From the journal

Spain Approves AI Governance Bill and Sends It to Parliament, May 26, 2026

Spain's Council of Ministers approved the Proyecto de Ley para el buen uso y la gobernanza de la inteligencia artificial on May 26, 2026, and submitted it to the General Courts under urgent procedure. The bill transposes Regulation (EU) 2024/1689 (EU AI Act) into domestic law, designates a national supervisory authority, creates an AI delegate role across public bodies, and governs regulatory sandboxes under Article 57 of the EU AI Act.

2 min read

Spain's Council of Ministers approved the Proyecto de Ley para el buen uso y la gobernanza de la inteligencia artificial on May 26, 2026. The bill is at the proposed/legislative stage: it has been submitted to the Spanish General Courts (Cortes Generales) under urgencia (urgent parliamentary procedure) for approval, shortening standard inter-ministerial and Council of State review timelines.

The bill transposes Regulation (EU) 2024/1689 (EU AI Act) into Spanish domestic law, adapting obligations for AI system providers, deployers, and importers to the national legal order. Article 2 of the bill designates a national supervisory authority to exercise market surveillance and enforcement powers under Articles 70 to 77 of the EU AI Act. The bill also introduces a delegado de IA (AI delegate) in each state public body, responsible for overseeing responsible AI deployment, and defines the governance of Spanish regulatory sandboxes under Article 57 of the EU AI Act.

AI system providers placing products on the Spanish market, deployers of general-purpose AI models in Spain, and public-sector bodies procuring AI tools must prepare for domestic enforcement once the bill is enacted. Spanish entities already subject to EU AI Act prohibited practices (in force from February 2, 2025) and governance rules (in force from August 2, 2025) will need to account for the domestic enforcement authority structure the bill creates.

The bill follows the March 2025 Anteproyecto de Ley, which underwent public consultation. Processing under urgencia shortens the timeline for parliamentary debate. Key open points before enactment include the formal designation of the national competent authority and the resourcing plan for the delegado de IA role across multiple public bodies.

We may advise on EU AI Act compliance and Spanish transposition requirements, and have partner counsel in Spain for direct engagement with the regulatory process. Organizations affected by the Spanish AI governance bill are invited to contact us to discuss compliance positioning. Work we undertake includes EU AI Act compliance roadmaps, high-risk AI system conformity assessment, national authority engagement, and AI governance advisory.

Source: La Moncloa, Consejo de Ministros, Proyecto de Ley para el buen uso y la gobernanza de la inteligencia artificial, May 26, 2026

AI Regulatory

More from the journal

See all
Illia Prokopiev

From Cloud Concentration to AI Dependence: The UK’s Critical Third Parties Regime

The United Kingdom now directly oversees designated technology suppliers whose service failures could threaten financial stability. The question is whether the first cloud designations show a legal expansion toward AI-model providers, and what the present regime requires. This analysis assumes the quoted statement concerns the UK financial-services Critical Third Parties regime and assesses the law through 14 July 2026.

Alberta Regulated iGaming Market Launched on 13 July 2026 with 22 Operators

Alberta's regulated private iGaming market launched on 13 July 2026, making Alberta the second Canadian province to permit private online gambling operators after Ontario. The Alberta Gaming, Liquor and Cannabis Commission serves as market regulator and the Alberta iGaming Corporation oversees commercial operations and operator contracts. Twenty-two operator sites went live on day one, including FanDuel, DraftKings, BetMGM, and BetRivers. Operators must fully launch or exit the Alberta market by 13 October 2026.

European Commission Presents Cybersecurity and AI Action Plan on 7 July 2026

On 7 July 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. The plan directs the Commission and ENISA to evaluate advanced AI models before they reach the EU market, establish a secure testing platform for critical-sector organisations, and launch an EU Grand Challenge on AI-powered cybersecurity solutions. It operates alongside the AI Act, NIS2 Directive, DORA, Cyber Resilience Act, and Cyber Solidarity Act, and introduces no new directly binding obligations.