In order to guarantee the safe use of artificial intelligence in a company in Spain in 2026, 5 things are necessary: knowing which tools your team already uses, contracting with a provider with a business contract and guarantees about your data, establishing a usage policy, training everyone on their role and reviewing everything once a year. The EU AI Act and the GDPR are already in place.
In this guide we explain what is needed for each of them, what has been delayed and how to implement it in 90 days.
How AI is used in companies in Spain in 2026
33.6% of Spanish companies with 10 or more employees already use AI. This is according to the first quarter of 2026 data from the INE, the National Statistics Institute of Spain. In the first quarter of 2025 it was 21.1%. In companies with less than 10 employees it is 21.4%.
However, the reality is higher than the official data. In a study of 1,000 Spanish SMEs carried out by OpenAI, 70% of executives state that their employees already use AI on their own initiative, often with personal accounts. 39% of those SMEs still do not have a policy on what is allowed and what is not. We guess that probably more than 90% of SMEs do not have a policy.
This is the starting point of almost every company: AI is already inside, without a contract, without rules and without knowing what data has left the company.
What AI can do and cannot do in your company
Generative AI is very good at drafting, summarising, translating, classifying and searching documents. It is increasingly good at multi-step tasks with company tools. However, it is bad at guaranteeing that a fact is true. It can make things up with complete confidence. Therefore, for every use, it is necessary to have a person who reviews the result before it leaves the company.
| Area | Uses that work today | What to review |
|---|---|---|
| Marketing | Drafts of copy and ads, adapting a campaign for each channel, analysing customer comments | Brand tone, facts and promises about the product, image rights |
| Sales | Preparing meetings, drafting proposals, updating the CRM from emails and calls | Prices and terms before anything is sent |
| Customer service | Suggested replies, case summaries, FAQs | That it does not promise what the company does not offer; telling people they are talking to an AI |
| Operations and product | Requirements, supplier comparisons, weekly reports, task follow-up | Figures and commitments to third parties |
| Finance and admin | Classifying invoices and expenses, reconciliations, draft reports | Every amount that ends up in the accounts |
| People (HR) | Job ads, training plans, answers to internal questions | Not letting AI decide about people (see below) |
To see how far it can go, read how an AI agent acted as our product manager for nine months and what AI-native companies do differently.
What the law says: the AI Act in 2026
The EU AI Act is directly applicable in Spain, in stages. Most companies do not build AI but use it. In the regulation they are called deployers. Their obligations are few, but already in force.
The Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, delayed the obligations for high-risk systems and softened the training duty. The rest of the calendar did not change.
| From | What applies | Does it affect a company that uses AI? |
|---|---|---|
| 2 February 2025 | Prohibited practices, such as recognising employees' emotions at work or social scoring | Yes: don't do them |
| 2 February 2025 | AI literacy (Article 4), reworded in July 2026 as a duty to take measures | Yes: training and records |
| 2 August 2025 | Obligations for providers of general-purpose models (OpenAI, Google, Anthropic…) | Not directly |
| 2 August 2026 | Transparency (Article 50) | Yes, if you publish AI-generated content or have a public-facing chatbot |
| 2 December 2027 | High-risk systems in Annex III (previously August 2026) | Only if you use AI in those areas |
| 2 August 2028 | High-risk AI in regulated products (Annex I) | Only for makers of those products |
The full calendar, the fines and what each duty means in practice are in our guide to the EU AI Act in 2026.
Training your team (Article 4)
Every company that uses AI must take measures so its team knows how to use it: its limits, its risks and the company's rules. There is no official certificate and no minimum number of hours, but you should be able to show what training you gave and to whom. We explain it in detail in the Article 4 guide.
Transparency (Article 50)
Since August 2026, anyone who publishes an image, audio or video generated or manipulated with AI that looks real (a "deepfake") must say it is artificial. The same applies to AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and someone takes editorial responsibility. And a chatbot that talks to customers must make clear it is an AI; that duty falls on the system's provider, but if you put one on your website, it is worth checking.
High risk: where to look carefully
The regulation treats as high-risk, among others, systems used to select staff, evaluate or promote employees, decide on dismissals or allocate tasks based on each person's behaviour, and those that assess the creditworthiness of individuals. Their obligations apply from 2 December 2027. Asking AI to draft a job ad is not high-risk; letting it filter candidates is.
Who enforces it in Spain
Spain's AI supervisory authority is the AESIA (Agencia Española de Supervisión de la Inteligencia Artificial), based in A Coruña. The AEPD remains the authority for everything involving personal data.
The organic law bill that was meant to set Spain's penalty regime and divide responsibilities between authorities lapsed on 6 October 2026, when the Cortes were dissolved for the general election. A new government will have to present a new text. That suspends nothing: the EU regulation applies regardless, with maximum fines of €35 million or 7 % of worldwide turnover for prohibited practices, and €15 million or 3 % for the other obligations. For an SME, the lower of the two applies.
GDPR: what already applied, and still does
As soon as someone pastes a customer's email, a CV or a spreadsheet with names into an AI tool, the company is processing personal data, and the GDPR applies as it does to any other processing. In practice, that means:
- A data processing agreement with the provider (Article 28 GDPR). Personal and free accounts do not have one; business plans do.
- A legal basis for each use involving personal data, and informing the people concerned where required.
- Care with special categories of data (health, political opinions, ethnic origin, biometric data): the simplest rule is not to put them into AI tools unless the use has been assessed and authorised.
- International transfers. If the provider processes data outside the European Economic Area, the transfer needs a safeguard. For the United States, the EU–US Data Privacy Framework is still in force: the General Court upheld it in September 2025, although the appeal to the Court of Justice is pending. Know which safeguard your provider relies on, and have a plan if the framework falls, as the two before it did.
- A data protection impact assessment when the use may pose a high risk to people, for example when analysing employees or customers at scale.
- Not letting AI decide alone about people when the decision significantly affects them (Article 22).
In November 2025 the AEPD published its own internal policy for using generative AI. It was written for the agency, not for companies, but it is a good model of which questions to answer in writing. And if you are worried about what your team does with the tools it already uses, read why many teams do not trust corporate AI.
How to choose an AI provider: eight questions
The question is not which model is "the best" (that changes every few months), but what guarantees the provider gives you about your data and how much it costs you to switch models. Before you sign, ask for written answers to these eight questions:
- Is it a business plan, with an administrator and company accounts? If everyone uses their own account, the company controls nothing.
- Does it train models on our data? On the business plans of the large providers, the default answer is no; on personal accounts, it depends on each person's settings.
- Where is the data stored? Several providers now let you store it in Europe. OpenAI, for example, offers this for new ChatGPT Enterprise and Edu workspaces.
- Where does the model run? That is not the same as the previous question. Data can be stored in Europe and sent to another country to generate each answer. Ask about both separately.
- Is there a data processing agreement, and who are the sub-processors? Ask for the list and the safeguards for each transfer.
- How long is data kept, and how is it deleted? Including the files the team uploads.
- Can I use several models, or am I tied to one? Each model is better at different tasks, and prices and terms change. Depending on a single provider is a business risk.
- Who helps me roll it out, and in what language? A tool the team does not adopt is a cost, not an investment.
A 90-day plan for an SME
It does not need to be a big project. A realistic plan for a company of 10 to 200 people:
| Weeks | What to do | Result |
|---|---|---|
| 1 and 2 | Inventory: which AI tools each team uses, with which accounts and which data | A list, without blame |
| 3 and 4 | Choose the authorised tool using the eight questions above, and sign the data processing agreement | A provider and a contract |
| 4 and 5 | Write the AI usage policy: authorised tools, forbidden data, who reviews what | A two- or three-page policy |
| 5 and 6 | Training by role, and a record of who has completed it | Article 4 met, and provable |
| 6 to 10 | Two or three pilots with one metric each: hours saved, response time, proposals sent | Knowing what works, with data |
| 11 to 13 | Extend what works, stop what does not, and name an owner for each workflow | Real use, with an owner |
After that, review the policy and the training once a year, and whenever the tools change.
Common mistakes
- Banning AI. The team keeps using it from their phones and personal accounts, and the company loses control of its data.
- Thinking the AI Act only affects those who build AI. Training and transparency apply to those who use it.
- Confusing "stored in Europe" with "processed in Europe". They are two different questions, and you should ask both.
- Measuring use instead of results. The number of conversations says nothing; hours saved or customers served do.
- Letting AI decide about people, in hiring, evaluations or credit, without a person reviewing each decision.
Where P30 fits
P30 is an AI workspace for companies: Claude, GPT, Gemini and Grok in one place, with a shared company memory, roles and permissions. Your data is stored in the EU and never used to train models, and our team helps you roll it out, in English or Spanish. You can see how we handle data on our security page and in our data processing agreement, or talk to us.
Sources
- Regulation (EU) 2024/1689 (AI Act): Articles 3, 4, 5, 50, 99 and 113, and Annex III.
- Regulation (EU) 2026/1744 (Digital Omnibus), which delays high-risk obligations and amends Article 4.
- Regulation (EU) 2016/679 (GDPR): Articles 9, 22, 28 and 35, and Chapter V.
- INE: survey on ICT and e-commerce use in companies, first quarter of 2026, published 22 October 2026, and the first quarter of 2025 (in Spanish).
- OpenAI study of 1,000 executives of Spanish SMEs, reported by Europa Press on 17 September 2026.
- Congress of Deputies: bill 121/000096 on the good use and governance of AI, lapsed on 6 October 2026, and Royal Decree 806/2026 dissolving the Cortes.
- AESIA, the Spanish AI Supervisory Agency.
- AEPD: internal policy for the use of generative AI, November 2025 (in Spanish).
- General Court of the EU, case T-553/23, Latombe v Commission, judgment of 3 September 2025; appeal C-703/25 P.
- OpenAI: data residency in Europe.