By clicking “Accept”, you accept that cookies will be stored on your device to improve site navigation, analyze site usage and assist in our marketing efforts. Consult our Cookie Policy for more information.
If your company already uses AI — or is about to — this interests you. El AI Act it is not “just another role”: it is the new regulatory framework that defines how we conceive, build, purchase and operate artificial intelligence systems in the EU. Here's a practical guide, designed for business and technology teams in Spain, to move from theory to action.
El European Artificial Intelligence Regulation (Reg. (EU) 2024/1689) is the world's first comprehensive law on AI. It came into force on August 1, 2024 And it will be fully applicable on August 2, 2026, with intermediate milestones: from February 2025 They govern prohibitions And the AI literacy, and since August 2025 The rules of apply governance and the obligations for general purpose models (GPAI). The systems of high risk embedded in regulated products they have an extended transition to August 2027.
The scope is very wide: it affects vendors (who developers/ “puts on the market”), importers/distributors and deployers (who uses AI in a professional context in the EU). There are assessed exclusions (e.g., non-professional military or personal uses), but for general business, applies.
The AI Act takes an approach risk-based: the greater the potential impact, more obligations.
Practices such as harmful cognitive-behavioral manipulation, the “social scoring” by authorities or the indiscriminate use of remote biometry in public spaces (with limited exceptions and guarantees). These prohibitions are apply since February 2, 2025.
It includes, among others, AI for biometry, critical infrastructures, upbringing, Employment/RR. HH., essential services (banking, health), law enforcement or justice. It requires a risk management system, data quality, technical documentation, human oversight, cybersecurity, post-marketing monitoring, CE marked and, for many cases, registration in the EU database. The deadlines are scaled between 2026 and 2027 depending on the type.
Obligations of transparency: report when a person interacts with AI, when the content is synthetic (deepfakes) or when it is used recognition of emotions or biometric categories in certain contexts. These obligations start at August 2025.
Most general-purpose software. Encourage codes of conduct and good practices, but without hard obligations of the Regulations.
Current news (July 2025): despite requests for extensions from large companies, the Commission has confirmed that there will be no pause in the calendar.
If your company uses or integrates foundational models (e.g., LLMs), the AI Act has specific rules:
For deployers (business users), even if the vendor complies, It doesn't exempt you: you must verify suitability of the use case, inform users when appropriate and ensure human oversight and proportional controls.
The fines for violating the AI Act are relevant:
Beyond the number, the reputational and operational risk is high: removal of systems, forced audits, impact on customer trust and talent.
Spain has created the AESIA (Spanish Agency for the Supervision of AI), with statute approved by RD 729/2023. AESIA will assume functions of market surveillance and national coordination of the AI Act framework, in line with other authorities (e.g., AEPD for data protection) and sector regulators (CNMV/Bde, Health, etc.).
Tu compliance program it must fit with the rest of the regulations: GDPR, NIS2 (cybersecurity), DSA/DMA (platforms), intake and sectoral rules (financial, health, mobility). The AI Act does not replace: It adds up.
AI in selection and evaluation It can be High risk: you must justify variables, monitor biases and ensure human oversight real (not “sticky”). Train recruiters in Explanability and informed decisions.
If you generate creatives or Copys with AI, prepare notices when necessary and Synthetic content label (deepfakes, voice, image). Adjust approval flows with human reviews.
The models of fraud detection, granting credit or ** risk scoring** usually fall into high risk: requires traceability, data controls, Explanability and CE marked when it applies.
If you integrate AI into regulated products (healthcare, automotive), the calendar is extended to 2027: coordinates with the manufacturer and plans conformity assessment.
Complying with the AI Act isn't about “papers”, it's about Reliability: better documented models, more explainable decisions and users who know what to expect. Start with Inventory, decide where you want to be in August 2025 and August 2026, and build a program that allows you innovate without shocks. At MBIT School we can help you design your compliance roadmap, train your teams and evaluate critical use cases.
Recommended next step: turn it into a 90-day project — if you want, we propose a workshop with your key areas (Business, Data, Legal and Technology) to land the plan in your company.
This article is based on official and updated sources at July 31, 2025, including the European Commission, EUR-Lex and specialized documentation. (European Digital Strategy, EUR-Lex, Whitecase.com, Artificial Intelligence Act EU, Artificial Intelligence Act EU, Artificial Intelligence Act EU, BOE, aesia.digital.gob.es, Reuters)
If your company already uses AI — or is about to — this interests you. El AI Act it is not “just another role”: it is the new regulatory framework that defines how we conceive, build, purchase and operate artificial intelligence systems in the EU. Here's a practical guide, designed for business and technology teams in Spain, to move from theory to action.
El European Artificial Intelligence Regulation (Reg. (EU) 2024/1689) is the world's first comprehensive law on AI. It came into force on August 1, 2024 And it will be fully applicable on August 2, 2026, with intermediate milestones: from February 2025 They govern prohibitions And the AI literacy, and since August 2025 The rules of apply governance and the obligations for general purpose models (GPAI). The systems of high risk embedded in regulated products they have an extended transition to August 2027.
The scope is very wide: it affects vendors (who developers/ “puts on the market”), importers/distributors and deployers (who uses AI in a professional context in the EU). There are assessed exclusions (e.g., non-professional military or personal uses), but for general business, applies.
The AI Act takes an approach risk-based: the greater the potential impact, more obligations.
Practices such as harmful cognitive-behavioral manipulation, the “social scoring” by authorities or the indiscriminate use of remote biometry in public spaces (with limited exceptions and guarantees). These prohibitions are apply since February 2, 2025.
It includes, among others, AI for biometry, critical infrastructures, upbringing, Employment/RR. HH., essential services (banking, health), law enforcement or justice. It requires a risk management system, data quality, technical documentation, human oversight, cybersecurity, post-marketing monitoring, CE marked and, for many cases, registration in the EU database. The deadlines are scaled between 2026 and 2027 depending on the type.
Obligations of transparency: report when a person interacts with AI, when the content is synthetic (deepfakes) or when it is used recognition of emotions or biometric categories in certain contexts. These obligations start at August 2025.
Most general-purpose software. Encourage codes of conduct and good practices, but without hard obligations of the Regulations.
Current news (July 2025): despite requests for extensions from large companies, the Commission has confirmed that there will be no pause in the calendar.
If your company uses or integrates foundational models (e.g., LLMs), the AI Act has specific rules:
For deployers (business users), even if the vendor complies, It doesn't exempt you: you must verify suitability of the use case, inform users when appropriate and ensure human oversight and proportional controls.
The fines for violating the AI Act are relevant:
Beyond the number, the reputational and operational risk is high: removal of systems, forced audits, impact on customer trust and talent.
Spain has created the AESIA (Spanish Agency for the Supervision of AI), with statute approved by RD 729/2023. AESIA will assume functions of market surveillance and national coordination of the AI Act framework, in line with other authorities (e.g., AEPD for data protection) and sector regulators (CNMV/Bde, Health, etc.).
Tu compliance program it must fit with the rest of the regulations: GDPR, NIS2 (cybersecurity), DSA/DMA (platforms), intake and sectoral rules (financial, health, mobility). The AI Act does not replace: It adds up.
AI in selection and evaluation It can be High risk: you must justify variables, monitor biases and ensure human oversight real (not “sticky”). Train recruiters in Explanability and informed decisions.
If you generate creatives or Copys with AI, prepare notices when necessary and Synthetic content label (deepfakes, voice, image). Adjust approval flows with human reviews.
The models of fraud detection, granting credit or ** risk scoring** usually fall into high risk: requires traceability, data controls, Explanability and CE marked when it applies.
If you integrate AI into regulated products (healthcare, automotive), the calendar is extended to 2027: coordinates with the manufacturer and plans conformity assessment.
Complying with the AI Act isn't about “papers”, it's about Reliability: better documented models, more explainable decisions and users who know what to expect. Start with Inventory, decide where you want to be in August 2025 and August 2026, and build a program that allows you innovate without shocks. At MBIT School we can help you design your compliance roadmap, train your teams and evaluate critical use cases.
Recommended next step: turn it into a 90-day project — if you want, we propose a workshop with your key areas (Business, Data, Legal and Technology) to land the plan in your company.
This article is based on official and updated sources at July 31, 2025, including the European Commission, EUR-Lex and specialized documentation. (European Digital Strategy, EUR-Lex, Whitecase.com, Artificial Intelligence Act EU, Artificial Intelligence Act EU, Artificial Intelligence Act EU, BOE, aesia.digital.gob.es, Reuters)
Have you been interested? Go much deeper and turn your career around. Industry professionals and an incredible community are waiting for you.
Conviértete en AI Compliance Officer y garantiza la conformidad regulatoria de los sistemas de IA en tu organización.
.avif)