The benefits of making decisions on the basis of mathematical calculations can be enormous in many sectors of life, but relying too much on AI, which inherently involves determining patterns beyond these calculations, may also cause injustice and restrict people’s fundamental rights. 

In fact, the use of AI systems compromises a wide range of fundamental rights, regardless of the field of application. These include, among others, the right to privacy, data protection, non-discrimination, and access to justice.

Paraphrasing Hans Kelsen, the Spanish Constitution (1978) lies at the peak of the pyramid of the legal system in Spain. Therefore, when using AI tools, at minimum the following articles of the Spanish Constitution should be considered: 

• Article 14: recognises the equality of Spaniards before the law and how they may not be discriminated against on account of birth, race, sex, religion, opinion or any other personal or social circumstance. 
• Article 18: point 1 guarantees “the right of honour, to personal and family privacy and to one’s own image”. Additionally, point 4 explicitly restricts “the use of data processing in order to guarantee the honour and personal and family privacy of citizens and the full exercise of their rights”. In this regard, the Constitutional Court concluded in its Judgment 94/1988 that Article 18.4 enshrines “an autonomous fundamental right to control the flow of information concerning each person”. This fundamental right is especially relevant as the right to privacy is particularly threatened by the use of AI.
• Article 24: recognises the right of all persons to obtain the effective protection of judges and courts in the exercise of their rights and legitimate interests. On this matter, although the processing of judicial data through so-called AI systems is likely to improve the transparency of the functioning of justice by improving the predictability of the application of the law and the consistency of jurisprudence, it should also be noted that such processes cannot be limited to algorithms and must take into account particular circumstances, thus ensuring the equality of data subjects before the law.

In terms of fundamental rights, Spain has been a world pioneer by presenting a “Charter of Digital Citizenship Rights”, a reference framework for navigating the digital environment in which we already live. This Charter was approved in July 2021 and seeks to update existing rights recognised in texts such as the Declaration of Human Rights or the Spanish Constitution, and adapt them to the new digital reality. Its section XXV recognises a set of rights in the context of AI that makes reference to non-discrimination, the obligation of transparency and the accessibility, usability and reliability that shall govern this technology. However, it is not (yet) a legislative text; therefore, it can only be understood within the existing legal framework.

In addition, Spain is a member of the Organisation for Economic Co-Operation and Development (OECD), and, therefore, has adopted the OECD Council Recommendation on AI. These principles promote AI that is trustworthy and that respects human rights.

Finally, it is worth mentioning the judgment of the Spanish Constitutional Court 76/2019 that repealed Article 58bis of the Organic Law on the General Electoral Regime, which allowed political parties to track the political opinions of citizens on the internet by means of AI systems. The High Court stated in its ruling its concern about the use of AI to manipulate the will to vote without the public being aware of it, by sending out propaganda, automatically tailored to their weaknesses and strengths. 

There are numerous examples of how AI acts autonomously at a creative and innovative level, both in scientific and in artistic environments, and within the latter, with respect to all disciplines, including literature and music. AI poses important legal challenges which, in intellectual property (IP) matters, involve determining whether creations generated solely by AI are protected by IP rights, and if so, who should be considered the holder of such rights. 

In order to address these IP issues that arise with respect to AI-generated creations in Spain, it is necessary to analyse whether those creations meet the requirements established by the Spanish IP legislation.

Law 24/2015 on Patents considers computer programs or ways of presenting information to be unpatentable (Article 4.4(a), (b), (c) and (d)), due either to their abstract nature or to their lack of technical character, depending on the case. In this sense, AI, as such, is not patentable, as it is a set of algorithms implemented in a computer system and therefore there is no technical function. However, as with software, AI would meet the requirements for patentability under Spanish law if it can be demonstrated that, by means of this technology, an invention allows a new technical aspect which implies an inventive step that can be attributed to this specific AI technology. 

The second question is whether the AI can be considered an inventor of a patentable creation. In this regard, Article 10 of the aforementioned regulation states that “the right to the patent belongs to the inventor (…)”. Given that the law links the status of inventor to the natural person — based on the conception that an invention is the result of human creativity — the AI, as such, cannot be considered an inventor.

Article 5 of Royal Decree-Law 1/1996, approving the Spanish Law on Intellectual Property, provides that “the natural person who creates a literary, artistic or scientific work shall be considered the author”. Additionally, Article 10 establishes that “all original literary, artistic or scientific creations (…) are subject to intellectual property”.

From the foregoing, it is clear that, under Spanish law and in accordance with the applicable doctrine and case law, the fundamental requirements that any creation must meet in order to be considered eligible for copyright protection are the following: 

• it must be the result of a creative act of its author who, in any case and ultimately, must be a natural person who imprints on such creation his or her artistic expression; and 
• such result must be original, in the sense that it must incorporate a minimum of “creative height” or novelty with respect to everything previously created.

Therefore, in Spanish law, copyright protection of creations made by AI is not possible, mainly due to the fact that creations that do not originate from a human being are not protected. The protection by copyright of these creations would require, at least, a substantial legislative change by way of extending the concept of “author” to entities other than natural persons.

As already explained, AI cannot be protected either by copyright or by patent protection under Spanish legislation. However, the Spanish system provides for an equally effective form of protection: trade secrets. Trade secrets are regulated in Law 1/2019, Article 1 of which establishes that any element or information that has the following characteristics can be considered a trade secret:

• it must be secret information, in the sense that it must not be generally known by the persons who may normally have access to that type of information;
• it must have a business value; and
• it must have been subject to measures to keep it secret.

In this sense, compilations of data, such as AI training sets, the expression of a programmer’s source code or other proprietary information used in AI technology can be considered information that is intended to be kept secret due to an economic or competitive advantage and, if it meets the above conditions, it can constitute a trade secret under Spanish law. In this regard, any disclosure of such trade secrets can give rise to different legal actions, including a claim for damages.

No ongoing cases to report.

The AI revolution may not only bring along risks of potential failure, misuse or discrimination, but can also directly affect privacy and an effective personal data protection. Spanish companies developing and implementing AI systems must address the risks associated with the uses of this technology as well as take into account data protection regulatory restrictions or prohibitions enshrined in Spanish legislation. 

In Spain, the right to data protection is developed in a regulatory framework that currently comprises the General Data Protection Regulation (EU) 619/2016 (GDPR) ([2016] OJ L119/1), and it is supplemented by Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), which fundamentally adapts Spanish legislation to the GDPR.

The LOPDGDD establishes a series of obligations and rights, which cover all processing of personal data, whether manual or computerised, and which must be especially considered in the implementation of AI technology. In this regard, it is worth noting its Title X which addresses the recognition of data subjects’ digital rights as enshrined in the abovementioned Article 18.4 of the Spanish Constitution.

Additionally, in 1992, the Spanish Data Protection Agency (AEPD) was created in order to promote and ensure compliance with Spanish data protection legislation. In relation to AI systems and data protection, the AEPD has issued the following guidelines:

• Guide to adapt products and services using AI to the GDPR (2020). 
• Guide on requirements for audits of data processing involving AI (2021). 
• Note 1/2019 on the processing of data relating to political opinions by political parties under Article 58bis of the Organic Law 5/1985. 

Given that Spain is a Member State of the EU, it is subject to the application of the GDPR. As the use of AI involves personal data processing, it entails the risk of non-compliance of the referred regulation if, for example, there is a lack of transparency about the way in which the personal data is processed or if personal data is used illegitimately.

Among all data subjects’ rights established in the GDPR, the right not to be subject to automated individual decisions is probably the one that may be most exposed by the use of AI technology. This right is intended to ensure that an individual is not the subject of a decision based solely on the processing of personal data (i.e. profiling) that produces undesired legal effects for the individual or significantly affects the individual in a similar way.

Profiling carried out by means of AI technology will certainly imply the processing of personal data that may be intended to evaluate personal features, in particular analysing or predicting aspects related to any individual’s work performance, economic situation, health, preferences or interests, reliability, or simply general behaviour.

Nevertheless, this data subject right will not be applicable when: (i) it is necessary for the conclusion or execution of a contract between any individual and a company; (ii) the processing of personal data is based on the individual’s consent; or (iii) it is authorised by the law of the EU or of the Member States and adequate measures are established to safeguard the rights and freedoms and legitimate interests of the interested party.

However, it is worth mentioning that when using the above referred exceptions, companies must always guarantee the data subject a right to obtain human intervention, to express a personal opinion and to challenge the automated decision.

Additionally, the above referred exceptions will not apply to special categories of data (Article 9.1 of GDPR), unless Article 9.2.(a) or (g) of GDPR is applied and appropriate measures have also been taken.

The availability of open data from public administrations is essential for the proper functioning of AI systems, as algorithms need to be fed and trained by data whose quality and availability allows for continuous improvement.

Thanks to the different initiatives undertaken in recent years, the already mentioned National AI Strategy highlights how Spain has become a European benchmark in the field of open data, stressing the role of the “Aporta Initiative”, a project launched in 2009 aimed at promoting the disclosure of public information and the development of advanced data-based services launched by the Ministry of Economic Affairs and Digital Transformation and Red.es, a public business entity.

This strategy also points out several key actions that can be taken in order to develop AI infrastructures in terms of open data. Among others, the development of a regulatory framework for open data, the definition of a strategy that ensures the access to public administration data and the creation of the Data Office at state level, which will coordinate all public administrations with a view to standardising the storage, access and processing of data.

Spain’s Digital 2026 Strategy further elaborates on measures and actions in AI and the data economy, including the creation of the Office of Data and the role of Chief Data Officer, the establishment of the AI Advisory Council, the publication of the Charter of Digital Citizenship Rights, and the approval of the National Language Technologies Plan. Other significant initiatives include the Strategic Project for Economic Recovery and Transformation (PERTE) “New Language Economy”, the strategic supercomputing project Quantum Spain, and the Spanish hub of GAIA-X, which supports the development of national sectoral data spaces and data management. The strategy also introduces the National Program for Green Algorithms (PNAV), a regulatory sandbox for the future European AI Regulation, the creation of the National Centre for Neurotechnologies, and the establishment of AESIA.

It is clear that the interaction of AI tools with voice and facial recognition enhances biometric information with a higher potential, but, in parallel, may also generate an extraordinary (not always positive) impact on the rights of individuals.

In Spain, it is worth mentioning the Report (36/2020) issued by the AEPD which analyses the use of biometric data for the purposes of facial recognition in online student tests. The legal report shows that consent on the part of the student can only be considered free and therefore valid when an equivalent alternative in terms of duration and difficulty has been offered. Additionally, said report proposes that when the legal basis for facial recognition of the students is in the public interest, this would require a regulation with the status of a law enabling it and providing specific safeguards for such processing.

In this respect, the AEPD issued in July 2021 a sanction against a renowned company in the retail sector for EUR 2.5 million due to the facial recognition system implemented by the supermarket company to prevent the entry of people who had been banned from accessing their shops by a judgment. The AEPD ruled that the processing of data based on facial recognition for identification purposes as implemented by the company was prohibited by the provisions of Article 9.1, as none of the exceptions set out in Article 9.2 of the GDPR for carrying out the referred processing were applicable.

The AEPD Guide issued in November 2023 on the use of biometrics for presence control sets strict criteria for compliance with the GDPR. It emphasises that biometric data processing, both for identification and authentication, is considered high-risk and includes special categories of data. For employment-related access control, a law specifically authorising the use of biometric data is required, and consent is not sufficient due to the power imbalance between employers and employees. Similarly, for non-employment-related access control, consent alone is not adequate. Additionally, the Guide mandates a Data Protection Impact Assessment before starting any biometric data processing and outlines technical and organisational measures to protect biometric data, including encryption, data minimisation, and ensuring the revocability of biometric templates.

As AI works on the basis of algorithms, the prevailing idea is that objective and neutral decision-making should be achieved and consequently become even more impartial than human decision-making by way of overcoming social and cultural prejudices. However, this may not always be the case. It has been shown that the data used in AI systems often reproduces human stereotypes and biases. 

There is no doubt that the use of AI for these purposes is in Spain — like any other activity — should be subject to compliance with the laws promoting equality and fighting discrimination. It should also be pointed out that in Spain there are also certain sector-led initiatives aiming towards the adoption of self-regulatory standards designed to prevent biases and discriminations by the application of AI in business processes based on already adopted Spanish general regulations on the protection of citizens’ rights against discrimination.

There is an increasing number of companies and public administrations in Spain that are taking advantage of the benefits offered by AI to automate processes. As an example, the VeriPol system estimates the probability that a crime report is false, while the VioGén system indicates the dangerousness of possible male abusers by determining decisions on pre-trial detention.

Law 15/2022 of 12 July 2022, on Equal Treatment and Non-Discrimination, covers AI and mass data management systems. Specifically, Article 23 outlines provisions related to AI and automated decision-making mechanisms. Within the framework of the National Artificial Intelligence Strategy, the Charter of Digital Citizenship Rights, and European AI initiatives, public administrations are encouraged to implement mechanisms ensuring that algorithms used in decision-making processes minimise biases, maintain transparency, and ensure accountability, whenever technically feasible. These mechanisms must include the design and training data, address potential discriminatory impacts, and promote impact assessments to identify any possible discriminatory bias. Public administrations are also mandated to prioritise transparency and interpretability in the design and implementation of these algorithms. Furthermore, both public administrations and private companies are urged to promote ethical, reliable, and fundamental rights-respecting AI, in line with European Union recommendations. Additionally, the promotion of a quality seal for algorithms is advocated to ensure standards and trust in AI applications.

In addition to the above, including the already-mentioned Article 14 of the Spanish Constitution, the following are the main regulations that guarantee the equality and non-discrimination of citizens that could be invoked in the event of the use of AI systems in violation of the referred fundamental right:

• Law 3/2007 for effective equality of women and men.
• Law 14/1986 of General Healthcare. Article 3 regulates that access to and provision of healthcare shall be carried out under conditions of equality, avoiding discrimination between women and men due to their physical differences or associated stereotypes.
• Royal Decree-Law 19/2018 on payment services and other urgent measures in financial sector. This law makes reference to equality and non-discrimination in relation to payment services throughout multiple articles.
• Workers’ Statute Law (Royal Legislative Decree 2/2015). Article 4.2 paragraph (c) recognises worker’s right not to be discriminated.
• General Law for the Defence of Consumers and Users (Royal Legislative Decree 1/2007). Consumers, in those cases in which they believe the principle of equality has been violated, have the right to know the justification for a company’s refusal to provide services or sell products to them. In the absence of a relevant explanation, the consumer may take action against the same as an infringement in accordance with Article 47.1, paragraphs (k) and (m).

Not applicable.

Competition in the digital economy has been evolving mainly due to the incorporation of innovations in business models and company strategy, as evidenced by the massive use of AI, machine learning and big data. In particular, as stated by the Spanish National Commission of the Market and the Competition as well as by the Regional Government of Catalonia Competition Authority, the use of AI entails radical changes in the functioning of markets, and poses a series of challenges for the defence of competition. Among others:

• data mergers or concentrations between companies handling large volumes of data, which can be comparatively more complicated to assess;
• the use of algorithms to set prices is becoming more widespread and, therefore, the possibility of algorithmic collusion increases; and 
• new barriers to market entry linked to AI may emerge, including access to data, given the essential contribution of data in the operation of algorithms.

At the present time, there are no final and formal administrative or judicial resolutions in Spain containing evidence of market abuses, algorithmic collusion or dark patterns caused by using AI technology.

In the field of trade, anti-trust and competition, the main Spanish regulations governing the application of AI are:

• Law 3/1991 on Unfair Competition;
• Telecommunications Law 9/2014; and
• Order ECC/2316/2015 (Spanish Economics and Competitivity Ministry) on obligations of information and classification of financial products. 

The adaptation of Spanish legislation to AI is still at a progressive and preliminary stage, taking into account the lack of understanding of the nature and functioning of AI that characterises this new technology. 

Regarding new regulatory initiatives in Spain, it is worth mentioning three key initiatives for Spain’s digital transformation that have recently been approved: 

• Draft General Law on Audio-visual Communication;
• Draft General Law on Telecommunications; and 
• The Charter of Digital Rights. 

There have been significant recent developments in terms of government strategy:

• The Royal Decree 817/2023 of 8 November 2023, establishes a controlled testing environment (AI regulatory sandbox) for trialling compliance with the European AI Act. This decree outlines conditions for access and admission, details the testing procedures, self-assessment processes, communication channels, and conditions for the sandbox’s termination. It also defines the rights and obligations of participants and the coordination with other entities.
• The Government’s approval of its Artificial Intelligence Strategy 2024. The Strategy, approved by the Council of Ministers in May 2024, is structured into three axes:
  • Axis 1: Strengthening capabilities for AI development. Focuses on enhancing supercomputing, sustainable data storage, language models, and specialised talent. Key investments include EUR 90 million for supercomputing and EUR 160 million for scholarships and training.
  • Axis 2: Facilitating the application of AI in the public and private sectors. Introduces the GobTech Lab for public sector AI projects and the Kit Consulting program for SMEs and freelancers, supported by EUR 300 million. It also includes a future Cyber Security Law and a EUR 400 million fund for AI solution development.
  • Axis 3: Promoting a transparent, ethical, and humanistic AI. Implemented through AESIA, this axis ensures AI adherence to ethical standards and transparency, certifying AI systems and engaging in international AI governance. The strategy emphasises sustainability and ethics in AI deployment.

The AI Strategy is coordinated by the Secretariat of State for Digitalization and Artificial Intelligence. It involves all the ministries of the Spanish Government and aims to oversee and monitor the implementation of AI measures. A new Interministerial Commission will ensure connectivity and digitalisation efforts are harmonised across the Spanish General State Administration.

• The Spanish Agency for the Supervision of Artificial Intelligence (AESIA) was established to position Spain as a leader in AI regulation. Its statute was approved in August 2023, followed by the constitution of its Governing Council in December 2023. The selection process for the agency’s director began in April 2024, aiming to appoint a highly qualified leader to steer its strategic initiatives. This agency anticipates the European AI Regulation, setting Spain at the forefront of AI governance in Europe.

8.1. Who is liable for the damages caused by AI?

Given that AI systems do not currently have legal personality in accordance with Article 322 of the Spanish Civil Code, the subject who created the AI, who must ensure in the training process that the system cannot learn things that could lead it to commit illegal acts or cause damages, shall be the civil liable party.

8.2. How can I guarantee that my AI system complies with the applicable legislation?

A prior legal assessment should be carried out to determine the potential impact of your AI system on the rights of individuals. On the basis of this assessment, you should take a series of steps in terms of transparency, non-discrimination and privacy in order to ensure compliance with the applicable legislation.

8.3. Can works created by AI be subject to IP protection? 

Under Spanish law, such protection is not currently possible as it would require a legislative change in order to broaden the concept of author or inventor to include parties other than human beings.