EU AI Act compliance guide for Spain

Spain's technology sector has grown rapidly over the past decade, with Barcelona and Madrid emerging as top-tier AI startup destinations in Europe. Spanish startups building AI-powered products for healthcare, retail, legal tech, and financial services face a clear compliance calendar under the EU AI Act. GPAI model obligations and Article 50 transparency requirements apply from August 2, 2026. Annex III high-risk systems must be compliant by December 2, 2027. Spain's national supervisory authority under the AI Act is the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), which became operational in 2024 and has since been building its enforcement capacity. For CTOs in Spain, the compliance challenge is real and the timeline is shorter than it appears.

What the EU AI Act requires

The EU AI Act creates risk tiers based on the system's use case and potential for harm. Article 6, combined with Annex III, defines high-risk AI systems across eight domains including employment, education, financial services, and critical infrastructure. If your AI product operates in any of these areas, Articles 9 to 17 require you to implement a risk management system, meet data governance standards, maintain technical documentation, provide transparency to users, enable human oversight, and operate a quality management system. For startups offering or deploying general-purpose AI models, Articles 53 and 55 add specific requirements around technical transparency, copyright policy, and safety testing. Article 50 requires AI-generated content to be clearly labelled, with obligations starting August 2, 2026. This is particularly relevant for Spanish startups in content creation, legal document generation, and customer communications.

What this means for your business

Spain's AI sector has notable strength in retail personalisation, legal tech automation, and healthcare AI, all of which intersect with Annex III categories. A recommendation engine used to make consequential decisions about product pricing or access could qualify as high-risk depending on its context. A legal document drafting tool using AI output that is not clearly labelled would breach Article 50 from August 2026. Spanish startups building on OpenAI, Anthropic, or European foundation models also face downstream obligations under Article 25: if the model provider has not fully addressed its Article 53 obligations, you as the deployer must fill the gap. AESIA has published early guidance indicating that it will prioritise enforcement in healthcare and employment AI, which should sharpen compliance priorities for startups in those sectors.

Steps to get compliant

1. Classify your AI features against the regulatory framework: Use Article 5 (prohibited practices) and Annex III (high-risk categories) to determine the regulatory status of every AI feature in your product. Document your reasoning. This classification determines your entire compliance roadmap.

2. Address August 2026 deadlines first: If you use or offer GPAI models, prepare to meet Article 53 obligations by August 2, 2026. Audit every AI-generated output visible to users and implement Article 50 labelling before the deadline. AESIA has signalled early enforcement activity on transparency obligations.

3. Prepare technical and risk documentation: Article 11 requires technical documentation before deployment of high-risk systems. Article 9 requires a live risk management process. Begin building these now: system description, data provenance, performance metrics, known limitations, and human oversight protocols are all required components.

4. Engage with AESIA guidance: Spain's AESIA has been publishing sector-specific guidance for AI in healthcare and employment. Review current guidance relevant to your product category and factor it into your compliance approach. AESIA has a sandbox programme for innovative AI products that may offer a structured path to compliance for early-stage startups.

Free EU AI Act risk assessment

Not sure where your AI system stands? The free ActComply risk screener classifies your system in under 5 minutes. No sign-up required.