AI disclosure requirements in Spain: what applies since 2 August 2026
The EU AI Act's transparency obligations are a Union-wide regulation, so the substance is the same in Spain as everywhere in the EU: from 2 August 2026, AI systems that interact with people must disclose they're AI, synthetic media must carry machine-readable marking, and deepfakes and certain AI-generated public-interest text must be labeled. What differs country by country is who enforces it, in what language your users encounter it, and how quickly complaints turn into questions.
Enforcement in Spain
Spain moved earliest of any member state: AESIA (Agencia Española de Supervisión de la Inteligencia Artificial) has been operational since June 2024, the EU's first dedicated AI supervision agency, and has published a substantial body of practical compliance guidance while running an active regulatory sandbox programme. The national implementing law (the ley para el buen uso y la gobernanza de la IA, first drafted March 2025) was approved by the Council of Ministers as an Organic Bill on 26 May 2026 and is now before Parliament. Supervision splits by domain: AESIA as the general AI authority, the AEPD where personal data is central, and other bodies in their spheres. Article 50 applies from 2 August 2026 with penalties up to €15M or 3% of worldwide turnover; the Spanish bill adds a national sanctions regime on top.
The four duties, as they show up on your site
- Article 50(1): chatbot disclosure
- Any AI system interacting with visitors must make that clear no later than the first interaction, in a clear and distinguishable way.A line in your terms doesn't satisfy it.
- Article 50(2): machine-readable marking
- AI-generated audio, images, video, and text must be marked in a machine-readable, detectable format.For generative systems already on the market before 2 Aug 2026, this specific duty has a transition until 2 Dec 2026; the rest does not.
- Article 50(3): emotion recognition & biometric categorisation
- People exposed must be informed the system is operating.
- Article 50(4): deepfake and AI-text labels
- Visible disclosure for deepfakes, and for AI-generated or manipulated text published to inform the public on matters of public interest.
Spain-specific practicalities
- AESIA exists now, is staffed now, and publishes practical guides, Spain is the member state where 'the regulator isn't ready' is least true; assume supervision starts on time
- The Spanish bill in Parliament carries its own sanctions framework for transparency failures, on top of the EU ceiling, undisclosed chatbots and unlabelled AI media are named concerns in the public drafts
- If personal data is central to your AI feature, the AEPD (data protection authority) shares the supervisory lane with AESIA, GDPR-style complaint routes apply
- Spanish-language disclosure matters commercially and legally: serve the notice in the language of the storefront, and keep the Spanish-language screenshot in your evidence file
Disclosure language should match your user-facing language. For a site serving Spain in Spanish, a first-message line such as "Estás chateando con un asistente de IA" (you're chatting with an AI assistant) is the pattern to aim for, at first interaction, not in the aviso legal.
Common questions
Is Spain's national AI law in force?
Not yet at the time of review: the Council of Ministers approved it as an Organic Bill on 26 May 2026 and sent it to Parliament. But AESIA is already operational and Article 50 of the EU regulation applies directly from 2 August 2026, waiting for the Spanish law to pass does not delay the disclosure duties.
Does AESIA publish anything we can follow?
Yes, AESIA has been the most productive AI authority in the EU, with a series of practical compliance guides and an active sandbox programme. If you serve Spanish users, its published expectations are the closest thing to a preview of how Article 50 supervision will feel in practice.