Regulatory radar · updated on 6 Oct 2026
This radar tracks, with dates and official sources, the laws, guidance and deadlines that affect organisations using AI with sensitive data in Spain. The next major milestone is 2 December 2027, when the AI Act's high-risk obligations apply to credit scoring, insurance, justice and public services. We review it every two weeks and every entry links to the original document.
Upcoming deadlines
Deadlines and dates of application still to come.
All entries
Filter by sector to see only what affects your organisation. Each entry shows whether it is a Spanish or EU rule, its status and the official source.
Awards are expected in early 2027. Spain is bidding with a public-private candidacy. It signals where European compute capacity for training and running models will be located.
Official source: EuroHPC ↗
When creditworthiness is assessed by automated processing, consumers can ask for a clear explanation, human intervention and a review of the decision. Models must be explainable case by case.
Official source: EUR-Lex · Directiva (UE) 2023/2225 ↗
Obligations arrive in 2027, 2029 and 2031: patient access to their data, requirements for electronic health record systems and secondary use of health data inside secure processing environments.
Official source: EUR-Lex · Reglamento (UE) 2025/327 ↗
Covers credit scoring, life and health insurance pricing, justice, essential public services and employment. Requires risk management, data quality, logging, human oversight and technical documentation.
Official source: EUR-Lex · Reglamento (UE) 2026/1744 ↗
Sets technical rules for cross-border exchange of health data between Member States and applies from 26 March 2027. It is the first concrete implementing act under the EHDS Regulation.
Official source: EUR-Lex · Reglamento de Ejecución (UE) 2026/2083 ↗
Applies to connected products placed on the market from this date. Manufacturers must design them so users can access the data they generate, which shapes architecture, contracts and industrial analytics.
Official source: EUR-Lex · Reglamento (UE) 2023/2854 ↗
Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents. This includes software with AI components placed on the EU market.
Official source: EUR-Lex · Reglamento (UE) 2024/2847 ↗
The stated goal is to strengthen data protection and speed up AI use in the regional administration. It confirms the public-sector trend towards infrastructure under its own control.
Official source: Comunidad de Madrid ↗
In force since 27 July 2026. Annex III obligations move to 2 December 2027 and Annex I obligations (AI in regulated products such as medical devices) to 2 August 2028.
Official source: EUR-Lex · Reglamento (UE) 2026/1744 ↗
A lump sum and daily penalties are requested. Until the Spanish law arrives, essential and important entities are well advised to prepare risk management, incident reporting and supplier control now.
Official source: Comisión Europea ↗
Recommends asset inventory, patching prioritised by exploitability, phishing-resistant authentication and governance of AI agents. A practical reference for bodies subject to the ENS.
Official source: CCN-CERT ↗
It sets out Spain's sanctions regime and the role of AESIA as supervisory authority. It is still in the amendment phase in Congress, so the final text may change.
Official source: Congreso de los Diputados ↗
It proposes a framework to assess the sovereignty of cloud and AI services and to encourage their adoption by the public sector. If adopted, it will shape how providers are assessed in tenders.
Official source: Comisión Europea ↗
In force since 18 June 2026. It organises health technology assessment, accepts real-world data and covers digital therapies, which matters to anyone building clinical software with AI.
Official source: BOE-A-2026-11587 ↗
The guidelines will use examples to clarify which use cases fall under the high-risk regime. The final version is expected at the end of 2026 and will help organisations review their AI system inventory.
Official source: Comisión Europea ↗
The signing lawyer must check the output and preserve professional secrecy and data protection. In practice, it matters where client documents are processed and who can access them.
Official source: Consejo General de la Abogacía ↗
The Like Company v Google case pits a publisher against a model provider. The judgment is pending and may set criteria on training with and reproducing protected content.
Official source: Comisión Europea · IP Helpdesk ↗
It proposes a rule of 2: an agent should not at the same time receive uncontrolled input, access sensitive data and take real-world actions. Useful for designing agent permissions and isolation.
Official source: AEPD ↗
It requires human control of every output and bans entering case data into non-official AI systems. It sets the confidentiality standard expected around the judiciary.
Official source: BOE-A-2026-2205 ↗
It covers confidentiality, supervision of outputs and choice of providers. It recommends knowing where client data is processed, and under which contract terms, before adopting a tool.
Official source: Consejo General de la Abogacía ↗
An interoperable network of regional platforms for secondary use of health data, backed by 70 million euros. It prepares research and AI models on clinical data inside controlled environments.
Official source: La Moncloa ↗
The AI Act complements CRR/CRD, DORA and EBA guidelines on credit scoring. Banks can build on their existing model governance and ICT risk frameworks to comply.
Official source: EBA ↗
Most are large cloud platforms, now under direct EU oversight. Financial entities remain responsible for managing concentration risk and exit strategies.
Official source: EBA · ESAs ↗
It governs data access and portability, makes switching cloud providers easier and limits transfers of non-personal data outside the EU. It strengthens the ability to leave a provider.
Official source: EUR-Lex · Reglamento (UE) 2023/2854 ↗
It applies Solvency II, IDD, DORA and GDPR to AI use with an approach proportional to each use case's risk: data governance, documentation, explainability and human oversight.
Official source: EIOPA ↗
AI medical software that needs a notified body is high-risk and must meet both frameworks. The guidance explains how to combine the documentation into a single conformity assessment.
Official source: Comisión Europea · MDCG ↗
We include laws, supervisory guidance, court decisions and calls that change what an organisation can or must do when it uses AI with personal, clinical, financial or confidential data. We leave out opinions, rumours and announcements without a published text.
We only cite official sources: the EU Official Journal (EUR-Lex), Spain's Official Gazette (BOE), the parliamentary gazette, the European Commission, supervisory authorities (AEPD, EBA, EIOPA, CCN-CERT) and professional bodies. We review the radar every two weeks; each entry carries the date of the event and a link to the original document so you can check it.
It is a regulatory monitoring tool for technical, compliance and management teams. For decisions on your specific case, rely on your legal advisers: we help with the infrastructure side, meaning where data is processed, who can access it and how it is documented.
On 2 December 2027 for Annex III systems (credit scoring, life and health insurance, justice, essential public services, employment) and on 2 August 2028 for AI built into Annex I regulated products such as medical devices. These dates come from the AI Omnibus, Regulation (EU) 2026/1744.
Not yet through a Spanish law: Spain had not transposed NIS2 when the Commission referred it to the CJEU on 8 July 2026. Meanwhile the ENS already binds the public sector and its providers, and DORA binds financial entities, so preparing risk management and incident reporting now is time well spent.
That the service is certified at the ENS category matching the public body's system (Basic, Medium or High), with access control, activity logging, encryption and continuity. Our platform holds ENS Medium certification issued by EQA and our Tier III datacenter in Madrid holds ENS High; see ENS and AI and public sector.
DORA treats third-party AI and cloud services as ICT risk: they must be registered, assessed, covered by audit and exit clauses, and monitored for concentration on a few providers. See banking and insurance.
Yes, with a valid GDPR legal basis for special categories, data minimisation and a controlled processing environment, ideally with data processed in Spain and never reused to train third-party models. The EHDS adds secondary-use rules from 2027; we explain it in healthcare.
Every two weeks, and sooner when a relevant rule is published. The date of the last review appears at the top and every entry links to its official source.
Compliance starts in the infrastructure
Talk to an engineer about compliance-ready AI infrastructure: data in Spain, ENS and GDPR by design.