Spain AESIA
Real Decreto 729/2023 - Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial (AESIA Statute)
Establishes AESIA as Spain's national competent authority for AI supervision - the first such agency in the EU. Headquartered in A Coruña, Galicia. Creates voluntary certification framework for ethical AI systems.
Jurisdiction
Spain
ES
Enacted
Aug 22, 2023
Effective
Sep 3, 2023
Enforcement
AESIA (Agencia Española de Supervisión de Inteligencia Artificial), A Coruña
First EU AI supervision agency; fully operational since June 2024
Who Must Comply
This law applies to:
- • All public and private entities developing AI systems in Spain
- • Entities deploying or using AI systems in Spain
- • AI systems placed on Spanish market or producing effects in Spain
Capability triggers:
Exemptions
Defense/National Security
high confidenceCoordinated with Ministry of Defense
Conditions:
- • Defense purpose
- • National security purpose
Personal/Household Use
high confidencePurely personal or household use exempt
Conditions:
- • Personal use only
- • No commercial application
Closed R&D Environments
high confidenceResearch and development in closed environments
Conditions:
- • Closed R&D environment
- • Not deployed publicly
Safety Provisions
- • Primary authority for AI supervision in Spain
- • Coordination with AEPD (data protection), Ministry of Health, Labor Inspectorate
- • Voluntary certification framework for ethical AI systems
- • Testing environments to reinforce user protection
- • 51-article statute covering organization, competencies, personnel, governance
Compliance Timeline
Sep 3, 2023
Royal Decree entered into force
Dec 1, 2023
Governing Council constituted, Director appointed
Jun 1, 2024
AESIA became fully operational
Aug 2, 2025
Full sanctioning powers (pending national law)
Enforcement
Enforced by
AESIA (Agencia Española de Supervisión de Inteligencia Artificial), A Coruña
Penalties
Penalties pending regulatory determination
Full sanctioning capacity pending national AI law; will follow EU AI Act penalty framework
Quick Facts
- Binding
- No
- Mental Health Focus
- Yes
- Child Safety Focus
- Yes
- Algorithmic Scope
- Yes
Why It Matters
First EU AI supervision agency. Sets precedent for national AI governance. Coordinates with EU AI Act implementation. Spain positioning as EU AI regulation leader.
Recent Developments
AESIA fully operational since June 2024. Spain missed August 2, 2025 EU AI Act governance deadline due to parliamentary delays on national law. AESIA Director stated agency will prioritize warnings before fines.
What You Need to Comply
AESIA provides oversight and certification for AI systems. Mandatory compliance expected once national AI law passes. Focus on high-risk AI systems per EU AI Act framework.
NOPE can helpCite This
APA
Spain. (2023). Real Decreto 729/2023 - Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial (AESIA Statute). Retrieved from https://nope.net/regs/es-aesia
BibTeX
@misc{es_aesia,
title = {Real Decreto 729/2023 - Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial (AESIA Statute)},
author = {Spain},
year = {2023},
url = {https://nope.net/regs/es-aesia}
} Related Regulations
Digital Austria 2.0
Austria's digital sovereignty framework establishing Sovereignty Compass for AI audits and mandatory Digi-Check for all legislation.
Netherlands Algorithmic Framework
Netherlands' algorithmic risk assessment framework specifically addressing mental health chatbots in risk reports and requiring Fundamental Rights Impact Assessment (FRIA).
Austria AI Service Center
Austria's national AI authority established within RTR (Rundfunk und Telekom Regulierungs-GmbH) for EU AI Act market surveillance coordination.
Switzerland FADP
Switzerland's revised data protection law with Article 21 automated decision transparency requirements, human review rights, and fines up to CHF 250,000.
Portugal Digital Rights Charter
Portugal's Charter of Digital Rights with Article 9 requiring AI to respect fundamental rights and establishing algorithmic auditability principles.
Serbia PDP Law
Serbia's GDPR-aligned data protection law with profiling safeguards and DPIA requirements.