What the Spanish Agency for the Supervision of AI is and why a law firm should know it

When people talk about regulating artificial intelligence, attention usually goes to the European Regulation. But Spain also has a specific body: the Spanish Agency for the Supervision of Artificial Intelligence, known as AESIA. Its Statute was approved by Royal Decree 729/2023 of 22 August, published in the BOE on 2 September 2023, and came into force the following day.

What kind of body it is

The Statute sets it up as a state agency, a public-law entity with its own legal personality, its own assets and management autonomy.

• Seat: A Coruña, in the La Terraza building, ceded by the city council.
• Attachment: the Statute attached it, through the Secretariat of State for Digitalisation and Artificial Intelligence, to what was then the Ministry of Economic Affairs and Digital Transformation. A 2025 ministerial order, Order TDF/774/2025, already refers to the Ministry for Digital Transformation and Public Service as the department on which the bodies delegating powers to it depend.

Its functions

According to the Statute, the agency's aims and functions include:

1. Supervising, advising, raising awareness and training public and private entities on the use of artificial intelligence systems.
2. Carrying out inspection, verification and sanctioning functions under EU law, and helping minimise risks to fundamental rights, including non-discrimination.
3. Promoting controlled test environments for AI systems.
4. Developing a voluntary certification framework for private entities.
5. Drawing up operational guides to apply the European requirements.

For professionals, the last two functions have the most practical effect. A voluntary certification framework can become a useful criterion for choosing tool providers, and the operational guides offer a reference for documenting how requirements are met in each organisation.

How it is organised

The Statute sets up three main bodies:

• Presidency, held by the head of the Secretariat of State for Digitalisation and Artificial Intelligence.
• Governing Council, a collegiate governing body, on which a Control Commission depends.
• Directorate, the executive body, supported by a General Secretariat and two sub-directorates.

In July 2025, Order TDF/774/2025 delegated to the agency's directorate various budget and staff management powers. The order refers to payroll, general expenses, centralised procurement and petty cash, and does not mention powers over the test environment or subsidies.

Why it matters to a firm

As an adviser to clients

Companies that develop or use AI systems will have the agency as a supervisory counterpart. Firms that advise on technology, data protection or compliance need to follow its guides and criteria. We explain the timetable of European obligations, which was changed in 2026, in the new AI Act timetable.

As a user of tools

A firm that uses AI systems in its daily work may have, for the purposes of the European Regulation, the status of deployer, with the obligations the rule attaches to that role, starting with AI literacy measures for its staff. The guides of the agency and the Council of Bars and Law Societies of Europe help organise that use, as the CCBE guide on generative AI for lawyers sets out.

As a participant in tests

One of the agency's aims is to promote controlled test environments. Spain regulated one in 2023, which we analyse in the article on the artificial intelligence sandbox.

What to watch

• The guides the agency publishes, which will specify how it interprets the requirements.
• Its inspection and sanctioning activity, which will set the practical criteria.
• Coordination with other authorities, such as the data protection authority or the CGPJ itself in the judicial sphere.

More analysis on regulation and tools in the Legal AI section.