Spain

Spain established AESIA — Europe's first dedicated public AI supervisory agency — through Royal Decree 729/2023, before the EU AI Act even entered into force, giving Spain the most advanced institutional implementation infrastructure in the EU

AESIA has published 16 practical compliance guides covering the full lifecycle of high-risk AI obligations, derived from real sandbox projects — the most comprehensive national implementation toolkit available from any EU authority

Spain's AI regulatory sandbox has tested real projects including health, employment and financial AI under regulatory conditions, producing applied institutional knowledge that no other member state has replicated at the same scale

Large enterprises use AI at 49.2% versus only 8.7% of SMEs — a 40-point adoption gap that is one of the largest enterprise-to-SME differentials in Europe, concentrating compliance risk exactly where governance capacity is weakest

The AEPD has already taken assertive positions on biometric processing, facial recognition impact assessments and AI-generated image content — creating a dual enforcement environment alongside AESIA before the AI Act's full enforcement cycle begins

Spain's compliance challenge has shifted from legal ambiguity to execution — companies know what is required more clearly than in most EU jurisdictions, but still lack the internal governance structures to implement it without external support