Worldwide Regulatory Monitor for Artificial Intelligence

The Spanish government has taken a significant step towards regulating artificial intelligence (AI) by enacting Royal Decree 817/2023, which sets up the first European regulatory sandbox for AI, known as the RD Sandbox. This move is part of a broader effort to establish a comprehensive AI regulatory framework in Spain.

The RD Sandbox and AI Oversight

The RD Sandbox, managed by AESIA (Agencia Española de Supervisión de Inteligencia Artificial), operational since June 2024, allows high-risk or general-purpose AI systems to be tested under a safe environment. AESIA will act as Spain's central market-surveillance authority for AI, with inspection and full sanctioning powers once the EU AI Act and the national AI law are fully in force.

The Artificial Intelligence Advisory Council

The Artificial Intelligence Advisory Council provides guidance to the government on the design and dissemination of AI policies. The council contributes to the development of the National Artificial Intelligence Strategy and the analysis of its implications.

Cross-Sectoral AI Regime

Spain's forthcoming AI regime is cross-sectoral, applying horizontally to all economic sectors and public-sector bodies. Common elements across regional frameworks include safeguards for algorithmic transparency and oversight, support for research and innovation ecosystems, integration of AI into public services, and mechanisms to prevent bias and ensure accountability in automated decision-making.

Risk-Based AI Governance

The Spanish AI framework adopts a risk-based model, dividing AI systems into four tiers: unacceptable risk (prohibited), high risk (subject to detailed compliance obligations), limited risk (mainly transparency duties), and low or minimal risk (not subject to new obligations beyond existing law).

Alignment with EU AI Act

Spain’s approach aligns closely with the EU AI Act by integrating the common EU regulatory framework, enforcement mechanisms, and sanctioning powers for non-compliance starting August 2025. This includes the capacity for authorities to demand corrective actions or market withdrawal for AI systems that are unlawful or risky.

Implementation of the Draft Spanish AI Law

A first draft of the Spanish AI law, known as the 'Good Use and Governance of Artificial Intelligence', was approved by Spain's Council of Ministers on March 11, 2025. The law is expected to apply throughout Spain and govern any AI system that is placed on the Spanish market, put into service or used in Spain, or produces effects in Spain.

Cooperation with Sector-Specific Regulators

Several sector-specific regulators are involved in AI oversight in relation to their fields, such as data protection, competition, finance, labor, and healthcare. Spain subscribes to international soft law instruments, such as the OECD Principles on Artificial Intelligence.

Exclusions and Definitions

There are certain exclusions in relation to AI that is used for defense and national security, purely personal or household use, and R&D activities carried out in closed environments. The RD Sandbox contains definitions for AI system, High-Risk AI System, and general-purpose AI system.

Core Issues Addressed by Spanish AI Regulations

The forthcoming Spanish AI regulations address core issues such as risk identification, assessment, and mitigation, awareness and promotion of training, development, and responsible use of AI, advising and assisting society, collaboration with other authorities, creating real test environments, and supervising AI systems.

In summary, Spain’s Draft AI Law is being implemented in synergy with the EU AI Act’s enactment, adopting its supervisory and enforcement regime with an emphasis on robust market surveillance, corrective measures, and sanctions against violators—marking Spain’s full incorporation of this pioneering EU legislation as of August 2, 2025.

The RD Sandbox, operational since June 2024, is a significant step in the international legal landscape of artificial intelligence (AI) regulation, managed by AESIA, Spain's central market-surveillance authority for AI.
The Spanish government's AI regulatory framework seeks recognition globally, with the RD Sandbox serving as the first European regulatory sandbox for AI, known as the RD Sandbox.
The Artificial Intelligence Advisory Council, a key part of the Spanish AI practice, provides guidance to the government on various aspects of AI policy design and dissemination.
Spain's cross-sectoral AI regime, encompassing all economic sectors and public-sector bodies, is designed to ensure general-news alignment with international standards, including safeguards for transparency and prevention of bias in automated decision-making.
In the finance industry, compliance with the upcoming AI regulations will be crucial for firms to maintain their corporate services and continue providing intellectual property solutions for their clients without disruption.
The proposed Spanish AI law, known as the 'Good Use and Governance of Artificial Intelligence', addresses core issues such as litigation involving AI systems and the need for education-and-self-development to ensure the responsible use of AI in the legal and corporate world.
Internationally, Spain's AI regulations align closely with the EU AI Act, ensuring a harmonized regulatory landscape for arbitration and regional commerce by adopting common enforcement mechanisms, starting August 2025.
Whitecase, a leading global law firm, offers services to navigate clients through the complexities of this new AI regulatory environment, providing guidance on compliance and litigation strategies.
The sports industry, in particular, stands to benefit from increased transparency and accountability provided by the RD Sandbox, improving athletes' drive for excellence and fostering fair competition.
The Spanish AI regime will work in synergy with sector-specific regulators, including those responsible for data protection, competition, finance, labor, and healthcare, to ensure comprehensive oversight across various industries.
In accordance with the Spanish AI regulations, high-risk AI systems will face strict compliance obligations, while low or minimal-risk AI systems will be monitored to ensure they adhere to existing laws, promoting the safe and responsible use of AI within the legal, corporate, and broader industry landscape.

Worldwide Regulatory Monitor for Artificial Intelligence