EU AI Act in Spain: timeline, risk classes, AESIA, fines and compliance costs for companies and startups

The EU AI Act — Regulation (EU) 2024/1689 — sorts AI systems by risk: prohibited, high-risk, subject to transparency duties, and everything else.

Prohibitions have applied since February 2025 and transparency since August 2026, while high-risk requirements now start in December 2027.

Fines reach €35 million or 7% of turnover. In Spain, AESIA supervises.

This guide covers who the EU AI Act applies to, which deadlines stand in November 2026 after the Digital Omnibus, how to work out your system’s risk class, and what Spain is doing: the AESIA agency, the regulatory sandbox and the national bill.

The second half is financial: what compliance costs, what fines a startup and a large company actually face in euros, how the AI Act changes due diligence and the valuation of an AI startup, and how to put it into a financial model.

Contracts, conformity assessment and dealing with the regulator are a lawyer’s job; here is what an owner or CFO needs to know.

What the EU AI Act is and who it applies to

The AI Act is Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence.

It entered into force on 1 August 2024 and, like any EU regulation, applies directly in every member state without national transposition.

A Spanish company must therefore comply now, even though Spain has not passed its own AI law.

Obligations follow roles.

The provider develops an AI system and places it on the market under its own name; it carries most of the burden — documentation, quality management, conformity assessment.

The deployer uses someone else’s system in its business: a bank with a credit-scoring model, a retail chain with an AI hiring tool.

Importers and distributors have their own duties. The regulation also reaches companies outside the EU when their system or its output is used in the Union.

Building the model yourself is not the test.

A startup that wraps a third-party language model into a candidate-screening product becomes the provider of a high-risk system, even though it did not train the model.

A company that simply buys that product is a deployer with obligations of its own.

How AI helps and hurts a startup day to day is covered in AI for startups: tool or trap; this article is about the rules.

EU AI Act timeline as of November 2026

Under the original text (Article 113), the regulation phases in: general provisions and prohibitions from 2 February 2025; general-purpose AI models, governance and penalties from 2 August 2025; most of the rest from 2 August 2026; AI in regulated products from 2 August 2027.

Those dates have moved.

The Digital Omnibus on AI was adopted as Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, and applies from 27 July 2026.

It does not remove obligations; it postpones the heaviest ones and simplifies some requirements.

Many online guides still say high-risk rules kicked in in August 2026 — that is no longer the case.

Two things follow for financial planning. If your product is high-risk, you have just over a year until 2 December 2027 — one or two development cycles and one funding round.

And if your product generates text, images or voice, transparency duties already apply; there is nothing left to postpone.

Risk classes: what is banned and what counts as high-risk

The regulation sorts AI systems into four groups. Prohibited practices are listed in Article 5.

High-risk systems are AI in regulated products (Annex I) and systems on the Annex III list.

An Annex III system is not high-risk if it performs a narrow procedural or preparatory task and does not materially influence the decision, but a system that profiles individuals is always high-risk; the provider documents its assessment and registers the system in the EU database.

Chatbots and generative AI carry transparency duties; everything else only needs staff AI literacy.

Deployers of credit-scoring and life and health insurance systems for individuals, as well as public bodies and private providers of public services, must assess the system’s impact on fundamental rights before use; after the Digital Omnibus this assessment can build on a GDPR data protection impact assessment, and the AI Office is preparing a template questionnaire.

For a Spanish bank, fintech or insurer, that is a cost line of its own, even when the model is bought in.

The AI literacy duty was softened by the Digital Omnibus: providers and deployers take measures so that staff working with AI understand it, but the law does not require them to guarantee any particular level of knowledge. The duty still exists and covers any company whose employees use AI.

Providers of general-purpose AI models — large language and multimodal models — keep technical documentation and a copyright policy; a model trained with more than 10²⁵ floating-point operations is presumed to carry systemic risk.

Their fines are set by the European Commission: up to €15 million or 3% of worldwide turnover.

A Spanish startup building on someone else’s model via API is usually not a GPAI provider; those obligations sit with the model developer.

AI regulation in Spain: AESIA, the sandbox and the national bill

AESIA. The Spanish Agency for the Supervision of Artificial Intelligence (Agencia Española de Supervisión de la Inteligencia Artificial) operates under statutes approved by Royal Decree 729/2023 of 22 August 2023 and is headquartered in A Coruña.

Spain was one of the first EU countries to set up a dedicated national AI supervisor.

The sandbox. Royal Decree 817/2023 of 8 November 2023 created a pilot regulatory sandbox.

The call opened in December 2024 and 12 high-risk systems from twelve Spanish companies were selected.

Based on the results, in December 2025 the government published practical guides — two introductory and thirteen on technical requirements — with self-assessment checklists.

The sandbox has concluded and its results report is published by the Ministry for Digital Transformation.

The guides are not binding, but they are the best free indication of how the Spanish regulator reads the requirements: quality management, data, cybersecurity, human oversight, incidents.

The national bill. The government approved a draft law on the proper use and governance of AI in March 2025 and on 28 May 2026 sent an organic law bill to Congress (file 121/000096).

The amendment period ran until 6 October 2026, the same day the decree dissolving parliament and calling a general election for 29 November 2026 was published, and on 4 November 2026 Congress formally declared the bill lapsed. The next government will have to start again.

The bill made AESIA the main supervisor and operator of the national sandbox, named the Bank of Spain as market surveillance authority for credit scoring of individuals at banks and financial institutions, and mirrored the regulation’s fine tiers: up to €35 million or 7% of turnover, up to €15 million or 3%, up to €7.5 million or 1%, and up to €500,000 or 0.5% for minor infringements.

The next draft will likely keep this structure, since it follows the EU regulation.

Until a law is passed, Spain has formally not set its penalty procedure — a reason to prepare, not to relax: the regulation’s requirements apply, and customers and investors are already checking them.

EU AI Act fines: what they mean in euros

The regulation sets three fine ceilings: for prohibited practices, up to €35 million or 7% of total worldwide annual turnover for the preceding year; for breaching the obligations of providers, deployers, importers and distributors or the transparency rules, up to €15 million or 3%; for supplying incorrect or incomplete information to authorities, up to €7.5 million or 1%.

A large company faces whichever is higher; SMEs and startups face whichever is lower.

The Digital Omnibus extended the “whichever is lower” rule to small mid-cap companies (SMCs), but only for the second and third tiers.

A small mid-cap is a new EU category: a company that no longer qualifies as an SME but has fewer than 750 employees and turnover of up to €150 million or a balance sheet of up to €129 million.

SMEs and SMCs can now use a simplified technical documentation form and a quality management system proportionate to their size. Here is what this means in money for three hypothetical companies:

These are ceilings, not tariffs: authorities weigh gravity, duration, the number of people affected and cooperation. For a startup, the fine is not the main risk anyway.

Stalled sales, a large customer who walks away because it is liable as a deployer, and a discount in the next round cost more.

EU AI Act compliance costs

There are no official figures after 2024; what exists are estimates prepared for the European Commission on the draft law. They are useful as orders of magnitude.

• European Commission impact assessment (2021): a maximum of about €10,000 per AI system for the provider — data, documentation, information to users — and, allowing for work companies would do anyway, around €6,000–7,000, or roughly 4–5% of an average development cost of €170,000. Review of the documentation by a notified body adds €3,000–7,500. Human oversight on the deployer side costs about €7,764 per system per year.
• CEPS study for the European Commission (2021): setting up a quality management system from scratch costs €193,000–330,000, plus around €71,400 a year to maintain. Companies that already hold ISO 9001 or medical-device certification spend considerably less.
• appliedAI (2023): of 106 enterprise AI systems, 18% were classed as high-risk, 42% as low-risk, and for 40% there was no clear answer. Legal classification is the first money a company spends, before any engineering.

The gap between €6,000 and €330,000 comes down to what was measured.

The first figure is the incremental cost per system in a company with mature processes; the second is building quality management from the ground up.

A startup with one high-risk product is realistically in a lighter version of the second scenario; a bank is in the first, multiplied by its number of models.

Worked example: budgeting for the AI Act in a startup’s financial model

A Spanish SL develops an AI CV-screening service for employers — high-risk under Annex III.

Annual recurring revenue is €4 million; the company is closing an €8 million Series A at a €32 million pre-money valuation (8x revenue), with monthly spend of €400,000 after the round.

All figures are hypothetical; costs are a guide for a small team without an existing quality system.

One-off costs plus two years of upkeep come to €490,000: 6.1% of the round, or 1.2 months of spend. The recurring part is 3% of revenue.

If the round closes in January 2027, about 10.6 months remain until 2 December 2027 — so compliance money belongs in the first quarters of the plan, not “later”.

What happens without the budget.

An investor who finds an unplanned high-risk product in due diligence may deduct the compliance cost from the valuation: €32 million minus €490,000 is €31.51 million, only 1.5% less.

More often, they ask for an escrow or a staged tranche: at 5% of the round, that is €400,000 the company cannot spend until the condition is met.

And doing compliance in a rush, when a large customer demands documents for a tender, pushes one-off costs up by roughly 40% to €350,000, while six months of delayed sales that lose a quarter of new deals cost about €500,000 of revenue.

A budget line in the model is cheaper than any of these outcomes. How a model with such lines is built is shown on our financial modelling page.

The AI Act in due diligence and AI startup valuation

Funds and acquirers already include the AI Act in their checks, even though the main deadline is December 2027. Typical questions:

• Role and risk class. Provider or deployer, whether the product falls under Annex III, and whether a “not high-risk” conclusion is documented. With no documentation, the investor prices in the worst case.
• Budget and timeline. Whether the financial model includes compliance costs and whether the company can meet the deadline at its current burn.
• Data. Rights to training data, GDPR consents, bias testing. Data problems often cost more than the AI Act itself and surface at the same time.
• Dependence on the model vendor. What happens to the product if the base-model provider changes its terms or fails its own obligations.
• Customer contracts. Who bears incidents and fines, and whether liability is capped. That is a lawyer’s work; the investor looks at the result — how much risk stays with the company.

The AI Act affects valuation in three ways. Through cash flow: compliance costs reduce EBITDA and lengthen the path to breakeven.

Through the discount rate or a discount to the multiple: unclear status reads as extra risk. And through deal terms: representations and warranties, escrow, staged funding.

For a mature company with its documentation in order, the effect runs the other way: AI Act compliance becomes a sales argument with large EU customers who are liable as deployers.

How to reflect this in the numbers is covered in How to value a startup; we review projects on the investor’s side in our startup due diligence for investors service and, for acquisitions, in due diligence in Spain.

Remedies for compliance promises that are not kept belong in the investor agreement.

The sandbox is a financial tool too.

Taking part does not exempt you from the law, but it opens an early dialogue with the regulator and produces documents that reduce uncertainty for investors.

Under the regulation, the national sandbox must be running by August 2027; watch for AESIA’s next call.

Other public programmes for founders are listed in Support programs for startups in Spain.

What a company should check: steps and common mistakes

1. Inventory your AI systems. Including those built into CRM, hiring and scoring tools your staff use.
2. Set the role for each system. Provider, deployer, importer; modifying someone else’s system and selling it under your name can make you a provider.
3. Set the risk class. Check Annex III and the AESIA guides; document any “not high-risk” conclusion.
4. Assess the gap. What exists — ISO, GDPR impact assessments, logs — and what must be built from scratch.
5. Put the budget and timeline into the financial model and round plan: one-off costs before 2 December 2027, recurring costs after.
6. Maintain documents and monitoring. Technical documentation, logs, incidents, staff training.

Common mistakes:

• Assuming the AI Act does not apply because Spain has no national law. EU regulations apply directly.
• Planning high-risk compliance for August 2026 or, the other way round, believing the Digital Omnibus scrapped everything. High-risk moved to December 2027; transparency already applies.
• Treating yourself as a mere deployer when you sell a product under your own brand on someone else’s model.
• Ignoring deployer costs: human oversight and fundamental rights assessments at a bank or insurer are recurring expenses.
• Showing investors a model with no compliance line while listing “AI regulation” as a risk with no number attached.

Frequently asked questions

What is the EU AI Act in simple terms?

It is Regulation (EU) 2024/1689, the first comprehensive law on artificial intelligence. It bans dangerous practices, sets strict requirements for high-risk systems such as those used in hiring and lending, and imposes transparency duties on chatbots and generative AI. It applies directly in all EU countries, including Spain.

When does the EU AI Act take effect?

It entered into force on 1 August 2024 and applies in stages. Prohibitions apply from February 2025, rules for general-purpose AI models from August 2025 and transparency from August 2026. After the Digital Omnibus, high-risk requirements apply from 2 December 2027, and from 2 August 2028 for AI in regulated products.

What did the Digital Omnibus change in the AI Act?

Regulation 2026/1744 moved high-risk deadlines to December 2027 and August 2028, softened the AI literacy duty, extended SME relief to small mid-cap companies, added a ban on non-consensual intimate deepfakes and pushed the deadline for national sandboxes to August 2027.

What are the fines under the EU AI Act?

Up to €35 million or 7% of worldwide turnover for prohibited practices, up to €15 million or 3% for breaching obligations and transparency rules, and up to €7.5 million or 1% for incorrect information to authorities. Large companies face the higher amount, SMEs the lower.

Does Spain have its own AI law?

Not as of November 2026. An organic law bill reached Congress in May 2026 but lapsed when parliament was dissolved. The EU regulation applies directly, AESIA supervises, and the next government will need to reintroduce the law.

How much does EU AI Act compliance cost a startup?

It depends on the risk class. Minimal-risk systems cost almost nothing beyond staff training. For high-risk systems, the European Commission estimated incremental costs of €6,000–7,000 per system, while building a quality management system from scratch was put at €193,000–330,000 by a CEPS study. Our hypothetical example comes to €250,000 one-off and €120,000 a year.

What is Spain’s AI regulatory sandbox?

A controlled environment where companies test AI systems with the regulator before going to market. Spain’s pilot under Royal Decree 817/2023 took 12 high-risk systems and produced published guides. Under the AI Act, every member state must have a permanent national sandbox running by August 2027.

Key points about the EU AI Act in Spain

• The AI Act applies directly in Spain; the absence of a national law does not exempt anyone.
• As of November 2026, prohibitions, AI literacy, general-purpose AI rules and transparency apply; high-risk requirements start on 2 December 2027.
• Fines reach €35 million or 7% of turnover, but startups and SMEs face the lower amount; the bigger financial risk is lost sales and a discount in the next round.
• Compliance for a high-risk product ranges from a few thousand euros with mature processes to hundreds of thousands when built from scratch; that line belongs in the financial model.
• Investors already check risk class, budget and data; good documentation turns the AI Act from a risk into a sales argument.

Sources

• Regulation (EU) 2024/1689 (AI Act) — EUR-Lex.
• Regulation (EU) 2026/1744 (Digital Omnibus on AI) — EUR-Lex, OJ L 24.07.2026; Commission Recommendation (EU) 2025/1099 on small mid-caps — EUR-Lex.
• Royal Decree 729/2023 (AESIA statutes) — BOE; AI sandbox — Ministry for Digital Transformation; guides from the sandbox — La Moncloa, 11.12.2025.
• Organic law bill 121/000096 — Congreso de los Diputados, text — BOCG A-97-1; Royal Decree 806/2026 dissolving parliament — BOE.
• European Commission impact assessment SWD(2021) 84 — EUR-Lex; CEPS on quality management system costs — CEPS, 2021; appliedAI risk classification study — appliedAI, 2023.