AI Regulation Tracker / Legislation pending
Spain's Draft AI Organic Law Would Set 35M Euro Fines Enforced by AESIA
Spain's Council of Ministers has approved a draft Organic Law that would give national teeth to the EU AI Act, with fines up to 35 million euros and a dedicated enforcement agency. It is now in parliament, so firms operating AI in Spain should read it as a preview of the sanctions to come.
Spain is moving to put a hard enforcement floor under the European Union's AI rulebook. On May 26, 2026, the Council of Ministers approved a draft Organic Law on the good use and governance of artificial intelligence, a bill designed to align national enforcement with Regulation (EU) 2024/1689, the EU AI Act. The text was published in the parliamentary official journal on June 12, 2026, which starts its formal passage through the Cortes Generales. It is a draft, not a law, and nothing in it binds anyone yet. But its shape tells firms operating in Spain exactly what is coming.
The headline is the money. The bill would create a graduated sanctions regime, with the most serious breaches facing fines of up to 35 million euros or 7 percent of a company's worldwide annual turnover, whichever is higher. Lesser tiers step down from there, with reporting placing a lower band at around 500,000 euros or 0.5 percent of turnover. Those top figures are not a Spanish invention. They mirror the penalty ceilings the EU AI Act itself sets out in Article 99, so Spain is domesticating a European standard rather than inflating it.
AESIA holds the whip
Enforcement would run through AESIA, the Agencia Española de Supervisión de la Inteligencia Artificial. Spain established the agency ahead of most of its neighbors, and it has been described as the first standalone national AI supervisory body in the EU. That head start matters. Where several member states are still deciding which existing regulators will police AI, Spain already has a dedicated authority ready to receive the sanctioning powers this bill would grant. For a firm trying to understand who will knock on the door, Spain gives an unusually clear answer.
Softer edges for smaller firms
The draft is not built purely to punish. It signals mitigations for small and medium-sized enterprises and for startups, along with reductions for early payment of penalties. The intent is to keep the heaviest exposure aimed at large operators and the most serious conduct while giving smaller players room to correct course. Professionals advising Spanish clients should watch how these carve-outs are defined as the bill moves through parliament, because the precise thresholds will decide who benefits.
What it does not do
This is the part that most limits any overclaiming. The bill is in parliamentary processing, which means its provisions, including the exact fine bands and the mitigation rules, can change before enactment. It does not create new obligations beyond what the EU AI Act already imposes; its job is national enforcement and governance, not fresh substantive duties. And it is not yet in force, so no fine can be levied under it today. Treat it as a preview of Spain's enforcement posture, not as a live compliance deadline.
The cross-border angle
For a US reader, the relevance is direct. A US company running AI systems that reach Spanish users or operations would sit inside this national sanctions layer once it is enacted, on top of the EU AI Act's own requirements. The AI Act already applies extraterritorially to providers and deployers whose systems are used in the EU. Spain's bill adds a specific enforcer, AESIA, and a specific penalty schedule to that reach. A US firm that has mapped its AI against the AI Act's prohibited and high-risk categories is already most of the way to understanding its Spanish exposure.
The practical read for any working professional is patience with preparation. There is no obligation to file anything with AESIA today. But the direction is set, the enforcer exists, and the numbers are on the table. Firms that inventory their AI systems and classify them against EU risk tiers now will not be scrambling if and when the Cortes turns this draft into law.
Frequently Asked Questions
What did Spain change?
Spain's Council of Ministers approved a draft Organic Law on the good use and governance of AI on May 26, 2026, aligning national enforcement with the EU AI Act. It was published in the parliamentary journal on June 12, 2026, and is now moving through parliament. It is a draft, not yet law.
Who does this affect?
Providers and deployers of AI systems in Spain, including US and other foreign firms placing AI on the Spanish market. The draft signals lighter treatment for SMEs and startups and reductions for early payment of any penalty.
How large are the fines?
The draft sets a graduated regime, with the most serious breaches facing up to 35 million euros or 7 percent of worldwide turnover, and lower tiers reported around 500,000 euros or 0.5 percent. Those top figures mirror the EU AI Act's own Article 99 penalty ceilings.
Is this in force now?
No. The bill is in parliamentary processing as of July 7, 2026. Its provisions can change before enactment, and no penalty can be imposed under it until it becomes law.
Sponsored Training
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.