Spain

Paraphrasing Hans Kelsen, the Spanish Constitution (1978) lies at the peak of the pyramid of the legal system in Spain. Therefore, when using AI tools, at minimum the following articles of the Spanish Constitution should be considered:

• Article 14 recognises the equality of Spaniards before the law and how they may not be discriminated against on account of birth, race, sex, religion, opinion or any other personal or social circumstance.
• Article 18, point 1 guarantees “the right of honour, to personal and family privacy and to one’s own image”. Additionally, point 4 explicitly restricts “the use of data processing in order to guarantee the honour and personal and family privacy of citizens and the full exercise of their rights”. In this regard, the Constitutional Court has linked Article 18.4 to the recognition of an autonomous fundamental right of personal data protection, including a power of control over personal information (see, among others, STC 94/1998 and STC 292/2000). This fundamental right is especially relevant as the right to privacy is particularly threatened by the use of AI.
• Article 24 recognises the right of all persons to obtain the effective protection of judges and courts in the exercise of their rights and legitimate interests. On this matter, although the processing of judicial data through so-called AI systems is likely to improve the transparency of the functioning of justice by improving the predictability of the application of the law and the consistency of jurisprudence, it should also be noted that such processes cannot be limited to algorithms and must take into account particular circumstances, thus ensuring the equality of data subjects before the law. 

In terms of fundamental rights, Spain has been a world pioneer by presenting a “Charter of Digital Citizenship Rights”, a reference framework for navigating the digital environment in which we already live. This Charter was approved in July 2021 and seeks to update existing rights recognised in texts, such as the Declaration of Human Rights or the Spanish Constitution, and adapt them to the new digital reality. Its section XXV recognises a set of rights in the context of AI that makes reference to non-discrimination, the obligation of transparency and the accessibility, usability and reliability that shall govern this technology. However, it is not (yet) a legislative text; therefore, it can only be understood within the existing legal framework.

In addition, Spain is a member of the Organisation for Economic Co-Operation and Development (OECD), and, therefore, has adopted the OECD Council Recommendation on AI. These principles promote AI that is trustworthy and that respects human rights.

At Council of Europe level, the Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law was opened for signature on 5 September 2024. It is intended to ensure that AI lifecycle activities are consistent with human rights, democracy and the rule of law.

Finally, it is worth mentioning the judgment of the Spanish Constitutional Court 76/2019 that repealed Article 58 bis of the Organic Law on the General Electoral Regime, which allowed political parties to track the political opinions of citizens on the internet by means of AI systems. The High Court stated in its ruling its concern about the use of AI to manipulate the will to vote without the public being aware of it, by sending out propaganda, automatically tailored to their weaknesses and strengths.

In December 2025, AESIA/SEDIA published a set of non-binding practical guides developed in the Spanish AI regulatory sandbox, aimed at operationalising the EU AI Act’s requirements (including transparency and human oversight) pending EU harmonised standards.

Law 24/2015 on Patents considers, inter alia, computer programs and ways of presenting information to be unpatentable “as such” (Article 4.4(a), (b), and (d)). In this sense, AI, as such, is not patentable, as it is a set of algorithms implemented in a computer system. However, as with software, AI would meet the requirements for patentability under Spanish law if it can be demonstrated that, by means of this technology, an invention provides a technical contribution (i.e. beyond the algorithm “as such”) and meets the remaining patentability requirements.

The second question is whether the AI can be considered an inventor of a patentable creation. In this regard, Article 10 of the aforementioned regulation states that “the right to the patent belongs to the inventor (…)”. Given that the law links the status of inventor to the natural person — based on the conception that an invention is the result of human creativity — the AI, as such, cannot be considered an inventor. This approach is consistent with the EPO’s position in the DABUS filings (inventor must be a natural person).

Article 5 of Royal Decree-Law 1/1996, approving the Spanish Law on Intellectual Property, provides that “the natural person who creates a literary, artistic or scientific work shall be considered the author”. Additionally, Article 10 establishes that “all original literary, artistic or scientific creations (…) are subject to intellectual property”.

From the foregoing, it is clear that, under Spanish law and in accordance with the applicable doctrine and case law, the fundamental requirements that any creation must meet in order to be considered eligible for copyright protection are the following:

• it must be the result of a creative act of its author who, in any case and ultimately, must be a natural person who imprints on such creation the author’s artistic expression; and
• such result must be original, in the sense that it must incorporate a minimum of “creative height” or novelty with respect to everything previously created.

Therefore, in Spanish law, copyright protection of creations made solely by AI (i.e. with no relevant human creative contribution) is not possible, mainly due to the fact that creations that do not originate from a human being are not protected. The protection by copyright of these creations would require, at least, a substantial legislative change by way of extending the concept of “author” to entities other than natural persons.

When it comes to training/text and data mining in GenAI use cases, the key copyright issue is not only the output, but the use of protected works for training. In Spain, text and data mining is expressly regulated (Article 67 TRLPI), including an opt-out mechanism for right holders (reserva expresa) under certain conditions.

As already explained, AI cannot be protected either by copyright or by patent protection under Spanish legislation. However, the Spanish system provides for an equally effective form of protection: trade secrets. Trade secrets are regulated in Law 1/2019, Article 1 of which establishes that any element or information that has the following characteristics can be considered a trade secret:

• it must be secret information, in the sense that it must not be generally known by the persons who may normally have access to that type of information;
• it must have a business value; and
• it must have been subject to measures to keep it secret.

In this sense, compilations of data, such as AI training sets, the expression of a programmer’s source code or other proprietary information used in AI technology can be considered information that is intended to be kept secret due to an economic or competitive advantage and, if it meets the above conditions, it can constitute a trade secret under Spanish law. In this regard, any disclosure of such trade secrets can give rise to different legal actions, including a claim for damages.

No ongoing cases to report.

In Spain, the right to data protection is developed in a regulatory framework that currently comprises the General Data Protection Regulation (EU) 2016/679 (GDPR) ([2016] OJ L119/1), and it is supplemented by Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), which fundamentally adapts Spanish legislation to the GDPR.

The LOPDGDD establishes a series of obligations and rights, which cover all processing of personal data, whether manual or computerised, and which must be especially considered in the implementation of AI technology. In this regard, it is worth noting its Title X which addresses the recognition of data subjects’ digital rights as enshrined in the above-mentioned Article 18.4 of the Spanish Constitution.

Additionally, in 1992, the Spanish Data Protection Agency (AEPD) was created in order to promote and ensure compliance with Spanish data protection legislation. In relation to AI systems and data protection, the AEPD has issued (among others) the following guidance and criteria:

• the Guide to adapt products and services using AI to the GDPR (2020);
• the Guide on requirements for audits of data processing involving AI (2021);
• the Circular 1/2019 on the processing of data relating to political opinions by political parties (Article 58 bis of Organic Law 5/1985);
• the Guide on biometric data for presence control and access (2023);
• the Criteria and enforcement relating to biometric data (including AI-based facial recognition) in online assessments (2020–2025); and
• the AEPD general policy for the use of generative AI in its own processes (2025).

Given that Spain is a Member State of the EU, it is subject to the application of the GDPR. As the use of AI often involves personal data processing, it entails the risk of non-compliance of the referred regulation if, for example, there is a lack of transparency about the way in which the personal data is processed or if personal data is used illegitimately.

Among all data subjects’ rights established in the GDPR, the right not to be subject to automated individual decisions is probably the one that may be most exposed by the use of AI technology. This right is intended to ensure that an individual is not the subject of a decision based solely on the processing of personal data (i.e. profiling) that produces undesired legal effects for the individual or significantly affects the individual in a similar way.

Profiling carried out by means of AI technology will certainly imply the processing of personal data that may be intended to evaluate personal features, in particular analysing or predicting aspects related to any individual’s work performance, economic situation, health, preferences or interests, reliability, or simply general behaviour.

Nevertheless, this data subject right will not be applicable when:

• it is necessary for the conclusion or execution of a contract between any individual and a company;
• the processing of personal data is based on the individual’s consent; or
• it is authorised by the law of the EU or of the Member States and adequate measures are established to safeguard the rights and freedoms and legitimate interests of the interested party.

However, it is worth mentioning that when using the above-referred exceptions, companies must always guarantee the data subject a right to obtain human intervention, to express a personal opinion and to challenge the automated decision.

Additionally, the above-referred exceptions will not apply to special categories of data (Article 9.1 of GDPR), unless Article 9.2.(a) or (g) of GDPR is applied and appropriate measures have also been taken.

For certain uses (notably “high-risk” AI), companies should also read GDPR compliance together with the EU AI Act’s specific requirements on data quality and data governance (e.g. training/validation/testing datasets), which are intended to reduce bias and improve traceability and accountability.

The availability of open data from public administrations is essential for the proper functioning of AI systems, as algorithms need to be fed and trained by data whose quality and availability allows for continuous improvement.

Thanks to the different initiatives undertaken in recent years, the already mentioned National AI Strategy highlights how Spain has become a European benchmark in the field of open data, stressing the role of the Aporta Initiative, a project launched in 2009 aimed at promoting the disclosure of public information and the development of advanced data-based services launched by the Ministry of Economic Affairs and Digital Transformation and Red.es, a public business entity.

This strategy also points out several key actions that can be taken in order to develop AI infrastructures in terms of open data. Among others, the development of a regulatory framework for open data, the definition of a strategy that ensures the access to public administration data and the creation of the Data Office at state level, which will coordinate all public administrations with a view to standardising the storage, access and processing of data.

Spain’s Digital 2026 Strategy further elaborates on measures and actions in AI and the data economy, including the creation of the Office of Data and the role of Chief Data Officer, the establishment of the AI Advisory Council, the publication of the Charter of Digital Citizenship Rights, and the approval of the National Language Technologies Plan. Other significant initiatives include the Strategic Project for Economic Recovery and Transformation (PERTE) “New Language Economy”, the strategic supercomputing project Quantum Spain, and the Spanish hub of GAIA-X, which supports the development of national sectoral data spaces and data management. The strategy also introduces the National Program for Green Algorithms (PNAV), a regulatory sandbox for the future European AI Regulation, the creation of the National Centre for Neurotechnologies, and the establishment of AESIA.

It is clear that the interaction of AI tools with voice and facial recognition enhances biometric information with a higher potential, but, in parallel, may also generate an extraordinary (not always positive) impact on the rights of individuals.

In Spain, it is worth mentioning the Report (36/2020) issued by the AEPD which analyses the use of biometric data for the purposes of facial recognition in online student tests. The legal report shows that consent on the part of the student can only be considered free and therefore valid when an equivalent alternative in terms of duration and difficulty has been offered. Additionally, said report proposes that when the legal basis for facial recognition of the students is in the public interest, this would require a regulation with the status of a law enabling it and providing specific safeguards for such processing.

In this respect, the AEPD issued in July 2021 a sanction against a renowned company in the retail sector for EUR 2.5 million due to the facial recognition system implemented by the supermarket company to prevent the entry of people who had been banned from accessing their shops by a judgment.

The AEPD Guide issued in November 2023 on the use of biometrics for presence control sets strict criteria for compliance with the GDPR. It emphasises that biometric data processing, both for identification and authentication, is considered high-risk and includes special categories of data. For employment-related access control, a law specifically authorising the use of biometric data is required, and consent is not sufficient due to the power imbalance between employers and employees. Similarly, for non-employment-related access control, consent alone is not adequate. Additionally, the Guide mandates a Data Protection Impact Assessment before starting any biometric data processing and outlines technical and organisational measures to protect biometric data, including encryption, data minimisation, and ensuring the revocability of biometric templates.

There is an increasing number of companies and public administrations in Spain that are taking advantage of the benefits offered by AI to automate processes. As an example, tools such as VeriPol (presented as an AI-based support tool for identifying potentially false reports in certain crime categories) and the VioGén/VioGén 2 system (risk assessment and follow-up in cases of gender-based violence) illustrate how algorithmic outputs may influence operational decisions and, therefore, require particular safeguards to prevent discriminatory outcomes.

Law 15/2022 of 12 July 2022, on Equal Treatment and Non-Discrimination, expressly addresses AI and automated decision-making mechanisms. In particular, Article 23 provides that:

• public administrations shall favour mechanisms so that algorithms used in public decision-making take into account bias minimisation, transparency and accountability, where technically feasible;
• public administrations and companies shall promote ethical, trustworthy, and fundamental-rights-respecting AI; and
• a quality seal for algorithms is to be promoted.

For uses that fall within the scope of the EU AI Act (notably “high-risk” AI systems, including those used in employment, education, access to essential services, law enforcement, migration, and justice), the anti-discrimination discussion is no longer purely “principles-based”: the AI Act imposes technical and organisational requirements that are directly relevant to bias control (e.g., data governance and bias in datasets; risk management; human oversight; post-market monitoring).

From a practical perspective, the AESIA guides (in particular, on risk management, data governance, transparency, and human oversight) converge on a similar bias-control playbook for high-risk AI systems, including:

• identifying likely sources of bias and protected groups affected;
• applying bias evaluation techniques and documenting mitigation measures;
• setting monitoring metrics (including for updates/releases) and detecting drift; and
• training users to avoid “automation bias” (overreliance on the system’s output).

In addition to the above, including the already-mentioned Article 14 of the Spanish Constitution, the following are the main regulations that guarantee the equality and non-discrimination of citizens that could be invoked in the event of the use of AI systems in violation of the referred fundamental right:

• Law 3/2007 for effective equality of women and men.
• Law 14/1986 of General Healthcare. Article 3 regulates that access to, and provision of, healthcare shall be carried out under conditions of equality, avoiding discrimination between women and men due to their physical differences or associated stereotypes.
• Royal Decree-Law 19/2018 on payment services and other urgent measures in financial sector. This law makes reference to equality and non-discrimination in relation to payment services throughout multiple articles.
• Workers’ Statute Law (Royal Legislative Decree 2/2015). Article 4.2, paragraph (c) recognises worker’s right not to be discriminated.
• General Law for the Defence of Consumers and Users (Royal Legislative Decree 1/2007). Consumers, in those cases in which they believe the principle of equality has been violated, have the right to know the justification for a company’s refusal to provide services or sell products to them. In the absence of a relevant explanation, the consumer may take action against the same as an infringement in accordance with Article 47.1, paragraphs (k) and (m).

In Spain, the main baseline instruments to consider (depending on your role and sector) are:

• Security of network and information systems (NIS/SRI framework).
• Current baseline. Real Decreto-ley 12/2018 (security obligations plus incident notification system for operators of essential services and digital service providers), developed by Real Decreto 43/2021.
• Update track (NIS 2). The government approved the Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad (Preliminary Draft Law on Cybersecurity Coordination and Governance) (still in the legislative process), intended to transpose Directive (EU) 2022/2555 (NIS 2/SRI 2).
• Public sector and public procurement baseline (ENS). When supplying AI-enabled services to Spanish public administrations (or operating within them), compliance with the Esquema Nacional de Seguridad (National Security Framework) (ENS) under Real Decreto 311/2022 is typically a core requirement (policies, risk management, controls, audits).
• Telecoms security and continuity. Spain has opened a public consultation on a draft Royal Decree on security and resilience of electronic communications networks and services (relevant for operators and certain critical digital infrastructures).
• Critical infrastructure protection. Where AI is used in or for critical infrastructures, the Ley 8/2011 (and its development rules) remains the domestic baseline to consider alongside sector rules.
• AI-specific requirements under the EU AI Act (directly applicable as EU Regulation). For high-risk AI systems, providers must ensure appropriate levels of accuracy, robustness, and cybersecurity and implement post-market monitoring and serious incident reporting obligations.

In practice, AESIA’s non-binding guides translate these obligations into implementable controls (e.g. threat modelling for AI, secure development lifecycle, logging/traceability, vulnerability management, incident triage and reporting workflows).

While Spanish precedents specifically addressing “autonomous” AI-driven collusion remain limited, the CNMC has already pursued cases where digital tools/software and information exchange were part of cartel conduct and enforcement analysis. By way of example, the CNMC opened proceedings and later sanctioned multiple companies in the real estate intermediation (PROPTECH) cartel case.

In the field of trade, antitrust, and competition, the main Spanish regulations governing AI-related conduct are:

• Law 15/2007 on the Defence of Competition (cartels, abuse of dominance, merger control framework at national level);
• Law 3/1991 on Unfair Competition (including practices that may be facilitated by AI-enabled commercial strategies);
• General Law for the Defence of Consumers and Users (Royal Legislative Decree 1/2007) (relevant where AI is used for personalised pricing, ranking, recommender systems or interfaces affecting consumers);
• General Telecommunications Law 11/2022 (sector framework relevant to digital markets players operating electronic communications networks/services); and
• Order ECC/2316/2015 on information obligations and classification of financial products (sector-specific, relevant where AI is used in marketing/distribution of financial products).

Spain does not recognise AI agents as having legal personality or independent capacity to contract. The legal consequences of an agent’s “actions” are generally attributed to the natural or legal person(s) that design, provide, deploy, configure, or use it (depending on the facts and roles).

From a contracting perspective, Spain expressly recognises the validity and effectiveness of electronic contracts “when consent and the other requirements necessary for validity concur” (Law 34/2002, Article 23). This is compatible with automation, but the contracting party remains a person (natural/legal); the AI is a tool used to express/implement consent and perform obligations.

Where electronic signatures or seals are relevant, the applicable EU trust-services framework is Regulation (EU) No. 910/2014 (eIDAS). In practice, an AI agent does not “sign” in its own name; signature/seal effects attach to the identified natural or legal person behind the credential.

A notable (non-liability) trend in Spain is judicial scrutiny of algorithmic decision-making used by public bodies, especially around explainability/transparency and access to information. The Supreme Court’s ruling in the proceedings brought by the Civio Foundation (a transparency-focused civil society organisation) concerning BOSCO (Bono Social Continuo, the automated system used by the Ministry for the Ecological Transition to assess eligibility for the regulated social electricity tariff) is often cited in this context.

There is no single “agentic AI” statute. Sector rules typically regulate the activity (e.g. trading, healthcare, transport) and AI obligations then layer on top (notably, the EU AI Act).

Financial services (Spain/CNMV perimeter)

Spain implements MiFID II-style controls on algorithmic trading and high-frequency algorithmic trading. Law 6/2023 (Ley de los Mercados de Valores y de los Servicios de Inversión (Law on Securities Markets and Investment Services)) contains specific requirements for firms engaging in algorithmic trading, including organisational and control obligations.

Public sector deployment (including justice/enforcement uses)

For “high-risk” uses in areas such as law enforcement, migration/border management, and justice, the EU AI Act relies on strong governance, oversight, and market surveillance, and it interfaces with sector supervision structures.

Across sectors (EU AI Act compliance baseline)

Where an agentic system qualifies as a high-risk AI system (or is embedded in one), practical compliance typically needs:

• human oversight measures that are real (not nominal), including intervention/override where needed;
• cybersecurity and robustness controls aligned with the system’s risk profile;
• incident management and reporting processes (including escalation and documentation);
• post-market monitoring and feedback loops misuse and new risks; and
• technical documentation and traceability.

Under the Spanish Royal Legislative Decree 1/2007, producers are liable for damage caused by defective products (Article 135). A “product” is defined as “any movable good” (Article 136).

This framework fits AI most clearly when AI is:

• embedded in a tangible product (e.g. a device, vehicle component, medical equipment); or
• marketed as part of a product ecosystem where defects in software/updates affect safety.

Where AI is provided purely as a service, liability analysis often shifts to contract/tort and sector rules.

Spain’s defective-product liability regime is strict in the sense that it does not require proving fault; the producer is responsible for damages caused by product defects (Article 135).

In practice, claimants still face the classic challenges of proving:

• the damage;
• the defect; and
• causation (which can be difficult for complex software/AI).

For AI, “recall” often translates into patching, disabling, rolling back models/versions, withdrawing from the market, or stopping deployment, but this would be based on two EU layers:

• EU AI Act (safety governance). High-risk providers must operate post-market monitoring and incident-handling processes and take corrective actions when risks materialise. AESIA’s guides operationalise these obligations into practical controls (incident workflows, monitoring plans, robustness/cybersecurity, documentation).
• General product safety. For consumer products, the EU’s updated general product safety regime strengthens expectations around rapid corrective action (including withdrawals/recalls and consumer notifications) where products present risks, increasingly relevant when risks emerge through software updates.

No Spain-specific, widely cited “AI product liability” test case has yet crystallised into a landmark line of case law.

When it comes to transparency litigation (public algorithms), while not product-liability cases, Spanish disputes around algorithmic systems used by administrations (e.g. BOSCO) signal growing pressure for explainability and access to technical information: relevant to future causation/defect arguments in AI harm scenarios.

The adaptation of Spanish legislation to AI remains progressive. However, Spain has moved from “early-stage initiatives” to a more concrete enforcement and governance agenda:

• General Audio-visual Communication. The former “draft” has been replaced by Law 13/2022, of 7 July, General Audio-visual Communication;
• General Telecommunications. The former “draft” has been replaced by Law 11/2022, of 28 June, General Telecommunications;
• Charter of Digital Rights (Carta de Derechos Digitales). This remains a reference framework (soft law), not a binding legislative text.
• Draft AI governance law (state level). On 11 March 2025, the Council of Ministers approved the Anteproyecto de Ley para el buen uso y la gobernanza de la Inteligencia Artificial (Preliminary Draft Law on the Good Use and Governance of Artificial Intelligence), intended to adapt Spanish governance/enforcement to the EU AI Act; a public consultation was opened shortly thereafter.
• Regional legislative developments (example). Castilla-La Mancha Law 4/2025, of 11 July, on administrative simplification/digitalisation includes a specific chapter on AI for the regional administration (human validation as a default, transparency duties, periodic audits, and explicit reference to EU AI Act prohibited practices and “high-risk” requirements).

There have been significant recent developments in terms of government strategy:

• AI regulatory sandbox. Royal Decree 817/2023 of 8 November 2023 establishes a controlled testing environment to trial compliance of certain AI systems that may pose risks to safety, health and fundamental rights, and regulates selection, testing procedures, and participant rights/obligations.
• Artificial Intelligence Strategy 2024. Approved by the Council of Ministers on 14 May 2024, structured around three axes (capabilities; adoption in public/private sectors; transparent/ethical/human-centric AI, including the role of AESIA).
• AESIA (institutional development). AESIA’s statute was approved by Royal Decree 729/2023. The agency’s leadership has also evolved: a director was appointed, as published on 24 December 2025.
• AESIA practical guidance for the EU AI Act (RIA). In December 2025, AESIA published a package of 16 practical guides (plus tools/checklists) to support compliance with the AI Act, developed in the context of Spain’s AI sandbox and intended to bridge implementation pending harmonised standards.