AI Act for companies in Spain: automating with AI while complying (2026)

If your company automates processes with AI agents, the AI Act for companies in Spain already affects you in 2026: it is the European regulation that classifies every AI system by risk level and assigns obligations according to that category, with application deadlines running since 2025. The good news: most typical SME automations —invoices, orders, reports, customer service— fall into the lighter categories, and compliance is perfectly feasible if designed from the start.

This guide is practical, not a legal treatise: what the AI Act requires based on what you automate, what the GDPR asks for when an autonomous AI agent sees personal data, where VeriFactu fits in if you touch invoicing, and why traceability solves most of the problem at once. At the end, you have a 10-question checklist for your provider. For your specific case, always validate with legal counsel: what follows gives you the map to make that conversation short and inexpensive.

What is the AI Act and since when does it apply?

The AI Act is the European artificial intelligence regulation: the world's first comprehensive AI law, in force since August 2024 and directly applicable in Spain, without the need for a national law to translate it. It does not regulate technology in the abstract but rather uses: the same model can be minimum risk in one process and high risk in another.

The deadlines are staggered, and by 2026 most of it is already in effect:

1. February 2025: prohibition of unacceptable risk practices and AI literacy obligation for personnel operating these systems.
2. August 2025: obligations for providers of general-purpose AI models (large language models) and governance and sanctions regime.
3. August 2026: the bulk of the regulation, including obligations for high-risk systems and transparency obligations.
4. August 2027: high-risk systems integrated into products already regulated by other rules (machinery, medical devices).

Fines scale up to 35 million euros or 7% of global turnover for prohibited practices, with lower brackets for other non-compliances. In Spain, AESIA (Spanish Agency for the Supervision of Artificial Intelligence) supervises, along with the AEPD regarding personal data. And a reassuring nuance: almost no Spanish company is an AI "provider" in the eyes of the regulation; most are users (deployers), and their obligations are significantly lighter than those of the system manufacturer.

Is your AI agent high risk? The four categories with examples

It depends on the use, not the technology: an agent that processes invoices is minimum risk; that same model screening resumes enters high risk. The AI Act defines four levels, and classifying your use cases is the first compliance exercise — half an hour of work that prevents scares.

Unacceptable risk (prohibited). Subliminal manipulation, social scoring of people, emotion recognition in the workplace. Practices that a normal company will not touch, but it's worth knowing they exist: they are prohibited since February 2025, with the highest fines in the regulation.

High risk. Uses that affect people's rights: recruitment (CV screening, promotion or dismissal decisions), access to essential services, creditworthiness assessment for granting credit. There are real obligations here: effective human oversight, risk management, technical documentation, and performance logs; as a user company, you must operate the system according to the provider's instructions, guarantee that human oversight, and keep logs. An agent that pre-selects candidates is the typical example in an SME: it can be used, but with these safeguards set up.

Limited risk (transparency). Chatbots must identify themselves as AI to the user, and content generated or manipulated by AI must be recognizable as such. If you have a customer-facing assistant, this is your main obligation: that no one believes they are talking to a person.

Minimal risk. The rest — which in practice is most internal automation: a accounts payable agent, bank reconciliation, order management, mail classification, report generation. No specific AI Act obligations beyond the general ones. Note: just because the AI Act doesn't require anything doesn't mean the GDPR doesn't; it applies whenever personal data is involved.

What does the GDPR require of an AI agent?

The GDPR doesn't change because you use AI: it requires the same things it always did —legal basis, minimization, safeguards with providers— but an agent puts it to the test because it processes data faster and with fewer human eyes involved. In practice, five points concentrate almost all the work:

1. Legal basis. Each processing activity the agent performs needs its own: performance of a contract for managing customer orders, legitimate interest for much of the internal automation, consent where applicable. If the manual process was already legitimate, the automated version usually inherits the basis; what you cannot do is take advantage of the change to use data for new purposes without reviewing it.
2. Minimization: what the agent sees. The agent should only access the fields it needs for its task. One that reconciles invoices doesn't need to see payroll; a support one doesn't need anyone's health data. This is solved with technical permissions, not promises in a document.
3. Where the data is processed. Ask which region the model runs in and where everything is stored. Large providers offer processing in the EU or international transfer guarantees (standard contractual clauses, EU-US Data Privacy Framework); the determining factor is that it is signed, not assumed.
4. Data Processing Agreements (DPA). Every provider in the chain that sees personal data —the model provider, the platform provider, your integrator— must sign one, and it must include that your data is not used to train their models.
5. Automated decisions. If the agent makes decisions with legal or significant effects on people (granting or denying something, filtering candidates), significant human intervention is required: someone with the real capacity to change the outcome, not an "accept all" button.

VeriFactu: if your agent issues invoices

VeriFactu is the Spanish regulation for invoicing software: from January 1, 2026, companies —and from July 1, 2026, freelancers— must invoice using programs that generate unalterable and chained records, with the option of direct submission to the AEAT. Generally, those already reporting through the SII are exempt.

For automation, the reading is simple: an agent that issues invoices must do so through invoicing software that meets these requirements, not by generating PDFs on its own. The agent operates the program —prepares the invoice, registers it, sends it— and the program guarantees integrity. Well set up, VeriFactu and automation get along well: the chained records required by the regulation are exactly the type of traceability that a serious agent already produces by default.

Traceability: a cross-cutting response to all three regulations

Traceability —that every action of the agent is recorded with date, data used, decision made, and result— is the answer that serves all three regulations at once. The AI Act asks for performance logs and human oversight; the GDPR asks for the ability to demonstrate compliance, not just comply; VeriFactu asks for integrity in invoicing records.

A well-built agent records every step: what it read, what it decided, what it wrote in which system, and who approved it. When an inspection occurs or a client exercises their rights, the answer comes from the log in minutes, not by reconstructing emails from eight months ago. We come from building systems with this level of traceability for regulated environments —hedge funds and family offices— and the lesson is transferable to any SME: compliance designed from the start costs little; compliance improvised later is very expensive. There is also a commercial effect: being able to show a large client or an auditor how every action is recorded is an advantage over a competitor who improvises, not just a shield.

Checklist: 10 questions for your AI provider

Before signing with an automation provider, these ten questions separate those who have compliance solved from those who will leave it on your plate. They complement the general criteria of our guide on how to choose an AI consultancy:

1. Which AI Act risk category does each proposed use case fall into, and why?
2. Where is my data processed and, if it leaves the EU, with what signed guarantees?
3. Do we sign a Data Processing Agreement (DPA) with every provider in the chain?
4. Is my data used to train third-party models? Where is it in writing?
5. What specific fields does the agent see and how is minimization technically applied?
6. Is every action of the agent recorded? Can I audit that record without asking you?
7. How is human intervention guaranteed in decisions that affect people?
8. If the agent touches invoicing, how does it fit with VeriFactu?
9. Do customer-facing assistants identify themselves as AI?
10. If regulations change, who adapts the system and at what cost?

If the provider answers all ten without hesitation —and in writing— you are on the right track. If any of them surprise them, keep looking: in our artificial intelligence consultancy, these answers are part of the design of every agent from day one, because incorporating them at the beginning costs a fraction of what it costs to add them later.

Frequently Asked Questions

Does the AI Act apply to SMEs or only to large companies?

It applies to all companies that use AI systems in the EU, regardless of size: what graduates the obligations is the risk of the use, not the turnover. The regulation provides for proportionality measures for SMEs, and in practice, an SME that only automates internal processes has minimal obligations.

What are the fines for non-compliance with the AI Act?

Up to 35 million euros or 7% of annual global turnover for prohibited practices, and lower brackets (up to 15 million or 3%) for other obligations; for SMEs, the lower of the two amounts applies. GDPR sanctions (up to 20 million or 4%) continue to apply in parallel.

Can I use models from American providers and comply with GDPR?

Yes. The determining factor is not the provider's nationality but the contract and configuration: processing in a European region when available, signed transfer guarantees, a DPA that excludes training with your data, and minimization of what the agent sees.

Do I need a Data Protection Officer (DPO) for using AI agents?

Using agents does not require it in itself: a DPO is mandatory due to the type of processing (large-scale systematic observation, large-scale sensitive data), not the tool. If you didn't need one before, automating the same process doesn't usually change that; if the agent expands what data you process or at what scale, review the assessment.

Who oversees compliance in Spain?

AESIA supervises the AI Act, AEPD everything related to personal data, and AEAT the VeriFactu invoicing requirements. In the same automation project, all three may be relevant — another reason why traceability should be unified and serve them all.