Skip to content
Montevive
Blog

News

AI Act in Spain: the national bill has lapsed and the timeline holds

·Rubén Sánchez Iruela·Artificial Intelligence, Regulation
AI Act in Spain: the national bill has lapsed and the timeline holds

In short. Spain's draft Organic Law on the good use and governance of artificial intelligence lapsed on 6 October 2026, when Parliament was dissolved. Regulation (EU) 2024/1689, known as the AI Act, still applies in Spain without that law. What is missing is the national piece: which authority supervises each case, and under what regime of infringements and penalties.

The bill never got past the amendment stage. Its deadline had been extended six times, and the last extension ran until 7 October, one day after the dissolution. For a company, that does not move a single AI Act date in Spain, but it leaves open what the AI Act asks each country to decide.

We covered what the AI Act requires and what its fines really cost in our guide to AI Act obligations and fines. This piece covers the Spanish side and the real timeline, as of 23 October 2026.

Original chart · Montevive. Sources: Regulations (EU) 2024/1689 and 2026/1744, Congress file 121/000096 and Royal Decree 806/2026. As of 23 October 2026.

What happened to Spain's AI law

The draft Organic Law on the good use and governance of artificial intelligence has been listed as "Concluded (Lapsed)" since 6 October 2026 in the record for file 121/000096 of the Congress of Deputies.

That day, the Official State Gazette (BOE) published Royal Decree 806/2026, which dissolved the Congress and the Senate. Under Article 207 of the Rules of the Congress, once the Chamber is dissolved, all business pending examination and decision lapses.

The Council of Ministers had approved the bill on 26 May 2026, and it was published in the Official Gazette of the Cortes Generales on 12 June. The amendment deadline was 30 June and it was extended six times.

The general election is on 29 November and the new Chambers will be constituted on 23 December. A new law would have to go through the whole process from scratch, and as of 23 October there is no timetable for one.

What still applies in Spain without a national law

The AI Act (Regulation (EU) 2024/1689) applies in Spain without any national law. Its Article 113 says so: the Regulation is binding in its entirety and directly applicable in all Member States. Prohibitions, AI literacy and transparency keep running on their own dates.

Nor does the Spanish law affect what Brussels supervises. The European Commission has exclusive powers over providers of general-purpose AI models (Article 88 of the AI Act) and can fine them (Article 101).

The GDPR does not change either. Article 2(7) of the AI Act leaves it untouched except on two points: sensitive data processed to correct bias (Article 4a) and regulatory sandboxes (Article 59). If an AI tool processes personal data, the Spanish Data Protection Agency (AEPD) acts as it always has.

What is still pending in Spain: who supervises and with what penalties

Since 2 August 2025, Article 99(1) of the AI Act (Regulation (EU) 2024/1689) has required each Member State to lay down the rules on penalties. In Spain, those rules were in the bill that has just lapsed.

The bill split supervision between the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), as the main authority, the AEPD, the General Council of the Judiciary (CGPJ) and financial and sectoral supervisors (Article 5).

It also classified infringements as very serious, serious and minor (Article 30). Those involving prohibited practices could reach, as under the AI Act, EUR 35 million or 7% of worldwide turnover. Minor ones, a tier the EU regulation does not have, could reach EUR 500,000 or 0.5%.

When it approved the bill, the Government explained why a law was needed: the power to impose penalties requires a rule with the rank of law that defines the infringements and sets the penalties and the procedure. That is what Articles 25 and 27 of Law 40/2015 require.

That leaves an open legal question: how a case for breaching the AI Act would be handled in Spain today. The answer depends on the obligation, the operator and the authority, and we are not going to pretend it is settled here.

What the lapse does not mean

  • Public administrations are not exempt from fines. Article 39 of the bill, which replaced fines with warnings and corrective measures, lapsed with the rest of the text.
  • The next law does not have to copy the one that lapsed. A new Parliament can allocate powers or grade penalties differently.

What the Omnibus changed in AI literacy and transparency

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July. It rewrote Article 4 of the AI Act, the AI literacy article, without changing its date.

Since then, Article 4 has said that providers and deployers shall take measures to support the promotion of AI literacy among their staff. They must take into account their knowledge and experience, the context of use and the people affected.

The Regulation adds that this obligation does not require providers or deployers to guarantee a specific level of AI literacy for any particular person. Before, they had to ensure, to their best extent, a sufficient level.

In practice, what Article 4 now asks for is measures taken by the company, matched to each profile. How to apply it team by team is in our guide to Article 4 (in Spanish).

On transparency, Article 50 splits the work. The provider must make sure people know they are talking to an AI and must mark synthetic content in a machine-readable format (paragraphs 1 and 2).

The deployer must inform people exposed to an emotion recognition or biometric categorisation system (paragraph 3). It must also disclose deepfakes and generated text that informs the public on matters of public interest, unless that text has gone through human review with editorial responsibility (paragraph 4).

The grace period until 2 December 2026 only covers the marking in paragraph 2. And it only applies to providers of generative systems placed on the market before 2 August 2026 (Article 111(4)).

If your company only uses AI, that grace period does not cover it: its obligations under paragraphs 3 and 4 have applied since 2 August 2026.

How the AI Act timeline in Spain looks, date by date

With the Omnibus in force, the AI Act (Regulation (EU) 2024/1689) timeline looks like this for a company that uses AI:

DateWhat starts to applyDoes it affect you if you only use AI?
2 Feb 2025Prohibited practices (Art. 5) and AI literacy (Art. 4)Yes, both
2 Aug 2025General-purpose AI models, governance and the penalties chapterThe models, no: they belong to their providers. The penalties, everyone
27 Jul 2026The Omnibus enters into force, with the new wording of Art. 4Yes: it changes how AI literacy is met
2 Aug 2026General application, including Art. 50 transparencyYes, in the cases of paragraphs 3 and 4
2 Dec 2026Two new prohibitions, non-consensual intimate content and child sexual abuse material (two new points in Art. 5(1)), and end of the labelling grace period (Art. 111(4))The prohibitions, yes; the grace period is your provider's
2 Aug 2027General-purpose models placed on the market before 2 Aug 2025 (Art. 111(3))Not directly
2 Dec 2027Annex III high-risk: employment, education, credit or essential services, among othersYes, if you use AI in those areas (Art. 26)
2 Aug 2028Annex I high-risk: AI in regulated productsDepends on the product and its sector rules

For high-risk systems, those already on the market or in service before their date are only caught if their design changes significantly afterwards (Article 111(2)). Those intended for use by public authorities have until 2 August 2030.

What to do now if your company uses AI

  1. Take an inventory of real uses, not licences: which tool, for what, with what data and who supplies it. It is also the deliverable of the AI Act assessment in our compliance and governance service: we classify it by risk level, and the work takes two to four weeks.
  2. Set your role in each system, provider or deployer: that determines which paragraphs of Article 50 apply to you.
  3. Review AI literacy against the new wording of Article 4: measures by profile and context of use. The article does not require a record, but without one it is hard to show what you did if someone asks. That named record, of who was trained, on what and when, is what noshadow, our AI literacy and certification product, produces.
  4. Ask your generative AI providers how they mark content and whether they will be ready by 2 December 2026.
  5. If you use AI in recruitment, educational assessment, credit or insurance, classify those uses now, with 2 December 2027 as the date.

Frequently asked questions

Does the lapse of the Spanish law delay the AI Act in Spain?

No. The AI Act is an EU regulation that applies directly. Its dates are set by Regulation (EU) 2024/1689 and the Digital Omnibus, Regulation (EU) 2026/1744, not by Spanish law.

Can the lapsed bill be picked up again after the election?

Not as it stands. Article 207 of the Rules of the Congress declares pending business lapsed when the Chamber is dissolved. A new initiative will have to be tabled in the legislature that starts on 23 December 2026.

What changes on 2 December 2026 for a company that only uses AI?

Two new prohibitions apply: systems that generate realistic intimate or sexually explicit content of an identifiable person without their consent, and systems that generate child sexual abuse material. For users of the tool, the prohibition covers using it for that purpose (new paragraph 1a of Article 5 of the AI Act). The providers' labelling grace period also ends that day.

Are Spanish public administrations exempt from fines?

The rule that provided for it was Article 39 of the lapsed bill, and it fell with it. The AI Act lets each Member State decide whether public authorities and bodies can be fined (Article 99(8)), so that decision is open again in Spain.

Sources

All checked on 23 October 2026. Official texts are linked in their Spanish editions; quotations from them in this article are our translation.

Does the AI Act affect your company, and how? Tell us which AI tools your team uses and we will reply within 24 hours.

This article reflects the situation as of 23 October 2026. It is for information only and is not legal advice.

Back to blog