Since 1 August 2024, the European Union has had the world’s first horizontal regulation dedicated to governing artificial intelligence: Regulation (EU) 2024/1689, known as the AI Act. This is not a directive that Spain must transpose piece by piece: it is a directly applicable regulation, meaning its obligations apply across the entire national territory regardless of whether Parliament is still processing the complementary organic law.
For any company that develops, markets, or simply uses artificial intelligence systems, this is no longer a matter for the future. It is a matter of deadlines — and the deadlines are pressing.
A regulation that applies in phases
The AI Act did not enter into force all at once. It is being rolled out in stages, each with its own package of obligations:
- 2 February 2025 — the absolute prohibitions in Article 5 enter into force.
- 2 August 2025 — obligations for general-purpose AI models take effect, and the governance and sanctions framework kicks in.
- 2 August 2026 — the key date for most companies: the full requirements for high-risk AI systems apply.
- 2 August 2027 — the final tranche, for high-risk systems embedded in already-regulated products (toys, machinery, medical devices).
In other words: what many companies perceive as “the new AI law arriving in August” is not the Regulation’s entry into force — that happened almost two years ago — but the moment its most demanding provisions are activated.
What is already illegal: the prohibited practices under Article 5
While the rest of the Regulation rolls out in phases, one part has been fully enforceable since February 2025: the list of AI practices that are absolutely prohibited throughout the Union, with no exemption for sector or company size.
These are not recommended best practices. These are red lines backed by their own sanctions regime. Here are the eight categories:
Manipulation and exploitation of vulnerabilities
Systems that use subliminal or deliberately deceptive techniques to alter a person’s behaviour in a way that causes them considerable harm are prohibited, as are those that exploit vulnerabilities linked to age, disability, or a specific economic or social situation.
Social scoring
Any form of “citizen scoring” that classifies individuals by their social behaviour and leads to disproportionate unfavourable treatment — or treatment applied outside the context in which the data were generated — is prohibited.
Predictive policing based solely on profiling
AI cannot be used to predict that a person will commit a crime based solely on personality traits or profiles, without support from verifiable objective facts. AI may assist a human assessment already grounded in real evidence; it cannot replace it.
Mass facial recognition by scraping
Building or expanding facial recognition databases by indiscriminately extracting images from the internet or from video surveillance circuits is a prohibited practice.
Emotion recognition in the workplace and in schools
Except for medical or safety reasons, systems that infer the emotions of employees or students may not be placed on the market or used for those purposes.
Sensitive biometric categorisation
Inferring race, political ideology, trade union membership, religious beliefs, or sexual orientation from biometric data is unlawful, except in very limited circumstances involving the labelling of lawfully obtained data.
Real-time remote biometric identification in public spaces
This is the prohibition with the most complex exception regime. It is only permitted for law enforcement purposes, in very specific circumstances — searching for victims of kidnapping or trafficking, imminent terrorist threats, serious crimes — and always subject to prior judicial authorisation, notification to data protection authorities, and annual reporting to the European Commission.
And the future Spanish law?
The Council of Ministers approved in late May 2026 the Draft Organic Law for the proper use and governance of Artificial Intelligence, currently at the amendment stage in the Spanish Parliament. This legislation does not introduce the European Regulation — which is already directly applicable — but completes the allocation of powers within Spain: it designates AESIA (the Spanish Agency for the Supervision of Artificial Intelligence) as the reference authority, establishes the domestic sanctions regime (up to €35 million or 7% of global turnover in the most serious cases), and incorporates obligations relating to the identification of synthetic content, among other developments.
While its parliamentary process is completed, the obligations of the European Regulation are already enforceable on their own. Waiting for Parliament to pass the Spanish law before taking action is not a prudent option.
What your company should review before 2 August 2026
- Inventory the AI systems in use, both proprietary and third-party, identifying the provider and purpose of each.
- Classify each system according to the Regulation’s risk levels: prohibited, high risk, limited risk, or minimal risk.
- Confirm that no system engages in the prohibited practices under Article 5, which have been enforceable since February 2025.
- Review contracts with AI providers, ensuring a clear allocation of responsibilities.
- Design internal governance: who oversees compliance, how it is documented, and to whom it is reported.
- Monitor the progress of the Spanish law, to anticipate the definitive sanctions regime and the competent authorities.
A conversation worth having now, not in July 2026
The European AI Regulation combines something unusual: a complex technical framework and a timeline that leaves no room for improvisation. For companies that already handle AI systems in recruitment processes, customer scoring, surveillance, or automated decision-making, the relevant question is not whether the obligations apply to them, but from when.
If you would like to review your company’s exposure to the Regulation, or need advice on the risk classification of a specific system, request an initial consultation.
Would you like to receive the next article in this series directly in your inbox? Subscribe to the blog.