Insights and Analysis

Draft Act on Artificial Intelligence in Spain - Opened public hearing until March 26

21 March 2025

Artificial Intelligence (AI),machine learning with data mining technology on virtual dachboard.Double Exposure,Businessman hand working concept. Documents finance graphic chart

The Spanish Government has published the Preliminary Draft Act for the proper use and governance of Artificial Intelligence (the "Draft Act"), which aims to complement and develop the framework set out by the AI Regulation. In this context, a Public Hearing and Information period has started, and is open from March 18 to March 26, 2025, during which allegations and comments may be submitted by interested parties.

Main changes with respect to the EU AI Act

The Draft Act introduces relevant measures in relation to surveillance, penalties and statutes of limitations, among other aspects. It is worth mentioning the following:

Surveillance and sanctioning authorities

The Spanish Artificial Intelligence Supervisory Agency (AESIA) is designated as the main authority for the supervision and sanctioning of prohibited and high-risk AI systems in various sectors.
The Spanish Data Protection Agency (AEPD) (or the autonomous communities’ data protection authorities) will supervise AI systems that entail profiling for crime prediction purposes, certain systems involving processing biometric data as well as systems used in the field of law enforcement (e.g., polygraphs or evidence reliability measurement tools).
Other sector entities with oversight functions include the Bank of Spain, the National Securities Market Commission (CNMV) and the Directorate General of Insurance and Pension Funds (DGFSP).
In the event of insufficient resources of a sectoral authority, AESIA may assume its functions until the situation is resolved.

Procedure and penalties: quantity of fines and additional measures

Administrative procedure: a specific administrative procedure is introduced, different from the common regime of the Public Administrations. Preliminary actions (i.e., the investigation prior to the sanctioning procedure) are greatly reinforced.
Fines for infractions:

Severity of violation	Maximum Fine	Minimum Fine	Statute of limitation
Very serious (prohibited AI)	Up to 35 million; or 7% of global turnover	Up to 500,000 euros; 1% of global turnover	5 years
Very serious (high-risk AI)	Up to 15 million; or 3% of global turnover	7.5 million; or 2% of global turnover	5 years
Serious (different types of actors)	Up to 7.5 million; or 2% of global turnover	500,000 euros; or 1% of global turnover	3 years
Minor	Up to 500,000 euros; 1% of global turnover	6,000 euros; or 0.5% of global turnover	1 year

Provisional measures:
- Adaptation of the AI system to comply with regulations.
- Prohibition of commercialization.
- Recalls and public warnings.
- Destruction of the AI system in extreme cases.
Publication of penalties: Final fines will be published and communicated to the European Commission.
(Civil?) Damage redress: Supervisory authorities will have the possibility to determine the damage and set indemnities in favor of the affected parties, which could considerably increase the economic liability of the responsible parties.

How to participate in the public hearing?

The allegations may be sent to the following e-mail address: tramitacion.dgdia@digital.gob.es indicating in the subject line: "Audiencia pública APL buen uso y gobernanza IA – Alegaciones [name or company name]".

The public hearing will be open until March 26 at 23:59.

Authored by Santiago de Ampuero, Juan Ramón Robles, and Cristina Barón.