Five high-risk AI cases explained: the Spanish sandbox's practical guide
Guide 2 of the Spanish artificial intelligence sandbox explains the Regulation through five high-risk use cases. Some, such as staff promotion or evaluating evidence in criminal investigations, bear directly on the work of employment and criminal law firms.
Understanding in the abstract what a high-risk system is under the European artificial intelligence Regulation is not simple. Guide 2, "Practical guide and examples for understanding the Artificial Intelligence Regulation", drawn up within the Spanish regulatory sandbox pilot, tries to do so with examples. Its version 2.0 dates from 17 July 2026 and is adapted to the Digital Omnibus; version 1.0 is from 10 December 2025.
Like the other sandbox guides, it is credited to the Ministry for Digital Transformation and the Civil Service and is not binding: according to its text, it neither replaces nor develops the applicable rules.
The five cases
The guide analyses five use cases, all high-risk, with the reference to the Regulation's annex in which they fall:
| Case | Classification the guide gives |
|---|---|
| Monitoring attendance at work through biometric identification | Annex III, point 1, letter a |
| Staff promotion | Annex III, point 4, letter b |
| Predicting social exclusion and access to benefits | Annex III, point 5, letter a |
| Smart insulin pump | Annex I, section A, subsection 11 (medical devices) |
| Detection of false complaints | Annex III, point 6, letter c |
Three lessons for firms
1. Classification depends on the use
In the attendance monitoring case, the guide says that classification as high risk depends on the use: according to its text, biometric verification is not considered high risk. That is, two systems with similar technology can have a different regime depending on exactly what they do.
For an employment law firm, the lesson is practical: before giving an opinion on whether a time-tracking system is high risk, you need to know precisely what it does. And if it affects working conditions, remember that the company must inform staff about algorithmic systems, as we explain in the guide to Royal Decree 723/2026 on information to workers.
2. Decisions about people at the company
The staff promotion case falls under point 4 of Annex III. Tools that help decide promotions directly affect firms' corporate clients and, in some cases, the firms themselves as employers. Moreover, any bias can have consequences under the equal treatment law, which we analysed when explaining Article 23 of Law 15/2022.
3. Criminal investigation
The detection of false complaints case refers, according to the guide, to law enforcement authorities assessing the reliability of evidence during the investigation or prosecution of offences.
The guide adds a relevant nuance: using that system to assess the truthfulness of statements by the people under investigation would be a substantial modification. For a criminal lawyer, knowing that a system of this kind has been used in an investigation, and for exactly what, can be decisive for the defence.
Provider and deployer
The guide does not formally define the roles of provider and deployer, but illustrates them with an example: in the insulin pump case, the provider is whoever places the system on the market and the deployer is the hospital that supplies it to the doctor. The distinction matters because the Regulation assigns each different obligations, which the guide links to articles such as 16 and 26.
How to use the guide
- As training material for teams starting with the Regulation.
- As a starting point for analysing client cases similar to the five examples.
- Together with the sandbox's other guides, such as the transparency one, which we summarise in the article on high-risk AI transparency.
More analysis in Legal AI.
Fuentes
- Ministerio para la Transformación Digital y de la Función Pública. Guía 2. Guía práctica y ejemplos para entender el Reglamento de Inteligencia Artificial, versión 2.0, 17 de julio de 2026 (PDF). Accessed 18 October 2026.
The specific data in this article come from the official sources cited.
