The European Union's Artificial Intelligence Regulation (AI Act): legal implications, progressive implementation and direct applicability in Spain
Regulation (EU) 2024/1689 of the European Parliament and of the Council, laying down harmonised rules on artificial intelligence (AI Act), is the first comprehensive regulatory framework aimed at regulating the development, marketing and use of artificial intelligence systems within the European Union.
The Regulation entered into force on 1 August 2024 and is directly applicable in all Member States, including Spain, without the need for transposition into specific national law. However, its material application is gradual, establishing a phased timetable of obligations extending until 2027, with the aim of allowing organisations to adapt gradually to the new regulatory requirements.
In particular, the Regulation provides for the prohibition of certain artificial intelligence systems considered to be of unacceptable risk from February 2025, the application of specific obligations for general-purpose artificial intelligence models from August 2025, and the full enforceability of the requirements applicable to high-risk systems from August 2026, with certain additional obligations coming into force in August 2027.
The Regulation adopts a risk-based approach, classifying artificial intelligence systems into different categories based on their potential impact on fundamental rights, security and the interests of individuals. In this regard, it distinguishes between unacceptable risk systems, whose use is prohibited; high-risk systems, subject to strict requirements for evaluation, control, documentation and human oversight; limited risk systems, subject mainly to transparency obligations; and minimal risk systems, which are not subject to specific regulatory obligations.
From a legal point of view, it is important to note that, as this is a European Regulation in accordance with Article 288 of the Treaty on the Functioning of the European Union, its provisions are binding in their entirety and directly applicable in Spain, without the need for a transposition rule equivalent to a directive. However, the Spanish State may adopt complementary regulations to establish supervisory mechanisms, designate competent authorities, regulate sanctioning procedures and ensure the correct application of the Regulation at national level. In this context, the Spanish Artificial Intelligence Supervisory Agency (AESIA) will play an important role as a supervisory authority.
Companies that develop, implement or use artificial intelligence systems must comply with a set of legal, technical and organisational obligations, including, among others, risk assessment and management, the implementation of human oversight mechanisms, the preparation of adequate technical documentation, the assurance of the quality of the data used, compliance with the principles of transparency and the adoption of appropriate security measures.
Failure to comply with the obligations set out in the Regulation may result in the imposition of significant administrative penalties, which may reach up to 35 million euros or 7% of the infringing company's global annual turnover, depending on the nature and severity of the infringement.
It is therefore essential that companies analyse the current and planned use of artificial intelligence systems in their activities, assess their classification in accordance with the risk-based approach set out in the Regulation, and take the necessary legal, technical and organisational measures to ensure compliance with the new European regulatory framework within the established phasing-in deadlines.
APPLICABLE LEGISLATION
- Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence.
- Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).
- Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.
- Charter of Fundamental Rights of the European Union.
- Treaty on the Functioning of the European Union (TFEU).
| UE Reglamento 2024 de 13 Junio IA | 2617 KB |
