AESIA, Spain's Agencia Española de Supervisión de la Inteligencia Artificial, was created by Royal Decree 729/2023 and has been operational since June 2024. It has published a full set of 16 technical guides for Regulation (EU) 2024/1689, the EU AI Act. AESIA is the EU's first dedicated national AI supervisory body to have operated at full capacity. The guides address obligations that apply to deployers of high-risk AI systems from 2 August 2026.
Article 26 of Regulation (EU) 2024/1689 imposes obligations on deployers of high-risk AI systems, including risk management, human oversight measures, and record-keeping. The 16 AESIA guides map to the high-risk AI categories listed in Annex III of the AI Act. Those categories cover biometric identification, critical infrastructure, education, employment, essential services, law enforcement, migration and border management, and administration of justice. Article 5 prohibitions covering unacceptable-risk AI practices have been enforceable since 2 February 2025.
Developers and deployers of high-risk AI systems operating in Spain must register systems in the EU AI Act database by 2 August 2026. The AESIA guides provide conformity assessment checklists, technical documentation requirements, and risk management specifications aligned with Articles 9 through 17 of the AI Act. SMEs and start-ups may use the guides to self-assess before mandatory registration. AESIA's regulatory sandbox, which admitted 12 companies in April 2025, is a formal pre-deployment testing mechanism.
Spain's government approved a draft Organic Law on the proper use and governance of artificial intelligence in May 2026. That law will supplement EU-level obligations with national enforcement provisions and specific penalties. The maximum EU AI Act penalty for the highest tier of violation reaches EUR 35 million or 7 percent of global annual turnover. The AESIA guides carry no direct legal obligation. Non-compliance with the underlying AI Act provisions they address carries penalties from 2 August 2026, once Article 26 deployer requirements apply.
Licentium advises on EU AI Act obligations and maintains a partner network of advisers across EU member states, including Spain. Organisations assessing their Annex III classification, preparing for 2 August 2026 deployer obligations, or engaging with AESIA's regulatory sandbox may contact us. Work we undertake includes high-risk AI system classification, conformity assessment preparation, AI Act data governance reviews, and regulatory sandbox applications.
Source: AESIA, Practical Guides for AI Act Compliance, aesia.digital.gob.es, accessed 30 June 2026