Spain unveils AI ‘good use’ law with €35m penalty ceiling

Spain is moving quickly to operationalise the EU AI Act with its own national ‘good use’ law, and the details matter. By hard‑coding fines up to €35 million or 7% of turnover, Madrid is signalling that AI misuse—especially around deepfakes, biometrics, and high‑risk applications—will be treated on par with major data‑protection or competition violations. The law also centralises supervision in AESIA and the data‑protection authority, and bakes in proportionality levers to avoid crushing startups, which is a non‑trivial design choice.

For the AGI race, this isn’t about frontier model weights so much as the operating environment. Spain is effectively piloting what a mature enforcement regime under the AI Act could look like: high sanctions, explicit human‑oversight requirements, and a bias toward corrective measures over punitive ones for smaller players. That will influence how both domestic and foreign labs roll out powerful models in the Spanish market, and will give Brussels a real‑world case study on whether AI Act enforcement can be both tough and innovation‑friendly. It also raises the bar for other EU members that haven’t yet translated the AI Act into national law—if Spain can turn a dense Brussels regulation into a coherent statute, pressure will build on laggards to follow.