1. Two-Pillar Framework

Pillar 1 - EU AI Act - Regulation (EU) 2024/1689 - Directly Applicable

Yes, Spain is subject to EU AI Act. Regulation EU 2024/1689 is an EU Regulation rather than Directive, which means it applies directly and in its entirety across every EU Member State, including Spain, without need for national transposition.

• In force 1 Aug 2024, phased obligations between 2 Aug 2025 and 2 Aug 2027
• Risk-based classification: Prohibited, High-Risk, Limited Risk, Minimal Risk
• One of key features is multi-stakeholder governance - law applicable both by European AI Office and by national authorities of 27 EU countries

Pillar 2 - Spanish National Law

A. AESIA - Agencia Española de Supervisión de la Inteligencia Artificial

• Created by Royal Decree 729/2023, located in A Coruña
• Operational since June 2024 - Europe's first dedicated AI supervisor
• Responsible for ethical use, transparency, compliance, market surveillance and sanctioning
• Pairs market surveillance with sandbox testing so banks and insurers can trial high-risk systems

B. Draft Organic Law on Proper Use and Governance of AI - Approved by Council of Ministers 26 May 2026

• On 26 May 2026, Spain's Council of Ministers approved draft Organic Law on proper use and governance of artificial intelligence, aligning national law with EU AI Act
• Establishes structured governance framework, built around designated notifying authorities and market surveillance authorities
• Regulation covers four main areas: market governance and supervision, controlled testing environments, responsible AI use in public sector, and sanctions for violations of European AI Regulation
• Text published in Official Gazette of General Courts, does not replace European AI Regulation but translates key part of implementation into Spanish law: competent authorities, institutional coordination, sanctioning regime

2. Hybrid Governance Model - Who Supervises Finance AI in Spain?

Spain established hybrid governance model with AESIA as primary regulatory authority, but sectoral supervisors keep competence.

For AI systems not covered by sector-specific product frameworks, three bodies share responsibility: AESIA, AEPD and sector regulator.

For regulatory oversight, specific authorities are designated per sector: Central Electoral Board will oversee electoral systems, etc.

Also: Spanish Agency for AI Supervision has broad oversight responsibilities, it collaborates with specialised bodies like Spanish Data Protection Agency, Bank of Spain, and Central Electoral Board to monitor sector-specific AI applications.

3. What Finance AI is High-Risk Under EU AI Act?

Annex III, point 5:

High-Risk:

• (b) AI systems intended to be used to evaluate creditworthiness of natural persons or establish their credit score - exception for fraud detection
• (c) AI systems for risk assessment and pricing in life and health insurance
• Systems for solvency assessment of natural persons

Not High-Risk but Limited Risk: Robo-advisor providing investment recommendations - must comply with transparency, inform user they interact with AI.

Prohibited - Article 5: Social scoring - Prohibition of AI-enabled social scoring is among red lines established by EU AI Act targeting practices that assess or classify individuals based on social behavior or personal traits, leading to unfair treatment, particularly when information is drawn from multiple unrelated contexts or when resulting treatment is disproportionate. Example: Using social media behavior to score creditworthiness for loan = prohibited.

Obligations for High-Risk in Finance:

1. Risk management system, data governance (training data must be representative, free of bias)
2. Technical documentation Annex IV
3. Logs kept 6 months minimum
4. Human oversight - Human must be able to override
5. Inform individuals they are subject to automated process
6. Fundamental rights impact assessment
7. Conformity assessment before placing on market, CE marking, registration in EU database

Bank of Spain Circular 1/2025 already requires banks to document AI models used for IRB credit risk.

AESIA published practical guidance - Guides 13 and 14 - Specialised Technical Guides to support compliance with European AI Act.

4. Ethical Requirements Specific to Spain

• Transparency Law 2025: Spain enacted new legislation targeting misuse of AI-generated content. Strict requirement for companies to label AI-generated content, including deepfake images, videos, synthetic voices. Non-compliance could result in crippling fines up to €35M or 7% global annual turnover, whichever higher. Enforcement managed by AESIA.
• CNMV Study 13 April 2026: "Large Language Models and Stock Investing: Is Human Factor Required?" by CNMV research. Study emphasizes use of AI without human intervention carries significant operational risks. CNMV expects human-in-the-loop for investment advice.
• Regulatory Sandbox: Spain's RD Sandbox chose 12 projects Apr 2025 for controlled testing. Banks like BBVA testing fraud detection, personalised advice.

5. Case Laws - The Foundation for Ethical AI in Finance

Case 1: CJEU C-634/21 - SCHUFA Holding - 7 Dec 2023 - Most Important for Credit Scoring

So do the courts since CJEU C-634/21. SCHUFA's credit scoring was challenged because banks made final lending decisions, not SCHUFA. Court ruled when human gives algorithmic score a "determining role", score itself is automated decision.

Facts: OQ requested credit, bank refused based solely on SCHUFA score 85.89%. SCHUFA argued it only provides score, bank decides.

Held:

• Credit scoring used by banks still counted as automated decision-making when humans gave score determining role
• A credit agency's score on which third party's decision decisively depends is automated decision under Article 22 GDPR - prohibited in principle unless exception (explicit consent, contract necessity, law) and safeguards.
• Whoever produces decisive score can be Art 22 party, not just whoever acts on it

Impact for Spain: Every bank using external AI credit scoring (Equifax, Experian, internal ML) must comply with GDPR Art 22 + EU AI Act high-risk obligations + provide meaningful explanation. Banco de España now requires banks to prove human override possible.

Case 2: CJEU C-203/22 - Dun & Bradstreet - Feb 2025

Court affirmed data subjects must be provided with meaningful information regarding automated decision-making processes that use their personal data.

Spanish application: Under RD 255/2025 implementing eIDAS 2.0, if AI denies loan, bank must disclose logic, key features weighted, and how to contest. Failure = AEPD fine + AESIA sanction.

Case 3: CNMV / AEPD Enforcement in Spain - BBVA / CaixaBank Models

Almost 20% of Spanish firms report AI use in Banco de España survey - while top law firms pilot generative models.

CNMV 2024-2025 Common Supervisory Action on ESG and AI integration found banks using AI for fraud detection without documenting bias testing. Banco de España required remediation under Circular 1/2025.

Case 4: Social Scoring Prohibition - Interpreted via FPF Guidelines

Sector-specific scoring systems that assess social behavior across unrelated contexts prohibited. Example: Using retail shopping data + social network to price health insurance - prohibited under Art 5. Spain's AESIA first to investigate such case in insurance - DGSFP collaboration 2025.

Case 5: OQ v Land Hessen - C-70/25 German reference but applied in Spain

German case cited by Spanish Supreme Court STS 571/2025 in banking fraud context - establishes that sovereignty over authentication means (biometrics, eIDAS) belongs to user, not bank, and AI-driven authentication must be inclusive and advantageous.

6. Sanctions Under Spanish Draft Law

• Prohibited AI: €35M or 7% global turnover
• High-risk non-compliance: €15M or 3%
• Limited-risk transparency failure: €7.5M or 1%

AESIA can order withdrawal of AI system from Spanish market, and public inventory of public sector AI systems.