Enterprise AI Agents for enterprises in Spain

Spain is the first EU country with a dedicated AI supervisor - and that changes the implementation plan

Spain is the only EU state with a fully operational national AI supervisor in AESIA (Agencia Espanola de Supervision de la Inteligencia Artificial). Headquartered in La Coruna, AESIA is Spain’s answer to the EU AI Act and takes on a role that is still distributed or unfilled in most other EU countries. For groups like Santander, BBVA, CaixaBank, Sabadell, Telefonica, Iberdrola, Repsol, Inditex, Mercadona, Ferrovial, ACS, Mapfre, Amadeus IT Group, Grifols and Naturgy this means: regulatory clarity earlier than anywhere else. The metropolitan areas of Madrid, Barcelona, Valencia, Bilbao, Seville and Malaga form the country’s main tech hubs - and all of them sit under the same unified AI supervisor. Building Enterprise AI in Spain means dealing with a regulator that knows what it expects and communicates it clearly.

The three regulatory hurdles for AI in the Spanish market

First, AESIA and the EU AI Act: AESIA has been operational since 2024 and is actively developing guidance on high-risk AI systems in the sense of EU AI Act Annex III. For HR decisions, credit scoring, biometric identification and critical infrastructure, AESIA expects documented conformity assessments, risk management, post-market monitoring and a complete Audit Trail. The Spanish advantage over other EU countries: Spanish groups already know today what will be expected of them in 2026 and 2027, while groups in Germany or France still wait for national implementation legislation.

Second, AEPD and LOPDGDD: the Agencia Espanola de Proteccion de Datos supervises GDPR in Spain, complemented by the Spanish Ley Organica de Proteccion de Datos y Garantia de los Derechos Digitales (LOPDGDD) and the LGICTE on AI transparency in consumer contact. For Santander credit scoring, BBVA AML operations or Telefonica recommendation systems, the AEPD expects documented legal bases, retrievable explanations and a traceable human final decision. The Spanish specificity: for algorithmic decisions in consumer contact, the LGICTE explicitly requires a transparency duty that does not exist in this form in any other EU jurisdiction.

Third, CNMV, Banco de Espana and CNMC for sector-specific supervision: Santander, BBVA, CaixaBank and Sabadell sit under CNMV (securities regulator) and Banco de Espana (bank supervisor). For MiFID-relevant recommendations, AML screening and underwriting, both authorities expect the same explainability and audit standards as BaFin or the FCA. The CNMC additionally oversees competition-relevant algorithmic decisions - a dimension that is becoming increasingly visible at Mercadona, Inditex and across the Spanish e-commerce landscape. Spanish groups with LATAM operations must additionally consider LGPD in Brazil and Argentine Data Protection Law 25.326.

Typical deployment scenarios in Spain

Santander and BBVA credit scoring: the large Spanish banks process millions of credit applications per year across Spain and LATAM. Document Agents extract structured data from application forms, the Decision Layer routes risk cases along the Banco de Espana thresholds, with Human-in-the-Loop on every final risk decision and an Audit Trail that holds up simultaneously for CNMV, AEPD and AESIA.

Telefonica consumer recommendation: Telefonica operates recommendation systems for tariffs, content and value-added services across several Spanish- and Portuguese-speaking markets. Decision Agents review every recommendation against LOPDGDD, LGICTE transparency requirements and LGPD rules in Brazil - every served decision backed by a traceable rationale.

Inditex and Mercadona supply chain operations: Spain’s market leaders in fashion and food retail run highly complex supply chains. Workflow Agents classify orders, returns and supplier incidents, the Decision Layer routes escalations to human owners and logs every decision for internal audit and CNMC-relevant competition reviews.

Iberdrola and Naturgy grid operations: Spain’s energy majors use AI for grid optimisation, predictive maintenance and consumption forecasts. Document Agents extract safety and maintenance notifications, Workflow Agents classify anomalies by severity, with an enforced human final decision on safety-relevant findings - a requirement that AESIA explicitly imposes for KRITIS-relevant AI.

How Gosign serves all of Spain from Barcelona

Gosign operates its own office in Barcelona (gosign.es) as the regional hub for the Iberian Peninsula. The Spanish-Catalan team of project managers and engineers - native speakers, comfortable in every stakeholder language - covers all four main market regions in the country: Madrid as the corporate and regulator capital, Barcelona itself as the tech hub, Valencia as the industrial and logistics centre, and Bilbao as the Basque industrial heartland. On-site workshops, sprint reviews and steering run in Spanish, in Catalonia additionally in Catalan, in the Basque Country with Euskara-speaking stakeholders where helpful. Direct contacts with AESIA in La Coruna, AEPD and CNMV in Madrid run through the Barcelona team, and compliance documentation is delivered bilingually. Hamburg supplies technical architecture standards and the international coordination with German, Swiss and Dutch parent groups. For Spanish groups with LATAM operations - Santander, Telefonica, BBVA, Mapfre - the Barcelona team additionally couples with the Sao Paulo office (gosign.com.br), so that GDPR, LGPD and the Mexican LFPDPPP can all run on the same architecture.

Why Spain is a strong starting point for Enterprise AI

Spain has a structural advantage no other large EU market currently offers: regulatory clarity from a single central source. An AI agent built for a Spanish enterprise that withstands AESIA expectations today rests on an architecture that is already EU AI Act conformant - before other EU countries even have their national supervisors operational. For German, Swiss and Nordic groups with Spanish or LATAM subsidiaries, Spain is therefore often the first productive AI market - and Spanish AESIA conformity becomes the blueprint for the subsequent rollout wave into other EU countries. Cert-Ready by Design here means: an architecture that already meets today what the rest of the EU will only make binding from 2027. Spain’s pioneering role is not coincidental but deliberate - and a considerable location advantage for anyone starting now. More context on the EU AI Act and the Spanish implementation is available in the Governance area.