What it is: Regulation (EU) 2024/1689, the world’s first comprehensive law on artificial intelligence. As an EU regulation, it applies directly across the EU without the need for national legislation.
Who it affects: companies that develop, sell, import, distribute or use AI systems in the EU, even if they are based elsewhere.
How it works: it classifies AI by risk. Some practices are banned, high-risk systems must meet strict requirements, others only have transparency obligations and the rest can be used freely.
What already applies: the prohibited practices and AI literacy since 2 February 2025. The rules for providers of general-purpose AI models, such as those behind ChatGPT or Gemini, since 2 August 2025. And the transparency obligations since 2 August 2026.
What comes next: from 2 December 2026, AI systems that generate intimate images of real people without their consent, and those that generate child sexual abuse material, are also banned.
What has been postponed: the Digital Omnibus (Regulation (EU) 2026/1744) delayed the high-risk obligations. They now apply from 2 December 2027 for uses such as employment, education or lending decisions, and from 2 August 2028 for AI built into regulated products, such as toys, lifts or medical devices.
Fines: up to 35 million euros or 7% of total worldwide annual turnover, whichever is higher.
In Spain: it is supervised by the Spanish Agency for the Supervision of Artificial Intelligence (AESIA). The Spanish bill meant to implement it lapsed in October 2026 when Parliament was dissolved, but the EU regulation applies regardless.
The AI Act is the law through which the European Union regulates how artificial intelligence is developed, placed on the market and used. It is also known as the EU Artificial Intelligence Act or the European AI Act. Its official name is Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence.
It was published in the Official Journal of the EU on 12 July 2024 and entered into force on 1 August 2024, but its obligations apply in stages. Because it is a regulation rather than a directive, it applies directly in all 27 Member States: no country needs to transpose it into national law.
Its first major amendment, Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026. It simplifies some obligations, extends benefits to mid-sized companies, adds two new prohibitions and delays the high-risk rules.
Item | Detail |
|---|---|
Official name | Regulation (EU) 2024/1689, the Artificial Intelligence Act |
Type of law | EU regulation: applies directly, with no transposition |
Published in the Official Journal | 12 July 2024 |
Entry into force | 1 August 2024 |
Latest major amendment | Regulation (EU) 2026/1744 (Digital Omnibus), in force since 27 July 2026 |
Supervision in the EU | European AI Office (European Commission) and national authorities |
Supervision in Spain | AESIA (Spanish Agency for the Supervision of Artificial Intelligence) |
Maximum fine | 35 million euros or 7% of total worldwide annual turnover |
Article 1 sums it up: to improve the functioning of the internal market and promote human-centric, trustworthy AI. To do so, it ensures a high level of protection of health, safety and fundamental rights against the harmful effects of AI, including democracy, the rule of law and the environment, while supporting innovation.
In practice, it pursues three goals:
Protecting people from uses of AI that could discriminate against them, manipulate them or infringe their rights.
Providing legal certainty with the same rules across the EU, so companies do not have to comply with 27 different national frameworks.
Not holding back innovation, through regulatory sandboxes and specific measures for SMEs and mid-sized companies.
The regulation only applies to what it defines as an AI system (Article 3(1)):
“A machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.”
The key is the ability to infer. According to the European Commission’s guidelines of February 2025, the following are not AI:
software that simply executes rules defined by people;
basic data processing, such as sorting, filtering or calculating;
systems based on classical heuristics;
simple predictions, such as a historical average.
Examples of AI systems include a chatbot built on a language model, a tool that scores CVs using machine learning, a fraud detection system or a recommendation engine. An Excel macro or a payroll calculation based on fixed rules is not.
The AI Act does not distinguish by company size or sector, but by the role each company plays in relation to an AI system. It also has extraterritorial reach: it applies to companies outside the EU if their AI is placed on the EU market or its output is used in the EU.
Role | Who it is | Example |
|---|---|---|
Provider | Develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge | A software company selling a CV screening tool |
Deployer | Uses an AI system under its authority in a professional activity | The HR department that uses that tool to select staff |
Importer | A company established in the EU that places on the market an AI system from a provider outside the EU | A Spanish company selling in Spain an AI solution developed in the US |
Distributor | Any other actor in the supply chain that makes the system available on the market | A wholesaler or a software integrator |
Most companies are deployers, because they use AI developed by others. But the same company can have several roles at once, and each comes with its own obligations.
Watch out: you can go from user to provider. Under Article 25, you become the provider of a high-risk system if you put your name or trademark on it, make a substantial modification to it or change its intended purpose so that it becomes high-risk. For example, if you use a general-purpose AI assistant, such as ChatGPT, to select staff.
The regulation applies to providers placing AI on the EU market, wherever they are established. It also applies to providers and deployers outside the EU when the output of their system is used in the EU. Non-EU providers of high-risk systems and of general-purpose AI models must appoint an authorised representative in the EU.
Uses exclusively for military, defence or national security purposes.
Systems and models developed and put into service solely for scientific research and development.
Research, testing and development before an AI system is placed on the market, except testing in real-world conditions.
Use by individuals for purely personal, non-professional activities.
Open-source AI, unless it is high-risk, prohibited or subject to transparency obligations.
The AI Act applies to all companies, but proportionately. The Digital Omnibus has extended several benefits that SMEs already had to small mid-cap enterprises. These are companies that are not SMEs but have fewer than 750 employees and an annual turnover of up to 150 million euros or a balance sheet of up to 129 million euros.
Their main benefits:
Capped fines: the lower of the percentage and the fixed amount applies.
Simplified technical documentation and a quality management system proportionate to their size.
Priority access to AI regulatory sandboxes.
Public support for AI literacy, with particular attention to SMEs.
If your company has between 250 and 749 employees, it probably falls into this new category, and it is worth checking.
The AI Act does not regulate technology itself, but how it is used. That is why the same tool can be minimal risk in one department and high-risk in another: a language model that summarises emails does not have the same obligations as that same model scoring job candidates.
The regulation sorts uses into four levels:
Level | What it covers | What it requires | Applies from |
|---|---|---|---|
Prohibited | Manipulation, social scoring, emotion recognition at work and non-consensual sexual deepfakes, among others | Cannot be placed on the market or used | 2 February 2025; the two new prohibitions, 2 December 2026 |
High-risk | Recruitment, credit decisions, education, critical infrastructure and safety components of regulated products | Strict requirements before placing on the market and during use | 2 December 2027 (Annex III) and 2 August 2028 (Annex I) |
Transparency | Chatbots, AI-generated content, deepfakes and emotion recognition | Inform people and mark content | 2 August 2026 |
Minimal risk | Spam filters, recommender systems, writing assistants and most internal tools | No specific obligations beyond AI literacy | Already applicable |
A single system can be subject to obligations from several levels. A chatbot that decides whether someone gets a loan is high-risk and must also disclose that it is an AI.
Since 2 February 2025, it has been prohibited to place on the market, put into service or use AI systems that:
Use subliminal, manipulative or deceptive techniques that materially distort a person’s behaviour and cause, or are likely to cause, significant harm.
Exploit vulnerabilities due to age, disability or a social or economic situation.
Score people based on their social behaviour or personal characteristics (social scoring) where this leads to unjustified or disproportionate detrimental treatment.
Assess the risk of someone committing a crime based solely on profiling or on their personality traits.
Create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage.
Infer people’s emotions in the workplace or in educational institutions, except for medical or safety reasons.
Categorise people based on their biometric data to deduce their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
Identify people remotely and in real time using biometric data in publicly accessible spaces for law enforcement, except in narrowly defined cases, such as searching for victims of abduction or preventing an imminent terrorist threat.
The Digital Omnibus adds two prohibitions that apply from 2 December 2026: systems that generate or manipulate intimate or sexually explicit images, videos or audio of an identifiable person without their consent, and systems that generate child sexual abuse material. The ban covers tools built for this and general-purpose generative AI that lacks reasonable safeguards to prevent it. For those who only use such a tool, the prohibition applies when they use it for that purpose.
A workplace example: video interview software that analyses a candidate’s face to infer their enthusiasm or nervousness falls under the ban on emotion recognition at work. In February 2025, the European Commission published guidelines with examples of each prohibited practice.
An AI system is high-risk through one of two routes:
Regulated products (Annex I): the AI is a safety component of a product, or is the product itself, covered by EU legislation that requires third-party conformity assessment, such as toys, lifts, radio equipment or medical devices. These obligations apply from 2 August 2028. Machinery and vehicles follow a different route: the AI requirements are built into their own sectoral rules, and the Omnibus moved the Machinery Regulation into that group.
Sensitive uses (Annex III): the AI is used in one of the eight areas in the table below. These obligations apply from 2 December 2027.
Annex III area | Examples |
|---|---|
Biometrics | Remote biometric identification (other than simple identity verification), biometric categorisation and emotion recognition where it is not prohibited |
Critical infrastructure | Safety components in road traffic, the supply of water, gas, heating or electricity, and critical digital infrastructure |
Education and vocational training | Deciding admissions, evaluating learning outcomes, assigning education levels and monitoring exams |
Employment and workforce management | Targeted job ads, filtering CVs, evaluating candidates, deciding promotions or dismissals, allocating tasks and monitoring performance |
Essential services | Granting public benefits, assessing creditworthiness (except fraud detection), risk assessment and pricing in life and health insurance, and triaging emergency calls |
Law enforcement | Assessing the risk of becoming a crime victim, evaluating the reliability of evidence or profiling in investigations |
Migration, asylum and border control | Assessing security risks or examining asylum, visa or residence applications |
Justice and democratic processes | Assisting judges in interpreting facts and the law, or influencing the outcome of elections |
The Article 6(3) exception. An Annex III system is not considered high-risk if it does not pose a significant risk because it only:
performs a narrow procedural task;
improves the result of a previously completed human activity;
detects decision-making patterns or deviations from prior patterns, without replacing or influencing the human assessment without proper review; or
performs a preparatory task to an assessment.
The exception never applies if the system profiles natural persons. Anyone relying on it must document their assessment before placing the system on the market and register it in the EU database: the Commission proposed removing this registration duty in the Omnibus, but the proposal did not survive.
Example: a tool that only sorts incoming CVs by date can rely on the exception; one that scores them and rejects candidates cannot.
To settle borderline cases, the Commission published draft guidelines on high-risk classification in May 2026, with examples of systems that are high-risk, systems that are not and borderline cases. The final version is expected by the end of 2026.
Since 2 August 2026, these uses require transparency:
Chatbots and assistants: people must be told they are interacting with an AI, unless it is obvious.
AI that generates content: the provider must mark generated text, images, audio and video in a machine-readable format so that they can be detected as artificial. Systems already on the market before 2 August 2026 have until 2 December 2026 to do so.
Deepfakes: anyone publishing images, audio or video that imitate real people, places or events must disclose that they were generated or manipulated with AI. For artistic, satirical or fictional works, a disclosure that does not spoil the work is enough.
Text on matters of public interest: anyone publishing AI-generated text to inform the public on matters of public interest must disclose it, unless a person has reviewed it and someone holds editorial responsibility.
Emotion recognition and biometric categorisation: the people exposed must be informed.
The Commission published guidelines on these obligations in July 2026 and, in June, a code of practice on marking and labelling AI-generated content, with common EU icons to flag it.
This is where most of the AI used by companies sits: spam filters, product recommendations, writing and summarising assistants, machine translation or predictive maintenance that is not a safety component. It has no specific obligations beyond the AI literacy duty in Article 4, although the regulation encourages voluntary codes of conduct.
Is it an AI system? If it only follows fixed rules defined by people, it is not, and the AI Act does not apply.
Is it on the list of prohibited practices? If so, it cannot be used and must be withdrawn.
Is it a safety component of a regulated product, or is its use listed in Annex III? Then it is, in principle, high-risk. If it falls under Annex III, check whether the Article 6(3) exception applies and document the decision.
Does it interact with people, generate content, create deepfakes or recognise emotions? It has transparency obligations, whatever its risk level.
None of the above? It is minimal risk. Add it to your inventory of AI systems and to your staff training.
Classification is done by use, not by tool: ChatGPT used to draft emails is minimal risk, but the same model used to reject job candidates is high-risk.
General-purpose AI models are trained on vast amounts of data and can perform a wide range of tasks: writing, summarising, translating, coding or creating images. Examples include the models behind ChatGPT, Gemini, Claude or Copilot. According to the guidelines the Commission published in July 2025, as a rule of thumb a model is general-purpose if it was trained with more than 10²³ floating-point operations (FLOP) and can generate language, or images or video from text.
The obligations fall on the companies that develop the models, such as OpenAI, Google, Anthropic, Meta or Mistral, and have applied since 2 August 2025:
Technical documentation of the model, available to the AI Office and national authorities.
Information for companies that integrate the model into their own products.
A policy to comply with EU copyright law, including rightsholders’ reservations against the use of their works for training.
A public summary of the training content, using the Commission’s template.
The most powerful models, trained with more than 10²⁵ FLOP, are presumed to pose systemic risk. Their providers must also evaluate the model through adversarial testing, mitigate systemic risks, report serious incidents to the AI Office and ensure cybersecurity.
The Code of Practice published by the Commission in July 2025 is the voluntary route to demonstrate compliance with these obligations. Models already on the market before 2 August 2025 have until 2 August 2027 to comply, and the Commission has been able to fine providers since 2 August 2026.
If your company uses ChatGPT, Copilot or Gemini, it is not the provider of the model: it is the deployer of an AI system. Its obligations depend on how it uses it:
Use | Your role | What it requires |
|---|---|---|
Staff use it to write, summarise or code | Deployer | AI literacy and an AI use policy, while respecting the GDPR for any personal data entered |
Customer service chatbot built on a third-party model | Deployer, and provider of the system if you offer it under your own brand | Disclose that it is an AI (Article 50) |
Images or videos for marketing campaigns | Deployer | Disclose deepfakes; technical marking is the tool provider’s job |
Filtering or scoring CVs | Provider of a high-risk system: giving it that purpose makes you a provider under Article 25 | The high-risk provider obligations plus Article 26, from 2 December 2027 |
Retraining the model with more than a third of its original training compute | Provider of the modified model | Documentation, copyright policy and training summary, covering the modification only |
Selling your own product with the model built in | Provider of the AI system | The obligations of its risk level |
Connecting a model to your documents, known as RAG, does not involve retraining it, and light fine-tuning on your own data rarely comes close to that one-third threshold. So in most cases it does not make you the provider of the model. Before you integrate generative AI into a process, make sure you know which row of the table you are in.
What applies to you depends on your role and on the risk level of each system. Most companies are deployers of minimal-risk systems, so their obligations are light. The heavy burden falls on those who develop or sell high-risk systems.
Since 2 February 2025, providers and deployers had to ensure a sufficient level of AI literacy among their staff. The Digital Omnibus reworded the article with effect from 27 July 2026: they must now take measures to support the AI literacy of their staff, without having to reach a specific level. It is still mandatory, and the Commission and the Member States must also promote it, with particular attention to SMEs.
What to do in practice:
Know who uses AI in the company and what for.
Train each profile according to their use: risks, checking outputs, data protection and the basics of the AI Act.
Adopt an internal AI use policy.
Keep evidence of the training, such as materials and attendance. The regulation does not require any certificate.
A deployer of a high-risk system must:
Use it in accordance with the provider’s instructions.
Assign human oversight to people with the necessary competence, training and authority.
Ensure that the input data it controls is relevant and sufficiently representative.
Monitor its operation and, if it identifies a risk, inform the provider and the authority and suspend its use. Serious incidents must also be reported.
Keep the logs generated by the system for at least six months.
Inform workers’ representatives and affected staff before using it in the workplace.
Inform people when the system makes, or helps to make, decisions about them. They have a right to an explanation (Article 86).
In addition, public bodies, private companies providing public services and those using AI to assess creditworthiness or price life and health insurance must carry out a fundamental rights impact assessment before first use (Article 27).
These obligations apply from 2 December 2027 for Annex III uses and from 2 August 2028 for AI built into regulated products.
The provider carries most of the obligations. Before placing the system on the market, it must meet these requirements:
Requirement | What it means | Article |
|---|---|---|
Risk management | Identify, assess and mitigate risks throughout the system’s lifecycle | 9 |
Data and data governance | Training, validation and testing data that is relevant, representative and, as far as possible, free of errors and bias | 10 |
Technical documentation | Demonstrate that the system complies; simplified for SMEs and small mid-caps | 11 |
Record-keeping | Automatic logging of the system’s operation | 12 |
Transparency and instructions | Deployers must know how it works, its limitations and how to oversee it | 13 |
Human oversight | Designed so that a person can monitor it, understand it and intervene | 14 |
Accuracy, robustness and cybersecurity | Appropriate levels, declared and maintained over time | 15 |
Quality management | Documented policies and procedures | 17 |
Conformity assessment and CE marking | Check compliance, issue the EU declaration of conformity and affix the CE marking | 43, 47 and 48 |
Registration | Register the system in the EU database | 49 |
Post-market monitoring | Monitor the system on the market and report serious incidents | 72 and 73 |
Data underpins almost all of these requirements. The Omnibus added Article 4a, which allows special categories of personal data to be processed, exceptionally, to detect and correct bias. Without sound data governance, it is very hard to show that a system complies with Article 10.
Before making a high-risk system available on the market, they must check that it bears the CE marking and comes with the EU declaration of conformity and instructions for use, and that the provider has met its obligations. If they have reason to believe it does not comply, they must not place it on the market until it is fixed. And if they put their own brand on it or change its intended purpose, they become providers (Article 25).
The AI Act does not apply all at once but in phases, and the Digital Omnibus changed several of its dates. This is the current timeline: what is already mandatory and what is coming over the next few years.
Date | What starts to apply | Who it affects |
|---|---|---|
1 August 2024 | The regulation enters into force | No one yet: it starts the clock |
2 February 2025 | Prohibited practices (Article 5) and AI literacy (Article 4) | Every company that develops or uses AI |
2 August 2025 | Obligations for general-purpose AI models, EU governance, national authorities and penalties | Model providers and Member States |
2 August 2026 | General application, including the transparency obligations (Article 50), and the Commission’s power to fine model providers | Anyone using chatbots or publishing generated content and deepfakes; model providers |
2 December 2026 | Two new prohibitions, and the end of the grace period for marking content from generative systems already on the market | Providers and users of generative AI |
2 August 2027 | General-purpose models placed on the market before 2 August 2025, and at least one AI regulatory sandbox running in every Member State | Model providers and Member States |
2 December 2027 | Annex III high-risk systems | Providers and deployers in employment, education, credit, life and health insurance, public services and the other Annex III areas |
2 August 2028 | Annex I high-risk systems | Manufacturers and providers of regulated products that include AI |
2 August 2030 | High-risk systems already used by public authorities must comply | Public authorities and their suppliers |
31 December 2030 | AI components of large-scale EU IT systems (Annex X) | EU institutions and Member States |
Annex III high-risk obligations move from 2 August 2026 to 2 December 2027, and Annex I obligations from 2 August 2027 to 2 August 2028.
These are fixed dates. The Commission had proposed linking them to the availability of technical standards, but the final text dropped that mechanism.
The deadline for every Member State to have an AI regulatory sandbox up and running slips by a year, to 2 August 2027.
Transparency was not delayed: it has applied since 2 August 2026. Only the marking of content from systems already on the market has until 2 December 2026.
Two new prohibitions are added, applicable from 2 December 2026.
Article 111 governs the transition. A high-risk system placed on the market before its obligations start to apply only has to comply if its design changes significantly afterwards. There are two exceptions: systems used by public authorities, which must comply by 2 August 2030, and prohibited practices, which apply to every system, old or new.
A delayed obligation is not a reason to wait. Bringing a high-risk system into compliance takes documentation, good-quality data, testing and human oversight, and that takes months. And the technical standards that help demonstrate compliance are still being published.
The AI Act sets maximum fines in three tiers, depending on how serious the infringement is, plus a separate regime for providers of general-purpose AI models. In each case, the higher of the fixed amount and the percentage of total worldwide annual turnover for the previous financial year applies.
Infringement | Maximum fine | Example |
|---|---|---|
Placing on the market or using a prohibited practice (Article 5) | €35 million or 7% of turnover | Analysing candidates’ emotions in a job interview |
Breaching other obligations, such as the high-risk or transparency rules | €15 million or 3% | Using a high-risk system without human oversight, or not telling people that a chatbot is an AI |
Supplying incorrect, incomplete or misleading information to authorities or notified bodies | €7.5 million or 1% | Answering a request with documentation that does not match the system |
Infringements by providers of general-purpose AI models (Article 101) | €15 million or 3%, imposed by the Commission | Failing to give the AI Office the model’s technical documentation |
For SMEs, including start-ups, and for small mid-cap companies, the rule is reversed and the lower figure applies. For example, an SME with a turnover of €20 million that uses a prohibited practice faces a maximum of €1.4 million, 7% of its turnover, rather than €35 million.
The authority weighs all the circumstances of the case (Article 99(7)), including:
the nature, gravity and duration of the infringement, the number of people affected and the harm suffered;
the size of the company, its turnover and its market share;
whether the infringement was intentional or negligent, and the degree of responsibility given the technical and organisational measures in place;
action taken to mitigate the harm, and cooperation with the authority;
whether the company itself reported the infringement, and whether other fines have already been imposed for the same conduct.
Besides fines, the authority can require the system to be corrected, restrict its use or withdraw it from the market. For public bodies, each Member State decides whether and to what extent fines can be imposed (Article 99(8)). And any person or company that believes a system breaches the regulation can lodge a complaint with the authority (Article 85).
National market surveillance authorities: the vast majority of infringements.
The European Commission, through the AI Office: infringements by providers of general-purpose AI models, from 2 August 2026. Since the Omnibus, it also supervises AI systems built on a general-purpose model from the same provider.
The European Data Protection Supervisor: infringements by EU institutions and bodies (Article 100).
The regulation requires each Member State to lay down its own penalty rules, and Spain has not yet done so: the bill that set them out lapsed when Parliament was dissolved in October 2026. Until there is a law, the final allocation of authorities and the sanctioning procedure remain pending. The AI Act’s obligations, however, are fully enforceable, and the Commission can already fine providers of general-purpose AI models.
That does not leave companies risk-free. In July 2025 the Spanish Data Protection Agency (AEPD) pointed out that it can already act under the GDPR against prohibited AI systems that process personal data. In fact, the best-known penalties against AI in Europe have been imposed under the GDPR, such as the €15 million fine the Italian data protection authority imposed on OpenAI in December 2024.
As an EU regulation, the AI Act applies in Spain without the need for a national law. But each Member State has to designate its authorities, set penalties and organise sandboxes, and here Spain combines a pioneering agency with a law that is still pending.
The Spanish Agency for the Supervision of Artificial Intelligence (AESIA), based in A Coruña, was created in 2023 and was the first agency of its kind in Europe. It is Spain’s single point of contact for the AI Act, and its role is to supervise compliance and guide companies and public bodies.
In December 2025 it published 16 practical guides, drawn from the experience of the Spanish sandbox:
two introductory guides, with examples to help understand the regulation;
thirteen technical guides on the high-risk requirements: conformity assessment, quality management, risk management, human oversight, data and data governance, transparency, accuracy, robustness, cybersecurity, record-keeping, post-market monitoring, incident management and technical documentation;
a self-assessment manual with checklists.
They are not binding, but they offer practical recommendations aligned with the regulation while European harmonised standards are being completed. They are available in Spanish.
Spain got ahead of the EU requirement with its own controlled testing environment, set up by Royal Decree 817/2023. In it, companies with high-risk systems brought them into line with the regulation’s requirements with support from the authorities, and AESIA’s guides came out of that experience. The AI Act requires every Member State to have at least one sandbox running by 2 August 2027, and the Omnibus has also created an EU-level sandbox, run by the AI Office, with priority access for SMEs, start-ups and small mid-caps.
On 26 May 2026 the Council of Ministers approved the draft Organic Law on the good use and governance of artificial intelligence, which was published in the Spanish Parliament’s official gazette in June. The bill lapsed when Parliament was dissolved by Royal Decree 806/2026 in October, ahead of the general election on 29 November. To become law, it will have to be reintroduced in the new parliamentary term.
The bill placed AESIA at the centre of the system, as single point of contact and supervisor of most uses, and shared out the rest among specialist authorities such as the AEPD, the General Council of the Judiciary, the Bank of Spain, the CNMV securities regulator and the Directorate-General for Insurance and Pension Funds. It also included a chapter on the good use of AI in central government, with an AI officer in every public body.
In the meantime, some rules are already clear because the AI Act itself sets them:
In banking and insurance, where the AI is directly linked to the provision of financial services, supervision falls to the financial supervisors (Article 74(6)).
For Annex I products, such as toys or medical devices, the authorities that already supervise each product remain competent (Article 74(3)), some of them at regional level.
The AEPD can already act under the GDPR whenever an AI system processes personal data.
The AI Act does not replace any other law: it adds to them. The good news is that much of the work done to comply with the GDPR or cybersecurity rules also counts towards the AI Act.
Rule | What it covers | How it fits with the AI Act |
|---|---|---|
GDPR | Processing of personal data | Applies alongside the AI Act whenever AI uses personal data. The data protection impact assessment complements the fundamental rights impact assessment in Article 27, and Article 22 GDPR still protects people from solely automated decisions. |
ISO/IEC 42001 | A voluntary, certifiable AI management system | Does not give a presumption of conformity, but structures the inventory, risks and controls the AI Act calls for. |
Harmonised standards, such as EN 18286 | European technical specifications for meeting the AI Act’s requirements | Following them gives a presumption of conformity. The first, on quality management, was published in the Official Journal in October 2026 and is designed to integrate with ISO/IEC 42001 and ISO 9001. |
NIS2 | Cybersecurity of essential and important entities | AI systems are among the assets to protect, and Article 15 of the AI Act also requires them to be secure. |
Cyber Resilience Act | Cybersecurity of products with digital elements | If a high-risk system meets its essential requirements, it is presumed to meet the AI Act’s cybersecurity requirements. |
DORA | Digital operational resilience in the financial sector, since January 2025 | Cloud AI providers are ICT third-party providers and fall within its risk management and contract rules. |
Product Liability Directive | Damage caused by defective products, which now include software and AI | Applies to products placed on the market from 9 December 2026. Breaching mandatory safety requirements, such as those in the AI Act, helps establish a presumption that a product is defective. |
Spanish Workers’ Statute (Article 64.4.d) | Information rights of workers’ representatives | Since 2021, companies in Spain must tell works councils about the algorithms and AI systems that affect working conditions. This adds to the AI Act’s Article 26 duty to inform. |
The Commission withdrew its proposed AI Liability Directive in 2025, so claims for harm caused by AI are brought under the new Product Liability Directive and national liability rules.
There is no need to wait until 2027 to start. These eight steps work for companies of any size, and the first four already cover the obligations in force today.
Appoint an owner. Name a person or a small committee to coordinate compliance, with representatives from the business, technology, data, legal and HR.
Build an AI inventory. List every AI system the company develops, buys or uses, including AI built into tools you already have, such as your CRM, recruitment platform or office suite, and the tools staff use on their own initiative.
Classify each system and your role. Apply the five risk classification questions, work out whether you are a provider or a deployer and document every decision, especially if you rely on the Article 6(3) exception.
Remove what is prohibited and meet what already applies. Withdraw any prohibited practice, train your staff, adopt an AI use policy and apply the transparency rules to chatbots and generated content.
Review your supplier contracts. Ask for documentation and instructions for use, information on the data and the model, CE marking where relevant, and commitments on incidents, changes and audits.
Run a gap analysis of high-risk systems. Compare each system with Articles 9 to 15 if you are the provider, or with Article 26 if you are the deployer, and plan the fixes before 2 December 2027.
Prepare the assessments and documentation. Depending on your case: conformity assessment, technical documentation, fundamental rights impact assessment, registration in the EU database and information for staff.
Govern AI continuously. Monitor systems in use, manage incidents, review the inventory regularly and reassess each system whenever its use, data or model changes.
A good starting point is an independent AI audit, which maps your systems, reviews data, models and risks, and leaves you with a prioritised compliance plan.
Do we have an up-to-date inventory of every AI system and who is responsible for each one?
Do we know our role for each system: provider, deployer, importer or distributor?
Have we checked that we use no prohibited practice, including the two new ones from December 2026?
Have staff received AI training suited to how they use it, and do we keep evidence?
Do we have an internal policy on which tools can be used, with what data and for what purpose?
Do our chatbots tell people they are an AI, and do we label deepfakes and AI-generated public-interest text?
Have we identified our high-risk systems, and do we have a plan for 2 December 2027?
Do our contracts with AI suppliers secure the documentation and cooperation we need?
Have we aligned the AI Act with the GDPR, cybersecurity and, where relevant, DORA?
Do we have a procedure to detect, record and report serious incidents?
Because obligations depend on use, the AI Act’s impact varies widely from one sector to another. These are the most common cases.
Assessing the creditworthiness or credit score of individuals is high-risk, unless the system is used only to detect financial fraud, and the deployer must also carry out a fundamental rights impact assessment. Supervised institutions meet part of the quality management and monitoring obligations through their internal governance rules, and AI Act supervision falls to their financial supervisors. All of this sits alongside DORA and the GDPR. Read more about AI in banking.
Risk assessment and pricing for individuals in life and health insurance is high-risk and also requires a fundamental rights impact assessment. Pricing in other lines, such as motor or home insurance, and claims fraud detection are not high-risk in principle, although they remain subject to the GDPR and insurance regulation. Customer service chatbots must tell people they are an AI. Read more about AI in insurance.
AI software that is a class IIa or higher medical device needs a notified body assessment and is therefore high-risk under Annex I: its requirements apply from 2 August 2028 and are checked as part of the Medical Devices Regulation assessment. Emergency patient triage systems, and the systems public authorities use to decide access to public healthcare services, are also high-risk. And health data is a special category under the GDPR. Read more about AI in healthcare.
Public bodies use many Annex III systems, such as those that decide access to public benefits and services, and they have obligations of their own: carry out a fundamental rights impact assessment before using a high-risk system, register that use in the EU database, and bring the systems they already run into compliance by 2 August 2030. Private companies that provide public services must also carry out the impact assessment. Read more about AI in the public sector.
This affects any company with employees. Systems that filter CVs, evaluate candidates or decide promotions, dismissals or task allocation are high-risk, and recognising workers’ emotions is prohibited. Before using a high-risk system at work, employers must inform workers’ representatives and the affected staff; in Spain, this adds to Article 64.4.d of the Workers’ Statute.
Predictive maintenance and visual quality inspection are usually minimal risk, unless they act as a safety component. AI that forms part of a machine’s safety functions will be governed by the Machinery Regulation, which applies from 20 January 2027, because the Omnibus took it out of the AI Act’s general regime to avoid double regulation. Using AI to monitor operators’ performance, on the other hand, can be high-risk. Read more about AI in industrial manufacturing.
Product recommenders, customer segmentation and demand forecasting are minimal risk. Chatbots must tell people they are an AI, and generated images or videos that resemble real people, places or events must be disclosed as such. The line is manipulation: techniques that distort consumer behaviour and cause significant harm are prohibited. Read more about AI in retail and distribution.
Yes. It entered into force on 1 August 2024 and applies in phases. It has applied generally since 2 August 2026, although the high-risk obligations were postponed to 2 December 2027 and 2 August 2028.
Every organisation that develops, places on the market, imports, distributes or uses AI systems in the EU in a professional capacity, including companies outside the EU whose AI is used here. What changes is how much: it depends on the company’s role and the risk of each system.
Yes, though few if the use is minimal risk: train your staff, set a use policy and comply with the GDPR for any data you enter. If it is used to make decisions about people, such as selecting candidates, it becomes high-risk and the company takes on provider obligations.
There is no general AI Act certificate. High-risk systems need a conformity assessment and CE marking: in most cases the provider carries it out itself, while some biometric systems and Annex I products require a notified body. ISO/IEC 42001 is a voluntary certification that helps, but it does not replace these obligations.
Up to €35 million or 7% of total worldwide annual turnover for prohibited practices, up to €15 million or 3% for breaching other obligations, and up to €7.5 million or 1% for supplying incorrect information. For SMEs and small mid-caps, the lower figure applies.
AESIA is the single point of contact and central authority, alongside sector supervisors such as the financial regulators. The bill that was to complete the allocation of powers and set penalties lapsed in October 2026 and will have to go through Parliament again.
It is Regulation (EU) 2026/1744, which amended the AI Act with effect from 27 July 2026. It postpones the high-risk obligations, adds two prohibitions, extends SME benefits to small mid-caps, reframes AI literacy and moves machinery to its own sectoral rules.
Yes, if they place AI systems or models on the EU market or if the output of their AI is used in the EU. That includes UK and US companies. Providers of high-risk systems and general-purpose AI models must appoint an authorised representative in the EU.
The GDPR protects personal data; the AI Act regulates AI systems according to their risk, whether or not they process personal data. When an AI system uses personal data, both apply at the same time.
If you develop or provide generative AI, make sure it has reasonable safeguards to stop it generating intimate images of real people without their consent or child sexual abuse material, and that content from systems placed on the market before 2 August 2026 is marked as AI-generated. If you only use it, make sure nobody in the company uses it for those purposes.
Regulation (EU) 2024/1689, the AI Act (EUR-Lex)
Regulation (EU) 2026/1744, the Digital Omnibus on AI (EUR-Lex)
AI Act Single Information Platform (European Commission)
Code of Practice on AI-generated content (European Commission)
AESIA guides on complying with the AI Act (in Spanish)
This guide is updated when the law or its interpretation changes. It is for information only and is not legal advice.
Our team helps you put it into practice.
CEO and Co-Founder of Macaque Group
1 post
CEO and Co-Founder of Macaque Group, a technology group based in Calafell (Tarragona, Spain) specialising in artificial intelligence, software development and IT outsourcing. Co-founder of BanAIna, an AI governance platform, and a member of OdiseIA. He advocates no-hype AI: applied to real business problems and built to reach production. His work has been published in Capital Humano (Wolters Kluwer).
ISO/IEC 27001:2023
EUROCERT S.A. Certificate no. 00.15.0812
Certification corresponding to Macaque Consulting
Scope according to certificate.
We process your personal data in accordance with the General Data Protection Regulation (GDPR) and Organic Law 3/2018 (LOPDGDD). See our Privacy Policy.
Obtained
Tell us what you need and we'll reply within 24 working hours.
We analyse your case and propose solutions tailored to your business
From the initial idea through product evolution
Technology prepared to grow with you
Response within 24 hours
