On 26 May, the Council of Ministers approved the draft Organic Law on the proper use and governance of artificial intelligence.
This law adapts the European Artificial Intelligence Regulation (the AI Act), in force since August 2024, into the Spanish legal system.
How are AI systems regulated?
The regulation classifies AI systems according to their potential risk to individuals’ fundamental rights, prohibits those that pose an unacceptable risk to people’s safety or health, and establishes the obligations that the remaining systems must comply with before being placed into service or made available on the European market.
Which systems are prohibited?
In addition to the systems classified as prohibited under the AI Act, the following are also prohibited:
- Systems that use subliminal or manipulative techniques.
- Systems that exploit the vulnerabilities of a person or group.
- Systems that evaluate or classify individuals, such as social scoring systems.
- Systems that assess the risk of a person committing a criminal offence.
- Systems that create or expand facial recognition databases.
- Systems that infer emotions in the workplace or in educational settings.
- Systems that classify individuals biometrically on the basis of race or political, religious or sexual orientation.
- Systems that carry out real-time biometric identification in public spaces.
At the request of Spain and with the support of France, on 7 May the European Union agreed to add two further prohibited systems:
- Systems that generate sexual deepfakes.
- Systems that generate child sexual abuse material.
Sanctions regime
Sanctions may reach up to €35 million or 7% of annual turnover in the most serious cases, and up to €500,000 or 0.5% of annual turnover for minor infringements.
The application of sanctions is adapted according to the seriousness, intentionality or recurrence of the infringement, as well as the size of the company, and includes mechanisms that prioritise correction over punishment.
However, the sanctions provided for in the Law are not limited to the imposition of fines. The Law also introduces the right to disconnect or withdraw from the market AI systems that have caused serious incidents, such as the death of a family member.
How to comply with the regulation
The main key to complying with AI regulations and avoiding sanctions is knowledge. It is important to understand the purpose for which AI systems are used within an organisation. This makes it possible to classify them according to their level of risk —minimal, limited, high-risk or prohibited— and to apply the compliance measures required by the regulation.
Our specialised AI Service is designed to support professionals and organisations in the implementation and safe use of artificial intelligence systems, ensuring that technology is used as a reliable support tool, under human supervision and in compliance with the European Artificial Intelligence Regulation.
We carry out a comprehensive assessment of Artificial Intelligence systems in order to classify them according to their risk level and establish the relevant control measures, helping organisations comply with all obligations under the AI Act, as well as with the recommendations of the Spanish Artificial Intelligence Supervisory Agency.
