Spain's AI bill lapses: what it means for your company

Spain’s bill on the sound use and governance of artificial intelligence — the law meant to spell out exactly who enforces the EU AI Act on the ground in Spain — has lapsed. Parliament’s dissolution, decreed on October 5, 2026 ahead of the November 29 general election, took file 121/000096 down with more than twenty other pending legislative initiatives. At Evicron, an AI and custom software studio in Barcelona, we had been tracking this bill since we covered the amendment deadline a little over a month ago. Here’s what actually changes for a company using AI today, and what stays exactly as it was.

What lapsed, and why

Royal Decree 806/2026, dated October 5, dissolves the Congress of Deputies and the Senate and calls a general election for Sunday, November 29, with campaigning from November 13 to 27 and the new parliament due to be seated on December 23 (ICAB). That’s the standard consequence of a snap election in Spain: any bill that hasn’t completed its full parliamentary passage dies with the dissolution, and has to be reintroduced from scratch in the next term if anyone wants to revive it.

The AI bill had been sitting in committee stage at the Economy, Trade and Digital Transformation Committee since June, with its amendment deadline extended several times after the closure we covered on September 2. The parliamentary record for file 121/000096 now shows it as lapsed, with a closing date matching the dissolution (Tercera Cámara). It never reached a floor vote.

What does NOT change: your obligations stand

This is the part that actually matters for a business, and it’s easy to confuse with the headline:

• Regulation (EU) 2024/1689 — the AI Act — applies directly across the whole EU on its own timeline and does not depend on Spain having a national law. What lapsed is the bill that would have divided enforcement duties among Spanish authorities, not the Regulation itself.
• AESIA can still fine you. As we explained when that power kicked in, since August 2, 2026 Spain’s AI regulator can demand documentation and issue fines for breaching Article 50 transparency duties — chatbots that don’t disclose they’re AI, unlabelled generated content, hidden deepfakes — up to €15 million or 3% of global turnover, and up to €35 million or 7% for the most serious breaches. That power comes from the EU Regulation, not from the lapsed bill, so nothing there has changed.
• AESIA’s 16 practical guides, updated in August after the Digital Omnibus package, remain the most complete Spanish-language reference for documenting an AI system, and they’ll stay available while a new government is being formed.
• The Annex III high-risk timeline — hiring screening, credit scoring, education — is still pushed to December 2, 2027, untouched by the Spanish bill lapsing.

What does stay on hold

The lapsed bill was meant to settle several loose ends that the EU Regulation leaves to each member state:

• The final split of enforcement powers between AESIA, Spain’s data protection authority (AEPD), the judiciary (CGPJ) and sector regulators (the central bank, the securities regulator, consumer protection) for AI used in justice or finance stays unresolved until a new text is drafted and passed.
• AESIA’s planned single complaints window — meant to let any company or person report a breach without first figuring out which agency to contact — doesn’t get formalized for now either.
• A Spain-specific penalty procedure, which mirrored the EU Regulation’s caps but with its own national process and appeals, falls back to whatever the AI Act already provides directly, without the extra layer the bill would have added.

None of this is a legal vacuum: the EU Regulation still covers the substance. What’s missing is the fine-grained national build-out, and that won’t happen before the new parliament is seated in December and a government decides whether to revive the same text or draft a different one.

What to do at your company while there’s no law

1. Don’t wait for the new government to comply. The obligations that were already enforceable in August — transparency, labelling generated content, chatbot disclosures — are exactly as enforceable today.
2. Keep using AESIA’s guides for whichever AI system concerns you most: they’re non-binding, but they’re the most operational material available, and they don’t expire with the bill.
3. If your system makes automated decisions about people (hiring, scoring, customer support escalation), set up your own internal complaints channel now: the public single-window system will take longer than planned to arrive.
4. Watch who inherits the digital transformation portfolio after the November 29 election: AESIA’s ministerial reporting line could change, and with it the pace of whatever comes next.

How we work on this at Evicron

We’re not a law firm, and the fine print of the Regulation is for your lawyers to interpret. Our part is the technical one: through our AI consulting for companies we audit which AI systems your company actually runs, apply AESIA’s guides to your specific case, and get the documentation ready for an inspection — lapsed bill or not. If you want the background first, we’ve also written about what AESIA is and about where the bill stood before it lapsed.

In short

Spain’s national AI bill lapsed with parliament’s dissolution on October 5, without ever reaching a floor vote. What hasn’t changed is what actually binds you today: the EU Regulation, the fines AESIA has been able to issue since August, and the agency’s practical guides. What’s on hold is the fine-grained split of powers among Spanish authorities, which will have to wait for the next term.

Want to know what’s still missing to comply with what’s already mandatory, lapsed bill or not? Get in touch: the first discovery session is free and we reply within 24 hours.