The Council of Ministers has given the green light to the draft Organic Law for the proper use and governance of artificial intelligence. If you manage an ecommerce, an SME or a startup, this legal move puts you at a new liability scenario.
Even if you feel that AI is not yet part of your day-to-day life, regulations govern everything from the software you use to segment customers to automated screening processes, so its impact is immediate for any digital business.
What is the IA law and what changes compared to the European Regulation?
The AI Law in Spain is the tool that lands the European Regulation (RIA) in our country to cover the legal gaps that the European regulation did not specify. While Europe sets the general ethical rules, this Spanish law specifies the practical details: it designates the AESIA as the supervisory body and sets the specific system of fines to be applied in our territory.
On a day-to-day basis, this standard adds labor transparency obligations and human review. If you use algorithms to manage your team or decide about customers, the law obliges you to report this and ensures that anyone affected can demand that a physical person, not just a machine, explain and review the decision made by the AI.
In addition, the law focuses on practical safety, forcing the labeling of AI-generated content and adapting our courts to prosecute crimes such as deepfakes.
AESIA: the body that will enforce compliance
The Spanish Agency for the Supervision of Artificial Intelligence (AESIA), headquartered in A Coruña, will be the central body in charge of supervising compliance with the standard.
It will count with inspection and sanctioning capacity, The new law gives it the power to request information, inspect AI systems, demand corrective measures and activate the sanctioning regime. The agency expects to have 50 specialized analysts in place by the end of the year.
Depending on the sector, other agencies will also have competencesThe Spanish Data Protection Agency (AEPD) for issues related to biometrics and personal data, and the General Council of the Judiciary (CGPJ) in the judicial area.
How much can the fine be?
This is probably the point of greatest concern to entrepreneurs. Sanctions are staggered according to the seriousness of the infraction:
- 500,000 or 0.5% of turnoverminor infractions
- 15 M or 3% of worldwide turnoverserious infringements
- 35 M € or 7% of worldwide turnoververy serious infractions
The standard introduces flexibility in the applicationThe authorities may take into account seriousness, intentionality and recidivism. In addition, there are reductions for prompt payment and discounts if the company takes corrective measures before the end of the proceedings.
One of the most criticized aspects is that the public administration is exempted from financial penalties. If a public agency misuses a prohibited system, it will only receive a reprimand, while a private company, for the same infraction, could face sanctions in the millions of dollars.
How does this affect your ecommerce or digital business?
Having an online business means that you are probably already using, or plan to use, artificial intelligence tools: chatbots, recommendation engines, behavioral analysis, price personalization or content generation. The regulations will mainly affects the way you implement these technologies. to interact with your customers.
Transparency and human oversight
If you use AI systems in your online store, you are required by law to have algorithmic transparency. This means that, in certain cases, you must inform your customers that they are interacting with an AI, and ensure that there is human oversight behind you to review critical processes. It's not enough to deploy a chatbot and forget about it: someone on your team must be responsible for monitoring its responses and decisions.
2. Prohibited practices to avoid
Make sure your business's AI tools do not engage in any of these sanctioned practices:
- Subliminal manipulationYou cannot use systems that use imperceptible sounds or images to influence your customers' purchasing decisions without their consent. The law gives as an example a chatbot that detects people with a gambling addiction and encourages them to enter online platforms using these techniques.
- Exploitation of vulnerabilitiesAI cannot be used to alter the behavior of people who are vulnerable because of their age, disability or socioeconomic status in a way that causes them harm. This includes aggressive urgency strategies or dynamic pricing that takes advantage of specific profiles.
- Deepfakes of a sexual natureThe use of systems that generate false images or videos of sexual content without consent is strictly prohibited.
- Social scoring systems: AI cannot be used to rank or rate people based on their social behavior in a generalized way.
3. Obligations according to the risk level of your system.
Not all AI systems are subject to the same obligations. The standard classifies systems according to their level of risk:
- High risk (biometrics, systems that affect fundamental rights, etc.).): very strict documentation, auditing and human supervision obligations.
- Limited risk (chatbots, recommender systems)The user must know that he/she is interacting with AI.
- Minimal risk (spam filters, basic content recommendations): without additional specific obligations.
Facilities for SMEs and startups: what the law does for you
The law is aware that the requirements cannot be the same for a multinational than for a family-run online store or a newborn startup. That is why it introduces specific support measures:
Sandboxes or test environments
You will be able to access «controlled test sites» operated by AESIA for test your AI systems under supervision before launching them in the marketplace, ensuring that they comply with the law from day one. Ideal for startups that want to innovate without taking unnecessary legal risks.
Penalties proportional to the size of the company
The sanctioning regime specifically takes into account the size of your company in order to that the fines are not disproportionate with respect to your turnover. An SME with 10 employees will not receive the same penalty as a large corporation for the same non-compliance.
Reductions for prompt payment and corrective measures
If you make a mistake and act diligently to correct it before the file is completed, the rule provides for reductions in the penalty. Correction is prioritized over penalization.
When does it become effective?
The bill must now pass through Parliament and be published in the BOE to be legally valid in Spain.. However, he recalls that the European AI Regulation has already been in force since August 2024 and its first obligations have started to be applied progressively.
High-risk system bans are now enforceable, The obligations for the rest of the categories will be activated until 2026.
Minister Óscar López has defended that this regulation seeks to control the misuse of AI «without detracting from competitiveness, on the contrary», with the aim of making the law «the definitive step» so that the productive fabric can use technology safely and with clear legal support.
