Draft Organic Law on the Responsible Use and Governance of AI

The Draft Organic Law on the proper use and governance of artificial intelligence (AI) develops certain aspects of the European Artificial Intelligence Regulation (AI Act) in Spain. Its objective is to establish the national governance framework, designate the competent authorities, regulate AI regulatory sandboxes, provide for measures for the proper use of AI in the state public sector, and develop the applicable sanctions regime.

Draft Organic Law on the Responsible Use and Governance of AI

Watch video

Executive summary

The Draft specifies the Spanish model for the application of the AI Act, establishing a governance and market surveillance framework based on the designation of competent national authorities. Within this model, AESIA plays a central role as the market surveillance authority in certain areas, the single point of contact and the general coordination body.

The text also regulates the governance of AI regulatory sandboxes and establishes specific measures for the proper use of AI in the state public sector, including information obligations, an inventory of AI systems, training and the designation of an AI officer. In addition, it develops the national sanctions regime, classifying infringements as very serious, serious and minor, and providing for financial penalties, ancillary measures and provisional measures.

The deadline for submitting amendments ended on 30 June 2026. The Draft will continue its parliamentary process until the final approval of the law.

Main content

The Draft Organic Law is structured around four main blocks:

• Governance and supervision. The Directorate-General for Artificial Intelligence is designated as the notifying authority, and the competent market surveillance authorities are identified according to the material scope of the AI system. The model combines authorities specialized by sector with a central role for AESIA, which acts as the market surveillance authority in certain areas, the single point of contact and the general coordination body. Coordination mechanisms between authorities, a single point of entry for complaints and protection for reporting persons are also provided for.
• AI regulatory sandboxes. The Draft establishes the governance framework for the regulatory sandboxes provided for in the European Artificial Intelligence Regulation. AESIA will be the competent authority responsible for the mandatory sandbox, and additional sandboxes may be created by competent authorities within their respective areas of competence. The responsible authorities must inform the AI Office and the AI Board, demonstrate sufficient resources, submit annual reports and make them public once the sandbox becomes operational.
• Proper use of AI in the state public sector. Information obligations are introduced regarding the use of AI systems in the exercise of public functions, and the creation of an inventory of AI systems for the state public sector is provided for, interoperable with the European register of high-risk AI systems. The Draft also includes awareness-raising, dissemination and training measures, as well as the designation of an AI officer in each state public sector entity.
• Infringements and sanctions. The national sanctions regime is developed, classifying infringements as very serious, serious and minor. Very serious infringements include the placing on the market, putting into service or use of AI systems that constitute prohibited practices, as well as the failure to report serious incidents in certain cases. The regime provides for financial penalties, ancillary measures and provisional measures, including the withdrawal of the product, the disconnection of the AI system or its prohibition, where applicable.

Download the technical note on the Draft Organic Law on the Responsible Use and Governance of AI (also available in Spanish).