AI disclosure requirements in Spain: what applies from 2 August 2026

The EU AI Act's transparency obligations are a Union-wide regulation, so the substance is the same in Spain as everywhere in the EU: from 2 August 2026, AI systems that interact with people must disclose they're AI, synthetic media must carry machine-readable marking, and deepfakes and certain AI-generated public-interest text must be labeled. What differs country by country is who enforces it, in what language your users encounter it, and how quickly complaints turn into questions — which is what this page covers for Spain.

Enforcement in Spain

Spain moved earliest of any member state: AESIA (Agencia Española de Supervisión de la Inteligencia Artificial) has been operational since June 2024 — the EU's first dedicated AI supervision agency — and has published a substantial body of practical compliance guidance while running an active regulatory sandbox programme. The national implementing law (the ley para el buen uso y la gobernanza de la IA, first drafted March 2025) was approved by the Council of Ministers as an Organic Bill on 26 May 2026 and is now before Parliament. Supervision splits by domain: AESIA as the general AI authority, the AEPD where personal data is central, and other bodies in their spheres. Article 50 applies from 2 August 2026 with penalties up to €15M or 3% of worldwide turnover; the Spanish bill adds a national sanctions regime on top.

The four duties, as they show up on your site

• Article 50(1) — chatbot disclosure. Any AI system interacting with visitors must make that clear no later than the first interaction, in a clear and distinguishable way. A line in your terms doesn't satisfy it.
• Article 50(2) — machine-readable marking. AI-generated audio, images, video, and text must be marked in a machine-readable, detectable format. For generative systems already on the market before 2 Aug 2026, this specific duty has a transition until 2 Dec 2026 — the rest does not.
• Article 50(3) — emotion recognition & biometric categorisation. People exposed must be informed the system is operating.
• Article 50(4) — deepfake and AI-text labels. Visible disclosure for deepfakes, and for AI-generated or manipulated text published to inform the public on matters of public interest.

Spain-specific practicalities

• AESIA exists now, is staffed now, and publishes practical guides — Spain is the member state where 'the regulator isn't ready' is least true; assume supervision starts on time
• The Spanish bill in Parliament carries its own sanctions framework for transparency failures, on top of the EU ceiling — undisclosed chatbots and unlabelled AI media are named concerns in the public drafts
• If personal data is central to your AI feature, the AEPD (data protection authority) shares the supervisory lane with AESIA — GDPR-style complaint routes apply
• Spanish-language disclosure matters commercially and legally: serve the notice in the language of the storefront, and keep the Spanish-language screenshot in your evidence file

Disclosure language should match your user-facing language. For a site serving Spain in Spanish, a first-message line such as "Estás chateando con un asistente de IA" (you're chatting with an AI assistant) is the pattern to aim for — at first interaction, not in the aviso legal.

Common questions