Spain

Legal Framework

Spain applies the EU AI Act directly. Its Article 50 transparency duties have applied since 2 August 2026: providers must tell people when they are interacting with an AI system and mark generated content in a machine-readable way, and deployers must label deepfakes. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to add marking, and new bans on AI systems that generate non-consensual sexual deepfakes or child sexual abuse material apply from the same date (Digital Omnibus on AI, Regulation (EU) 2026/1744). Rules for Annex III high-risk systems now apply from 2 December 2027. At EU level, the Commission said on 12 October 2026 that its AI Office has requested and received serious incident reports on recent loss-of-control incidents and will send further requests for information to the companies that developed the models involved. On 14 October 2026, Executive Vice-President Henna Virkkunen said the AI Office has started enforcing the AI Act's rules for general-purpose AI providers and has sent requests for information "addressing issues such as security, external evaluation and monitoring how models are used". None of these Commission statements addresses companies that deploy those models. In October 2026 the Official Journal cited EN 18286:2026, a quality management system standard, as the first harmonised standard supporting the AI Act; CEN-CENELEC says it gives providers of high-risk AI systems a route to a presumption of conformity with the Act's Article 17 quality management requirements. Spain set up a national AI supervisor before the AI Act applied: the Spanish Agency for the Supervision of Artificial Intelligence (Agencia Española de Supervisión de Inteligencia Artificial, AESIA), whose statute was approved by Royal Decree 729/2023 of 22 August 2023. Royal Decree 817/2023 of 8 November 2023 created a controlled testing environment (sandbox) for checking AI systems against the AI Act's requirements. Spain has not yet passed the law that designates its AI Act authorities and sets its sanctions. The government's Organic Law bill on the good use and governance of artificial intelligence, presented to the Congress of Deputies on 28 May 2026, would have given AESIA most uses not covered by product legislation, such as employment, biometrics and education, alongside the Spanish Data Protection Agency (AEPD) and the General Council of the Judiciary (CGPJ) in their own areas, with AESIA as the single point of contact. The bill lapsed on 6 October 2026, when the Cortes were dissolved ahead of the general election on 29 November 2026 (Royal Decree 806/2026). The AEPD enforces GDPR and has published guidance on AI and automated decision-making. Spain's National AI Strategy was updated as the 2024 AI Strategy, approved by the Council of Ministers in May 2024. Sources: https://eur-lex.europa.eu/eli/reg/2026/1744/oj ; https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act ; https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations ; https://digital-strategy.ec.europa.eu/en/news/special-meeting-ai-scientific-panel ; https://www.boe.es/buscar/act.php?id=BOE-A-2023-18911 ; https://www.boe.es/buscar/act.php?id=BOE-A-2023-22767 ; https://www.congreso.es/public_oficiales/L15/CONG/BOCG/A/BOCG-15-A-97-1.PDF ; https://digital.gob.es/comunicacion/notas-prensa/mtdfp/2026/05/el-gobierno-aprueba-el-proyecto-de-ley-que-garantizara-una-super ; https://www.congreso.es/es/proyectos-de-ley?_iniciativas_id=121%2F000096&_iniciativas_legislatura=XV&_iniciativas_mode=mostrarDetalle&p_p_id=iniciativas&p_p_lifecycle=0&p_p_mode=view&p_p_state=normal ; https://www.boe.es/eli/es/rd/2026/10/05/806 ; https://ec.europa.eu/commission/presscorner/api/files/document/print/en/speech_26_2150/SPEECH_26_2150_EN.pdf ; https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-10-15-en-18286-2026-published-in-ojeu

Key Laws & Regulations

• ◆EU AI Act (Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744)
• ◆GDPR (LOPDGDD)
• ◆Royal Decree 729/2023 (AESIA statute)
• ◆Royal Decree 817/2023 (AI sandbox)
• ◆Capital Companies Act (Royal Legislative Decree 1/2010)
• ◆Law 18/2022 on business creation and growth
• ◆Startup Law (Law 28/2022)

Business Formation

SL (Sociedad Limitada) is the standard entity. Since Law 18/2022 on business creation and growth, an SL can be formed with share capital of EUR 1. While its capital is below EUR 3,000, at least 20% of profit must go to the legal reserve until capital plus reserve reach EUR 3,000, and if the company is wound up without enough assets to pay its debts, the partners are jointly liable for the shortfall up to EUR 3,000. The Startup Law (Law 28/2022) offers tax benefits for qualifying startups and a visa for remote workers (digital nomads). Sources: https://www.boe.es/buscar/act.php?id=BOE-A-2010-10544 ; https://www.boe.es/buscar/act.php?id=BOE-A-2022-15818

Tax Implications

Standard corporate tax rate is 25%, with a reduced 15% rate for newly created companies in their first two profitable years. Startup Law provides additional tax benefits for qualifying startups.