Regulation & Rights

Published on 15 October, effective 16 October 2026. Delegates internal contracting and personnel functions, including contracts below €60,000. It does not itself introduce general AI compliance duties.

The AEPD reports warnings to two municipalities planning AI video analysis. This announcement is not evidence of a fine or a general ban.

The AEPD warns a company considering automated CV scoring. Data-protection safeguards should be incorporated from the start of the proposed system.

Congress records the bill as concluded and lapsed from 6 October 2026. Its proposed AI inventory, AI officers and allocation of authorities did not become law through this bill. The earlier amendment deadlines are no longer current.

AESIA’s institutional website: public information on its organisation, activities, guidance and responsibilities. Specific supervisory powers should be checked against the applicable legal text.

The legal basis for Spain's AI supervisory agency, including its supervision, advice, awareness, training, testing, coordination, and inspection functions.

Spain's rider-law amendment to the Workers' Statute, requiring worker representatives to be informed about algorithmic or AI systems affecting work conditions, access, retention, or profiling.

Spain’s 2021 Digital Rights Charter, a policy reference for rights in digital environments. It is not presented here as a statute creating standalone enforceable obligations.

AESIA’s dated note of 29 May 2026 on the Commission’s transparency and high-risk consultations. Kept as a record of participation in the guidance process, not as a current consultation notice.

Spain's pre-AI-Act sandbox, created to rehearse compliance for high-risk AI, general-purpose systems, and foundation-model-like systems before full EU enforcement.

The AEPD’s library of guidance and tools on data protection. Each guide has its own publication date, scope and status; guidance is not a substitute for the applicable law.

A 2026 AEPD guide on AI agents, autonomy, environmental interaction, and measures controllers and processors can use to manage data-protection risks.

The Commission’s implementation timeline, read alongside Regulation (EU) 2026/1744. Article 50 generally applies from 2 August 2026; the amended calendar separates high-risk systems, new prohibitions and transitional provisions. Consult the legal text for the applicable case.

Voluntary compliance framework for mandatory Article 50 duties. EU icons are optional. The final code dates to June, not its October webpage update.

The 2024 AI Act as published in the Official Journal. For current obligations, read it together with amendments, including Regulation (EU) 2026/1744, and the relevant transitional provisions; the original publication is not a consolidated legal assessment.

The enacted amendment to the AI Act, published on 24 July 2026. It changes the application calendar, including Annex III high-risk requirements on 2 December 2027 and product-related Annex I requirements on 2 August 2028. New prohibitions and Article 50 transitions have their own dates.

The Commission's final Article 50 guidance on AI-interaction notices, machine-readable marking, deepfake labels, public-interest synthetic publications, and biometric or emotion-recognition disclosures.

The Commission's optional icon set for certain AI-generated or manipulated content. The icons can support Article 50 disclosure, but using them is not mandatory and does not establish compliance by itself.

Draft Commission guidance published on 19 May 2026 on Article 6 high-risk classification. Its consultation closed on 23 June 2026. The linked document is a draft, not a binding rule or evidence that a consultation remains open.

The voluntary GPAI Code of Practice supports compliance with the AI Act through chapters on transparency, copyright, and safety and security. Signing the code is not an independent safety certification or a replacement for legal obligations.