AESIA: Spain's AI Supervisory Agency, Explained

While most of Europe was still drafting the institutions that would police artificial intelligence, Spain quietly switched one on. AESIA — the Agencia Española de Supervisión de la Inteligencia Artificial — became Europe's first dedicated, operational AI regulator, opening its doors roughly six weeks before the EU AI Act even entered into force.

It also sits somewhere unexpected: not Madrid, but A Coruña, on the Atlantic coast of Galicia. This explainer walks through what AESIA is, why it landed there, the powers it now holds, the Spanish AI law it enforces, and how it fits into the wider EU AI Act machinery.

What is AESIA

AESIA stands for Agencia Española de Supervisión de la Inteligencia Artificial — the Spanish Agency for the Supervision of Artificial Intelligence. It is an autonomous public body attached to Spain's Ministry for Digital Transformation, tasked with supervising, inspecting, advising on and, where necessary, sanctioning the use of AI systems on Spanish territory (BOE, Royal Decree 729/2023).

Its founding act is Royal Decree 729/2023, of 22 August 2023, which approved the agency's statute. AESIA then became operational on 19 June 2024 — and that date is the headline. The EU AI Act entered into force on 1 August 2024, so Spain stood up its supervisory authority roughly six weeks ahead of the law it would help enforce. That makes AESIA the first dedicated AI regulator to actually open for business anywhere in the European Union, while other member states were still deciding which existing body to repurpose.

That first-mover position is not a footnote. Most countries are routing AI oversight through data-protection authorities or telecom regulators that already had full plates. Spain built a body whose only job is artificial intelligence — and gave it a head start. The agency's first director, Ignasi Belda, led the launch phase; since January 2026 it has been run by Alberto Gago.

Why A Coruña, not Madrid

Here is the detail people tend to double-check: AESIA is headquartered in A Coruña (La Coruña), a port city in Galicia, in Spain's far north-west. The agency sits in the restored "La Terraza" building, on premises ceded by the city council (BOE, Royal Decree 729/2023). It is, as far as European AI governance goes, the only AI authority based outside its country's capital.

The choice was deliberately political and economic. In 2022 the Spanish government ran an open competition to decentralise new state agencies away from Madrid, spreading public investment and skilled jobs into the regions. A Coruña won the bid for AESIA against more than a dozen rival cities. The logic: anchor a high-tech institution in Galicia, build a local AI talent pool around it, and signal that AI policy in Europe doesn't have to be a capital-city affair.

It's a useful contrast with how the rest of the continent works. The European AI Office, the EU's central coordinating body for AI, sits inside the European Commission in Brussels. National authorities elsewhere tend to cluster in capitals. Spain put its AI regulator on the Atlantic — a decision that has given Galicia an unusual claim in the European AI conversation, and that fits the broader story of how AI is developing across Spain beyond Madrid and Barcelona.

Timeline and powers

AESIA's mandate didn't arrive all at once. The agency was set up first, then progressively armed with guidance, a regulatory sandbox and — eventually — the power to fine. The table below tracks the milestones that matter.

In practice, AESIA's powers fall into a handful of buckets. It supervises and inspects AI systems placed on the Spanish market; it advises government and industry on compliance; it runs a regulatory sandbox where companies can test high-risk AI under supervision before launch; and, since 2 August 2025, it can impose sanctions on those who break the rules.

The agency has tried to lead with help rather than penalties. In April 2025 it selected 12 projects for its first sandbox cohort — a controlled environment for testing high-risk systems against the EU AI Act's requirements. In December 2025 it published 16 practical guides aimed at translating dense legal text into something an engineering or compliance team can actually act on. That guidance-first posture matters for any organisation trying to navigate enterprise AI adoption in Spain.

The Spanish AI law and penalties

AESIA enforces two overlapping rulebooks. The first is the EU AI Act, which applies directly across all member states. The second is Spain's own national AI law, whose draft (anteproyecto de ley) the Council of Ministers approved on 11 March 2025. The bill adapts the EU framework into Spanish law, designates AESIA as the enforcement authority, and — crucially — sets the penalty regime (White & Case, 2025).

The headline feature is one Spain got there first on: a mandatory labelling obligation for AI-generated content. Announced in April 2025, it makes Spain the first EU country to write this duty into national law, with AESIA as the body that enforces it. Deepfakes and synthetic media that aren't clearly marked as AI-generated become a punishable offence.

The fines are steep, and tiered. The draft law sets penalties ranging from €500,000 to €35 million, or between 0.5% and 7% of global annual turnover, whichever is higher — with reduced caps for SMEs and start-ups (Euronews; White & Case, 2025). Failing to label AI-generated content is classed among the most serious infringements, sitting at the top of that range.

• Most serious infringements — including unlabelled AI content and banned practices — face the top band, up to €35 million or 7% of worldwide turnover.
• Serious infringements carry mid-range fines, scaled to the breach and the size of the operator.
• SMEs and start-ups benefit from reduced ceilings, so the absolute figures land lower for smaller firms.

One caveat worth stating plainly: as of June 2026 the Spanish AI law is a draft bill moving through the legislative process, not finalised statute. The EU AI Act, by contrast, already binds Spanish operators directly. Treat the penalty figures as the proposed regime and track the bill's passage before relying on the exact numbers.

AESIA and the EU AI Act

It helps to think of two layers. The EU AI Act is the EU-wide regulation: it defines the four risk tiers, the bans, the high-risk obligations and the rules for general-purpose AI. But a regulation needs hands on the ground in each member state to inspect systems and issue fines. That's the role AESIA plays for Spain.

Under the AI Act, every member state must designate a national market surveillance authority to oversee compliance within its territory. AESIA is Spain's designated authority — the body that checks whether AI systems sold or deployed in Spain meet the Act's requirements, and that enforces them. Above the national level sits the European AI Office in Brussels, which coordinates implementation across the bloc and takes special responsibility for the most powerful general-purpose models.

The reason AESIA gets so much attention is timing. Most member states were late to name and stand up their authorities; Spain had a dedicated one running before the Act took force. For companies operating across borders, that means Spain became one of the first places where the AI Act has a real, named enforcer with an address — and a body other European governments have watched as a model. It's a concrete example of the regulatory dynamics covered across our enterprise AI guide.

What it means for businesses

If you build, sell or deploy AI in Spain — or your AI's output is used there — AESIA is the authority you'll answer to. The practical takeaways:

• Know your tier. AESIA enforces the EU AI Act's risk tiers. High-risk systems (hiring, credit, biometrics, essential services) carry the full compliance load; most everyday AI does not. Mapping this is step one — see the EU AI Act explainer.
• Label generated content. Spain is first in the EU to make AI-content labelling a legal duty. If you produce synthetic media for the Spanish market, disclosure isn't optional, and the top fine band applies to failures.
• Use the guidance. AESIA's 16 compliance guides and its sandbox exist to lower the cost of getting it right. They're a faster route than reading the raw regulation.
• Watch the bill. The national AI law and its exact penalties are still moving through parliament — the EU AI Act already binds you, but the Spanish specifics may shift.
• Treat Spain as a bellwether. Because AESIA moved early, how it interprets and enforces the rules is an early signal of how AI regulation will play out across Europe.

For teams working through all of this in practice, the conversation increasingly happens in person. Spain's regulators, AI companies and enterprise teams meet at events like AI Summit Europe, where the people named on stages — our speakers — and the companies shipping AI products sit in the same room as the people writing the rules.

If this interests you

• Map the EU framework: the EU AI Act explained sets out the risk tiers AESIA enforces.
• See the national picture: AI in Spain tracks how AI is developing beyond Madrid and Barcelona.
• Operationalise compliance: the enterprise AI guide covers adoption and governance in practice.
• Meet the people writing the rules: browse the AI Summit Europe dossier, the speakers and the companies.

Sources

• BOE — Real Decreto 729/2023, de 22 de agosto, por el que se aprueba el Estatuto de la Agencia Española de Supervisión de Inteligencia Artificial
• AESIA — Agencia Española de Supervisión de la Inteligencia Artificial (official site)
• White & Case — AI Watch: Global regulatory tracker — Spain, 2025
• Euronews — Spain could fine AI companies up to €35 million for mislabelling content, 12 March 2025
• Regulation (EU) 2024/1689 (EU AI Act) — national market surveillance authorities and enforcement framework