AI Agents for enterprises in Bilbao and the Basque Country

Bilbao is the only Spanish city where heavy industry and energy infrastructure demand AI compliance at the same time

The Basque Country is the industrial antithesis to the tourism-driven south of Spain. In Bilbao and the Bizkaia region sit Iberdrola - the global energy major with group headquarters at Torre Iberdrola - along with Petronor (the Repsol refinery in Muskiz), CAF (Construcciones y Auxiliar de Ferrocarriles) as a rail manufacturer, Tubacex and Sidenor in steel processing, and the Kutxabank group. BBVA has a historic Bilbao site and still runs significant operational functions there, and Euskaltel is the regional telecoms spine. Building AI in Bilbao means building for power grids, blast furnaces, train fleets and platforms whose downtime is counted in millions per hour, not for service industries.

The three regulatory hurdles for AI in the Basque market

First, the dual data protection regime. Spain is the only EU country with a regional data protection authority operating alongside a national one: the AVPD (Agencia Vasca de Proteccion de Datos) has jurisdiction over public bodies and some regionally anchored organisations in the Basque Country, while the AEPD (Agencia Espanola de Proteccion de Datos) covers the rest. Both authorities implement the LOPDGDD (Ley Organica 3/2018) and examine automated decisions with unusual rigour. Any work with personal data in the region has to consider both authorities inside the compliance architecture.

Second, the CNMV and Banco de Espana for the financial logic inside BBVA and Kutxabank. Both banks have relied on AI-supported risk models for years, but since 2024 the CNMV has required complete explainability for any model contributing to investment recommendations. Audit Trail, reproducibility and escalation paths for risk decisions are no longer negotiable.

Third, the EU AI Act together with industrial safety regimes. Iberdrola operates high-voltage infrastructure, CAF builds rolling stock - in both domains the EU AI Act’s high-risk categories (energy infrastructure, critical transport) combine with sector-specific safety standards (UNE-EN, IEC 61508). EU AI Act compliance here does not mean “check the data protection box”, it means “certify the AI model as a safety-critical component”.

Typical deployment scenarios in Bilbao

Iberdrola optimises smart-grid operations across multiple markets, with models determining which generators take which loads at any moment. Every decision is documented towards the regional grid operator; Audit Trails are a condition for market participation. BBVA develops risk-scoring models for credit decisions in the Basque mid-market, which must be justifiable to customers under Article 22 GDPR. CAF maintains train fleets in multiple European countries and uses telemetry data for predictive maintenance, with recommendations that must remain explainable to supervisory bodies in each operating country. Tubacex relies on AI-supported quality control in specialty steel production, where every automatic rejection decision must be defensible before major customers such as Aramco or Equinor.

Across all four scenarios, the topic is industrial AI with consequences for physical assets. The Decision Layer provides the architecture that wraps these decisions in an Audit Trail, Human-in-the-Loop escalation and Cert-Ready by Design. A Basque specificity matters: the cooperative tradition around Mondragon shapes even the non-cooperative enterprises in the region. Worker participation in technology decisions is not a compliance item here but part of the business culture. We build the Decision Layer so that the co-determination duties of the Comite de Empresa and the cooperative governance structures are met architecturally - not as an after-the-fact consultation but as an integrated workflow inside the system itself.

How Gosign serves Bilbao from Barcelona

Gosign handles Basque projects out of the Barcelona office (gosign.es) with Spanish-speaking project managers and engineers. The direct Barcelona-Bilbao flight takes around an hour, putting on-site meetings at Torre Iberdrola, the BBVA site, CAF in Beasain, Tubacex and the BEAZ cluster within one working day. The Spanish team supports Basque industry under the regional particulars: the dual data-protection regime of AVPD and AEPD, the cooperative Mondragon tradition with its co-determination structures, and the multilingual reality where Spanish and Euskara sit side by side in technical discussions. Where helpful we bring Basque-speaking stakeholders directly into workshops. Hamburg handles EU-wide compliance topics, architectural principle questions and the interface into German industrial compliance standards; operational delivery, the engineering language of Basque heavy industry and the shorter decision paths of the region stay with the Barcelona team.

Why Bilbao is a strong starting point for Enterprise AI

Anyone who takes an industrial AI pilot productive in Bilbao holds a reference case that has passed under dual data-protection supervision (AEPD plus AVPD), under CNMV standards and under EU AI Act high-risk logic - the bar is not higher anywhere else in Spain. The BEAZ cluster, Bizkaia Startup Bay and the Mondragon Innovation Hub provide the ecosystem, talent and pilot partners. Basque enterprises also come with a long-term temperament: AI projects are not planned as quarterly pilots here but as multi-year investments.

We bring the experience of building AI systems that not only function but remain defensible under audit conditions - with Governance by Design, an Audit Trail and the discipline that industrial compliance demands. Bilbao is the right market in which to scale that discipline across Northern Spain. There is also a geographic edge: from the Basque Country you reach both the south-French industrial belt (aerospace in Toulouse, pharma in Lyon) and northern Portugal (tech and industry around Porto). An AI architecture that goes productive under Bilbao conditions becomes a reference case for the whole Western European Atlantic arc.