If your business uses ChatGPT, Claude, a website chatbot or an AI automation, some EU rules already apply to you. This page brings together what applies today, what is coming, who supervises in Spain and which grants are open, with a link to the official source for each fact.
Last reviewed: 28 October 2026. We review this page every month and whenever something important changes. It is general information, not legal advice. See our editorial policy.
The 30-Second Summary
- The main law is European: the AI Act, Regulation (EU) 2024/1689. It applies directly in every member state, including Spain, without a national law.
- Already in force for almost every business: the banned practices, the duty to support AI literacy among staff and, since 2 August 2026, transparency, such as telling people a chatbot is an AI.
- What was delayed: the 2026 Digital Omnibus moved the high-risk rules to 2 December 2027 and 2 August 2028, and softened the AI literacy duty.
- In Spain: the AESIA agency supervises AI. The Spanish AI bill has lapsed in Congress, and the GDPR still applies to any AI use involving personal data.
- Grants: as of today, Spain’s Kit Digital and Kit Consulting calls are closed.
AI Act Timeline
Dates from the European Commission’s official timeline, which already includes the Digital Omnibus changes (Regulation (EU) 2026/1744, in force since 27 July 2026).
| Date | What applies | Does it affect a typical small business? |
|---|---|---|
| 2 Feb 2025 | Definitions, AI literacy (Article 4) and prohibited practices (Article 5) | Yes |
| 2 Aug 2025 | Rules for general-purpose AI models (the makers of large models), governance and national authorities | Rarely, not directly |
| 2 Aug 2026 | Most of the Act and its enforcement, including Article 50 transparency | Yes, if you use chatbots or publish AI-generated content |
| 2 Dec 2026 | Ban on systems generating non-consensual sexual deepfakes or child sexual abuse material; transitional deadline under Article 50(2) for generative systems already on the market | Only for developers of generative systems |
| 2 Aug 2027 | Each member state must have at least one AI regulatory sandbox running | No |
| 2 Dec 2027 | High-risk systems in Annex III, such as recruitment or creditworthiness checks | Yes, if you use AI for those purposes |
| 2 Aug 2028 | High-risk AI embedded in regulated products (Annex I) | Only for makers of those products |
What a Small Business Using AI Has to Do
The Act calls a business that uses an AI system under its authority a “deployer”, even if it did not build the system. That describes most small businesses. These are the duties that affect them most often.
1. Train your team (AI literacy, Article 4)
Since the Omnibus, Article 4 requires providers and deployers to “take measures to support the development of AI literacy” of their staff and of others using AI systems on their behalf. It adds that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” Before 27 July 2026 the wording asked them to ensure a sufficient level. The Commission and member states must now help, especially SMEs, and the Commission will publish practical examples.
For a small business, something proportionate and documented is enough: a short internal policy on which tools may be used and with what data, a training session for the people who use them and a record that it happened. Our AI literacy guide for small businesses has a role-based plan and a record template.
2. Tell people when they deal with AI or AI-generated content (Article 50)
- Chatbots and assistants: people must be told they are interacting with an AI system, unless it is obvious.
- Deepfakes: if you publish AI-generated or manipulated images, audio or video that look real, you must disclose that they are artificial.
- Text on matters of public interest: AI-generated text published to inform the public must be disclosed, unless a person reviewed it and someone holds editorial responsibility.
This applies from 2 August 2026, and the Omnibus did not delay it. More detail in our Article 50 guide for small businesses and our guide to EU AI Act compliance for AI agents.
3. Avoid prohibited practices (Article 5)
Banned practices include harmful manipulative techniques, social scoring and emotion recognition in the workplace or in education, except for medical or safety reasons. A tool that promises to “measure your employees’ mood” is a red flag.
4. Prepare for high-risk uses (from 2 December 2027)
Using AI to screen job applicants, evaluate employees or decide on a person’s credit falls under Annex III. You will have duties around human oversight, logs and informing the people affected. There is time until December 2027, but it is worth knowing before you choose a tool.
Fines
Under Article 99:
| Infringement | Maximum fine |
|---|---|
| Prohibited practices (Article 5) | €35 million or 7% of worldwide annual turnover |
| Other obligations, including Article 50 transparency | €15 million or 3% of worldwide annual turnover |
| Incorrect or misleading information to authorities | €7.5 million or 1% of worldwide annual turnover |
The higher figure applies in general, but for SMEs and start-ups the lower of the two applies.
Spain: Who Supervises and Where the National Law Stands
- AESIA: the Spanish Agency for the Supervision of Artificial Intelligence was created by Royal Decree 729/2023 and is based in A Coruña. It has published 16 practical guides on the Act, based on Spain’s first AI sandbox, which closed in June 2026. AESIA states that they are not binding.
- Spanish AI bill: the government sent the Organic Law on the good use and governance of AI (file 121/000096) to Congress in May 2026. Congress lists it as “Concluded (Lapsed)” as of 6 October 2026. The EU Act still applies; what is missing is national detail, such as the split of powers and the domestic penalty regime.
- Data protection: the GDPR applies to any AI system that processes personal data. In Spain the AEPD supervises it and has a guide on GDPR compliance for AI processing (in Spanish).
GDPR: Three Checks Before Using AI With Customer Data
- Data processing agreement (GDPR Article 28): your AI or automation provider must sign one with you. Free or consumer plans often do not include it.
- Where data is processed: transfers outside the EU need a legal basis. For example, Zapier stores data in the US, Make lets you choose an EU region and n8n Cloud hosts in Frankfurt. We compare them in Make vs Zapier.
- Automated decisions (GDPR Article 22): if AI alone decides something with legal or similarly significant effects on a person, such as rejecting an applicant, you need human involvement and a specific legal basis.
What changes between personal and business accounts in ChatGPT, Claude and Gemini, and what never to paste: GDPR and ChatGPT, Claude or Gemini at work.
Grants for Adopting AI in Spain
| Programme | Status (28 Oct 2026) | Source |
|---|---|---|
| Kit Digital | Calls closed | Acelera Pyme |
| Kit Consulting (advisory vouchers of €12,000 to €24,000 by company size) | Call closed | Acelera Pyme |
| Red.es C012/26-IA (AI ecosystems for start-ups and SMEs; associations and technology centres apply, not SMEs) | Open until 10 Nov 2026 | Red.es |
| SPRI Artificial Intelligence 2026 (industrial companies in the Basque Country, up to 60% and €100,000) | Open until 2 Nov 2026 | SPRI |
Details of each programme, including CDTI and EDIHs, are in our guide to AI grants in Spain for small businesses. We have not found an open national grant that a small business can apply for directly to adopt AI. Be wary of anyone offering to “process Kit Digital for AI” while the calls are closed. We will update this table when a new official call is published.
Checklist for a Small Business
- List the AI tools used in the business, including the ones people use on their own.
- Write a one-page internal policy: allowed tools, data that must not be entered and who reviews the output.
- Give short training to the people who use AI and keep a record (Article 4).
- If you run a chatbot or assistant, add a visible notice that it is an AI (Article 50).
- Label AI-generated images, audio or video that look real.
- Check that no provider offers prohibited features, such as employee emotion recognition.
- Sign a data processing agreement with every provider that receives personal data, and check where it hosts it.
- If you use AI in hiring or customer assessment, keep the final decision with a person and prepare for December 2027.
If you are just starting, our guide to AI agents for small business explains what to automate first and what it costs.
Frequently Asked Questions
Does the AI Act apply to a small business that only uses ChatGPT?
Partly, yes. As a user of an AI system, a small business must take AI literacy measures (Article 4), avoid prohibited practices (Article 5) and meet Article 50 transparency where relevant, for example when it runs a public-facing chatbot.
Is AI training for employees mandatory?
Yes. Since 27 July 2026, Article 4 requires measures to support the AI literacy of staff who use AI systems, without having to guarantee a specific level. There is no mandatory certificate.
Does Spain have its own AI law?
No. The organic law bill is listed as lapsed in Congress as of 6 October 2026. The EU AI Act applies directly in Spain anyway.
What is the maximum fine for a small business?
It depends on the infringement: up to €35 million or 7% of turnover for prohibited practices, and up to €15 million or 3% for other obligations. For SMEs, the lower of the two figures applies.
Are there open grants for AI in Spain?
As of 28 October 2026, Kit Digital and Kit Consulting calls are closed according to Acelera Pyme, and we have not found another open national grant that a small business can apply for directly.
Official Sources
- EUR-Lex: AI Act, Regulation (EU) 2024/1689
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- European Commission, AI Act Service Desk: implementation timeline
- AI Act Service Desk: Article 4 (consolidated as at 27 July 2026)
- AI Act Service Desk: Article 99 (penalties)
- AESIA: practical guides for AI Act compliance
- Spanish Congress: file 121/000096
- AEPD: GDPR compliance guide for AI processing
- Acelera Pyme: Kit Digital and Kit Consulting