and several obligations are already in force:
Since 2 February 2025: bans on certain practices and the AI literacy duty (Article 4). Every company using AI must make sure its teams understand the tools well enough.
Since 2 August 2025: rules for general purpose AI models and national penalty regimes.
Coming next: the provisional political agreement on the Digital Omnibus, reached on 7 May 2026, plans to move transparency obligations to 2 December 2026 and Annex III high-risk obligations to 2 December 2027.
The delay is no excuse. AI literacy and the GDPR apply today, and these are the first things the AEPD and AESIA can check.
The real everyday risk: data inside prompts
In most Spanish companies, AI does not arrive through a big project. It arrives through a salesperson pasting a contract into a chatbot, a lawyer summarising a case file, an accountant asking for help with a payroll spreadsheet. Much of this is shadow AI, outside any control by IT.
In banking, insurance, healthcare and tourism, sectors that weigh heavily in Spain, these texts contain DNI and NIE numbers, social security numbers, IBANs or health data. Once sent to an external AI service, they leave the company's perimeter. For the AEPD, that raises questions of legal basis, transfers and security of processing. Banning ChatGPT solves nothing: employees simply find another tool. The real question, also raised by sovereign AI, is where the data goes.
Five workstreams to start now
Map usage: which AI tools are used, by whom, with which data. Without an inventory, you cannot classify risks under the AI Act.
Train, and prove it: Article 4 requires a sufficient level of AI literacy. Keep records of training, without relying on it alone.
Write a usage policy that is clear, shared with staff representatives and consistent with the digital rights in the LOPDGDD.
Protect data at the source: detect and anonymise Spanish identifiers before they leave the device.
Keep evidence: log prevented incidents so you can answer an AEPD or AESIA inspection.
Our EU AI Act and GDPR Article 32 checklist walks through these points step by step.
How ZeusLock helps Spanish companies
ZeusLock runs directly on employee devices and browsers. Before a prompt or a file goes to an AI assistant, it spots sensitive data (DNI, NIE, IBAN, social security numbers, customer data), anonymises it while preserving its format, warns the user or blocks the upload according to your rules. Every incident is logged, which gives you concrete evidence to show during an inspection. To get started, our 90-day rollout playbook offers a realistic plan.
Key takeaways
Spain is the first EU country to create a national AI supervisory agency, AESIA.
The AEPD remains in charge whenever personal data is involved, together with the LOPDGDD.
AI literacy and the GDPR already apply, even if some AI Act deadlines are moving.
The main risk hides in everyday prompts.
Want to see how to protect your teams' data in Spain without slowing down AI adoption? Book a ZeusLock demo.
Protect your data from AI leaks
See ZeusLock stop sensitive data before it reaches ChatGPT, Claude, Gemini and more, in a 30-minute demo.
