Spain unveils tough AI governance law with €35m deepfake penalties

Spain’s AI law is the clearest example so far of what it means to turn the EU AI Act into a national operating system. It doesn’t just copy Brussels; it adds teeth. By explicitly banning sexual deepfakes and tying fines to up to 7% of global turnover, Madrid is signaling that abusive AI use will be treated more like antitrust or GDPR‑scale misconduct than a minor compliance issue.([servimedia.es](https://www.servimedia.es/noticias/gobierno-aprueba-una-ley-buen-uso-gobernanza-ia-multas-hasta-35-millones-euros/1412915482))

For companies building or deploying advanced models in Europe, this raises the compliance floor. Providers and large users now face not only EU‑level prohibitions on high‑risk systems but also a domestic inventory requirement for AI used in public administration and a mandatory “AI delegate” role to oversee governance. That pushes serious players toward more rigorous documentation, impact assessments and human‑in‑the‑loop safeguards even for non‑frontier models.([lamoncloa.gob.es](https://www.lamoncloa.gob.es/consejodeministros/referencias/Paginas/2026/20260526-referencia-rueda-de-prensa-ministros.aspx?utm_source=openai))

From an AGI‑race perspective, Spain is testing whether a “high‑regulation, high‑trust” model can coexist with rapid deployment. If the law manages to curb the worst abuses—like non‑consensual deepfakes—without stifling legitimate R&D, it could become a template for other EU states and Latin countries that want strong protections but still want access to top‑tier models. If, instead, enforcement proves heavy‑handed or inconsistent, we may see more cutting‑edge work and data centers gravitate to jurisdictions with lighter governance.