Spain's AI law has expired without a vote: which obligations remain in force and who can sanction now
The dissolution of parliament leaves Spain without an AI governance law: the AI Act still applies, AESIA cannot fine and the calendar stretches.
Spain's bill for an Organic Law on the good use and governance of artificial intelligence, the statute meant to complete the application of the European AI Regulation in Spain, expired on 6 October 2026 with the dissolution of the Cortes Generales under Royal Decree 806/2026. It directly affects any company that develops, integrates or uses AI systems in Spain, as analyses by Novatierra and the European platform EuGFA explain.
A bill that never reached a vote
The Council of Ministers approved the bill on 26 May 2026 and sent it to Congress, where it was registered on 28 May under file number 121/000096 and published in the Official Gazette of the Cortes Generales on 12 June. It was assigned to the Economy, Trade and Digital Transformation Committee, where the amendment deadline was extended repeatedly, and it never reached the rapporteurship stage.
Its content was narrower than the title suggests: it designated AESIA as the market-surveillance authority and single contact point before the Commission, shared powers with the AEPD and the CGPJ, regulated the national controlled testing environment and set the sanctioning regime, with fines of up to 35 million euros or 7 per cent of worldwide turnover for prohibited practices. For the state public sector it added a mandatory inventory of AI systems and the figure of the AI delegate.
Why it does not resume where it stopped
The Congress standing orders provide that, once the chambers are dissolved, pending business lapses except for matters the Permanent Deputation must hear, and a bill at the amendment stage is not among them. Reviving it means starting from scratch: a fresh approval by the Council of Ministers and a new registration, even if ministries keep the technical work. In addition, Law 50/1997 bars a caretaker government from tabling bills, and the Constitution requires the new Congress to be constituted within 25 days of the 29 November election, that is, before 24 December. On those timelines, a new law before the second half of 2027 looks unlikely even if the text is recovered intact.
The AI Act does not wait for parliament
The essential point for the firm's counsel is that the substantive obligations have not moved. Regulation (EU) 2024/1689 is directly applicable: prohibited practices have applied since 2 February 2025, the obligations of general-purpose models since 2 August 2025 and the article 50 transparency duties since 2 August 2026, so today any company releasing a conversational assistant to the public must disclose that it is an AI system, unless that is obvious.
The calendar was amended this summer by Regulation (EU) 2026/1744, the so-called Digital Omnibus on AI, published on 24 July and in force since the 27th: it postpones to 2 December 2027 the obligations for high-risk systems in Annex III and to 2 August 2028 those embedded in regulated products. On 2 December 2026 the new prohibitions on AI-generated intimate content enter into force and the transitional period for technical marking of synthetic content ends; and by 2 August 2027 each State must have at least one controlled testing environment operational.
The real gap: supervision without fines
AESIA's founding instrument defines no offences or fine amounts, and the principle of sanctioning legality requires a statute that does not now exist. The agency can supervise, demand information and publish guides, but it cannot fine breaches of the AI Act. The gap does not leave non-compliance unpunished: the AEPD keeps fines of up to 20 million euros or 4 per cent of turnover where the system processes personal data, and consumer authorities sanction the use of AI in advertising or pricing. The sandbox royal decree the bill meant to repeal also remains in force.
The practical recommendation matches the one we gave in our piece on AI governance in the company: inventory the systems and the organisation's role in each, audit compliance with article 50 and document decisions following AESIA's guides, in line with the rigour of sources the sector demands. When the law arrives, that documentation will be the best evidence of diligence, an approach also applied by the courts under the new CGAE guidelines.
Sources: Novatierra (28 October 2026) and EuGFA (27 October 2026).
Related links
Fuentes
- novatierra.com. Accessed 2 November 2026.
The specific data in this article come from the official sources cited.
