Two regulatory moves in a matter of weeks, one in Madrid and one in Brussels, and it pays not to mix them up, because they affect different deadlines.
In Spain, the Organic Law Bill on the proper use and governance of artificial intelligence, approved by the Council of Ministers on 26 May, entered Congress at the end of May and was published in the Official Gazette of the Cortes Generales on 12 June. As of late July it remains in parliamentary procedure, which means two things: it is not yet binding law, and the text can still change through amendments.
What does the bill do? It does not invent a new regime: it completes the application of the EU AI Act in Spain. It designates the national supervisory authorities (with the Spanish Agency for the Supervision of Artificial Intelligence, AESIA, at the centre), builds the national sanctioning regime and details the policing of prohibited practices. The fines contemplated reach 35 million euros or 7% of worldwide turnover for the most serious infringements.
Brussels, meanwhile, has adjusted the calendar of the AI Act itself. The digital omnibus package, endorsed by the European Parliament on 16 June and finally approved by the Council on 29 June, defers the high-risk obligations: those for Annex III systems (recruitment, credit scoring, education, access to essential services) move from 2 August 2026 to 2 December 2027, and those for AI embedded in regulated products (Annex I) to 2 August 2028.
What is not deferred is precisely what most people overlook: the transparency obligations of Article 50 apply from 2 August 2026. In practice, AI assistants that interact with clients must identify themselves as such, and AI-generated or AI-manipulated content must be labelled. The prohibitions (in force since February 2025) and the general-purpose model obligations (since August 2025) do not move either, and a new prohibition arrives on 2 December 2026 against systems generating non-consensual intimate imagery.
The practical translation for law firms, advisory firms and public administrations has four points. First: the high-risk deferral buys air but grants no exemption; this is the moment to inventory and classify systems with the calendar in your favour. Second: anyone running a public-facing AI assistant has an immediate transparency duty, not a 2027 one. Third: the Spanish bill deserves professional tracking, because the sanctioning regime, the allocation of authorities and the national particularities will come out of it, and the time to influence through amendments is now. Fourth: for law firms there is a double game, complying as an organisation and advising as a service, because every client with a chatbot, a recruitment tool or a credit-scoring system will arrive with questions.
The overall picture is clear: Europe is easing the pace on high risk while Spain sharpens its sanctioning regime. None of that changes the direction of travel; only the speed.
Sources
- The Government regulates artificial intelligence to ensure trustworthy, ethical use — La Moncloa, Council of Ministers, 26 May 2026
- Organic Law Bill on the proper use and governance of AI — Official Gazette of the Cortes Generales, 12 June 2026
- Spain's AI law 2026: fines and new obligations — INEAF
- EU AI Act Omnibus Agreement: postponed high-risk deadlines and other key changes — Gibson Dunn