Spain's New AI Law: Strict Rules and Million-Dollar Fines 2026

Spain has finally approved its long-awaited AI law, but it's not designed to incentivize artificial intelligence—it's meant to regulate it and impose million-euro sanctions. The new Organic Law for the Good Use and Governance of Artificial Intelligence adapts Spanish legislation to the European Union's AI Act framework, establishing a series of obligations and prohibitions based on the risk classification of these systems.

The norm introduces mandatory human oversight for high-risk systems and extends responsibility beyond the company deploying these systems to include those who use them. This marks a significant shift in how AI accountability is understood in Spain.

What the New AI Law Entails

The law categorizes AI systems by risk level, with stricter requirements for higher-risk applications. High-risk systems must have human supervision, and responsibility now reaches not only developers but also deployers and users. This broadens the scope of liability considerably.

For businesses, this means that if you use an AI system classified as high-risk without proper human oversight, you could face severe penalties. The law aims to ensure that AI is used responsibly and transparently across all sectors.

Penalties and Sanctions

The sanctions regime is tiered, with fines escalating based on the severity of the infraction. For minor violations, such as failure to cooperate with authorities, fines start at €6,000 and can go up to €500,000 or 0.5% of total revenue.

More serious infractions carry fines of up to €15 million or 3% of global revenue when high-risk systems are used without human supervision. The most severe cases can result in fines of up to €35 million or 7% of worldwide turnover.

• Minor violations: Fines from €6,000 to €500,000 or 0.5% of revenue.
• Serious violations: Fines up to €15 million or 3% of global revenue.
• Very serious violations: Fines up to €35 million or 7% of global revenue.
• Human oversight: Mandatory for high-risk AI systems.
• Extended liability: Responsibility reaches deployers and users.

The Double Standard Controversy

A major point of contention is that these fines do not apply when the administration itself violates the norm. If, for example, the police or a ministry uses an AI system classified as prohibited, the law provides for warnings and disciplinary actions, but no fines.

The government defends this by claiming it has "raised the bar of self-demand" with transparency measures, including the creation of a supervisory authority. However, critics argue that this creates an uneven playing field and undermines public trust.

Comparison of Sanctions

What This Means for Businesses and Users

Companies deploying AI in Spain must now conduct thorough risk assessments and ensure compliance with the new obligations. The extended liability means that even users of AI systems can be held accountable if they fail to adhere to the rules.

This could lead to increased due diligence when adopting AI tools, especially in sectors like finance, healthcare, and law enforcement. Businesses may need to invest in oversight mechanisms and documentation to demonstrate compliance.

Implications for the Tech Industry

The law is part of a broader European trend to regulate AI, following the EU AI Act. Spain's approach is one of the first national implementations, and it could set a precedent for other member states.

While the government argues that the law provides legal certainty, some industry players worry that the heavy fines and extended liability could stifle innovation. Startups and smaller companies might find it challenging to meet the compliance requirements. The background to this story is set out in Swiss Voters Reject Strict Neutrality Rules in Landslide Vote. A related thread runs through AI Safety Regulation: Can Rules Stop AI Systems Killing Us. Earlier coverage in Wooden Shelves Designed with Artificial Intelligence shows how the argument developed.

What to Watch Next

The law still needs to go through the parliamentary process, and details may change. The creation of the supervisory authority and its enforcement practices will be crucial in determining how the law is applied in practice. A closer look at the same subject appears in Extremadura Approves Long-Awaited Zafra-Jerez Road, But Not a Motorway. Anyone following the wider picture can start with AI Regulation in Australia: Why OpenAI and Anthropic Support. The same theme surfaces in AI Regulation Gap: Why AI Needs Stronger Oversight Now, which takes a different angle.

Additionally, the double standard for public administrations may face legal challenges or political pressure. How the government addresses these concerns will shape the law's legitimacy. Context on how this played out before sits in Father Sets Strict Rules For His Son Who Just Moved Back Home After Graduating, Son Flips Out. A companion piece, Sydney Metro Extension Opens: Long-Awaited Southwest Line Launches, approaches the same subject from another angle.