Spain - Market Insights

Spain’s AI moment meets legal risk and opportunity

Spain has entered an assertive phase on AI. The EU AI Act, adopted in 2024, is now moving towards its staged application and Spain has positioned itself with “institutional muscle”: the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) is now operational in A Coruña as the national AI authority; the Spanish Data Protection Agency (AEPD) continues robust EU General Data Protection Regulation (GDPR) and Spanish regulations enforcement; and the government’s National Artificial Intelligence Strategy (ENIA) signals policy ambition. The upshot: Spain is now becoming a jurisdiction where expectations are relatively clear and enforcement is likely to be active.

These days, corporations (and public institutions) are swiftly adopting generative AI for drafting, research and knowledge retrieval, as business leaders press for productivity and differentiation. In this context, two issues have become decisive for legal outcomes in Spain: first, confidentiality and training-data risks when using or building AI; second, the appropriate contractual risk allocation under the EU AI Act’s provider–deployer framework.

Both issues will be essential to determine whether AI adoption becomes a strategic asset or if it actually becomes a liability trap for companies.

Confidentiality and training data

For corporations, confidentiality underpins client trust and commercial strategy. The adoption of generative AI challenges this foundation in ways that are subtle but material.

Many AI tools improve models using user prompts and outputs by default. Even where providers promise “no training on customer data”, this can vary across versions, regions and software updates. If confidential information appears in a shared model, secrecy and signed NDAs may be compromised.

Spanish regulators will certainly look at these technical facts, not at “AI marketing language”, as logs, telemetry and prompt caches can persist even without model training. We should not forget that the “privacy by design” and “minimisation” principles under the GDPR/the Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) also apply directly to AI activities. So the questions are: what data is stored, for how long, in which jurisdiction, and with what access controls?

If prompts or outputs reach providers in the US or elsewhere, transfers must be justified under GDPR (typically based on standard contractual clauses (SCCs) and a Transfer Impact Assessment). For all confidential materials, the bar is even higher because breaches may undermine clients’ relationships and commercial strategies. At this point, standard Software as a Service (SaaS) contractual AI arrangements for sensitive data may not be sufficient.

Also, using internal precedents and existing work products to fine-tune models raises intellectual property (IP) questions. Spanish contract law and its ethical obligations can limit reuse, while the EU’s ongoing debates around training data origin reinforce the need to verify applicable permissions.

Additionally, what happens when AI-generated content is integrated into products and/or corporate services? It may cascade into civil (or even criminal) liability and Spanish courts will expect appropriate commercial due diligence as the usual “black box” argumentation may not be enough to sustain a defence. In brief, AI augmentation does not diminish the duty of professional care.

All companies should be aware that confidentiality and IP risks cannot be solved by a single vendor promise. They require end-to-end architecture and governance that stand up to regulatory or judicial scrutiny. This will indeed imply mapping data flows and aligning contractual commitments to technical realities, as well as implementing auditable measures.

The EU AI Act’s transparency duties for general-purpose models add another perspective: providers must disclose training data summaries and model characteristics. If your company’s AI deployment strategy conflicts with these disclosures, in Spain you should be ready to answer potentially hard questions from AESIA and AEPD.

Contractual role clarity under the AI Act: Provider vs deployer

The EU AI Act sets out roles along the lifecycle — provider, importer, distributor and deployer — with specific obligations. Corporations often assume they are mere “users”, but often — in reality — frequently cross into “provider” territory.

If a company retrains, fine-tunes or substantially modifies a model, it may be considered a “provider” of an AI system, triggering obligations around technical documentation, conformity assessment, CE marking for high-risk uses, and post-market monitoring. It should also be noted that building a tool that qualifies as an AI system and making it available across a group or to clients can make any company a provider or distributor, not just a deployer.

It should also be pointed out that certain use cases can be high-risk under the EU AI Act — for example, if used for recruitment screening in employment, credit assessments for legal finance, or in public procurement support. High-risk obligations for companies are heavy and time bound.

Ascertaining the correct classification of the AI use is not simply a formality, as it may potentially drive liability and enforcement. AESIA may like to see clarity about who the provider is and whether obligations have been met pre-deployment. If a Spanish corporation builds a generative drafting tool that integrates client data, dynamically modifies prompts and is offered across business units, that may look like “provider activity”. Alleging “we just use vendor X” may not be sufficient if the company controls the system behaviour and its data ingestion.

As already pointed out, Spain has purposely invested in institutional capacity. AESIA and AEPD coordination suggests active oversight, particularly for general-purpose models and high-risk deployments, and future Spanish-specific guidance is likely to supplement EU standards.

Spanish courts will also focus on the reality of AI control and responsibility. If contracts label a company as a deployer but it materially shapes the model’s behaviour, provider obligations may be attached.

The contractual allocation of roles — mapping responsibilities for providers and deployers across integrators, cloud vendors and foundation-model suppliers — will certainly develop as appropriate due diligence for companies. The setting up of warranties tied to AI Act compliance — providing technical documentation, training data provenance, risk management and post-market monitoring, combined with auditing rights — now becomes essential. And, of course, should these compliance failures arise, companies may wish to ensure that they can pivot to other vendors’ AI solutions while duly preserving IP and data extraction rights.

The Spanish regulatory framework: privacy, digital rights and sector context

Spain’s regulatory context also shapes AI strategy for companies. The AEPD enforces robustly, and Spain’s national data regulations enhance digital rights that intersect with AI by setting up high expectations around transparency and non-discrimination in certain contexts.

Although not binding like the EU AI Act, but very influential in the expectations for human oversight, transparency and fairness, those values incorporated in the so-called “Digital Bill of Rights” (included in the national data legislation completing the EU GDPR) are very likely to inform Spain’s enforcement.

As the national AI authority, AESIA will issue guidance, coordinate with EU-level structures, and focus on general-purpose models and high-risk systems.

The practical takeaway for companies should be that EU rules are necessary but not sufficient: if Spanish regulations are applicable to your company, anticipate scrutiny grounded in fundamental rights, a deep data protection culture and a rather strict administrative law scrutiny. AI touching employment, consumers or public services will face higher expectations, including demonstrable human oversight and explainability. Finance and health companies have supplementary obligations and their legal teams must always be ready to reconcile sectoral rules with the EU AI Act and additional privacy requirements.

Companies should treat AI deployment as a risk management decision, not as a generic IT tool rollout. Those organisations that will lead are making deliberate choices by establishing boundaries for matters where confidentiality or sensitivity preclude AI involvement, even with strong controls, and that communicate this position as part of their quality assurance and commercial strategy.

The prescribed company governance should also be easy to understand by a judge. Evidential policies — clear logs, human review checkpoints, model cards for internal tools and documented training for users — should be ready to prove that the right decision-making process has been established at any given company.

AI commercial contracts should specifically address confidentiality, IP and privacy obligations, but not in a generic manner. For foundation models, companies should demand full clarity on clauses dealing with data location and origination, as well as training practices, in order to accommodate Spanish enforcement realities. Contracts should also be adaptable for staged AI Act dates as prohibitions on some specific practices apply earlier than others, and will be followed later by transparency rules for general-purpose models and full high-risk obligations. However, Spanish regulators could potentially begin asking questions ahead of final deadlines.

A confident outlook

Spain’s market is certainly becoming a proving ground for responsible AI. Corporate customers will soon ask not “do you use AI?”, but rather “how do you control AI and can you actually prove it?” Those corporations that respond with organisational, technical and contractual reliability will certainly lead.

The EU AI Act just provides the legal scaffolding, and Spain’s institutions and national regulations contribute the necessary enforcement by responding to cultural expectations. Business leaders in Spain — as well as legal professionals — do not require an all-in-one AI procedural manual; rather, they need a solid grasp of where business exposure to AI sits and how governance, technical architecture and contracts jointly rule it.

Within this overall context, AI can be a force multiplier for business excellence in Spain. Any corporation advantage lies in trust, precision and accountability. AI holds the potential to amplify those strengths if it is engineered as a full management decision and as a decisive legal design choice. This approach will strongly require a pro-innovation stance.