Spain: Data Protection Agency guidance on its authority to enforce EU's Artificial Intelligence Act

On 15 July 2025, the Spanish Data Protection Agency (AEPD) issued guidance clarifying that it can already act against prohibited AI systems that process personal data, before the EU Artificial Intelligence (AI) Act is fully in force. From 2 August 2025, supervisory and sanctioning provisions under Article 5 of the AI Act covering banned AI systems such as real-time biometric identification in public spaces, will begin to apply. Although Spain has not yet adopted its national AI law and the AEPD has not formally been designated as a market surveillance authority, it remains empowered to act in its capacity as data protection authority. It includes overseeing AI-driven data processing when it infringes on data protection rights. The AEPD advises organisations using AI to begin preparing for AI Act compliance and is assessing the internal resources it needs to fulfil future responsibilities under the regulation.