The AI Act: what it requires of your company, and from when
Regulation (EU) 2024/1689 — the Artificial Intelligence Act · Updated: julio de 2026
What is it, and what does it require of you?
Regulation (EU) 2024/1689 (the AI Act) is the world's first law on artificial intelligence. Since 2 August 2026 it applies in full: any company using AI systems in the EU must inventory them, classify them by risk, train its staff (art. 4) and ensure human oversight, with fines of up to €35m or 7% of global turnover.
Who does it apply to?
To any company or public body that develops, sells or simply USES AI systems in the EU — including office copilots, chatbots, CV screening, scoring or content generators. There's no headcount threshold: it applies from the first AI tool in use.
Key dates
See also the Spain–Latin America compliance calendar.
Penalties
Compliance checklist
- Inventory every AI system in use (including shadow AI: the tools staff use on their own).
- Classify each system by AI Act risk level (unacceptable, high, limited, minimal).
- Document art. 4 training per person: who, when and on what content.
- Put recorded human oversight on every critical use (HR, credit, customer service).
- Review contracts with AI vendors: liability, transparency, data.
- Leave dated evidence of all of the above — the regulator won't ask for the manual, it will ask for the proof.
- A live inventory of AI systems classified by risk level, with an owner and a compliance status.
- Art. 4 training documented per person, with certificate, date and content version.
- Human oversight logged: every intervention becomes auditable evidence.
- Dashboards to show the regulator that your AI governance works.
Frequently asked questions
When does the AI Act take effect?
The AI Act entered into force on 1 August 2024 and applies in stages. The prohibitions and the training obligation (art. 4) have applied since 2 February 2025; from 2 August 2026 the Regulation applies in full and the penalty regime is operational.
What are the AI Act fines?
Up to €35 million or 7% of global annual turnover for prohibited practices; up to €15m or 3% for breaching the Regulation's obligations; and up to €7.5m or 1% for giving authorities incorrect information.
My company only uses ChatGPT or Copilot — does the AI Act apply?
Yes. The Regulation also binds deployers of AI systems: you must know which tools your staff use, ensure an adequate level of AI literacy (art. 4) and use them in line with their instructions — with particular care where people are affected (recruitment, appraisal, credit).
Who enforces the AI Act in Spain?
The Spanish AI Supervision Agency (AESIA), with the penalty regime operational since August 2026.
What is the article 4 training?
Art. 4 requires providers and deployers to ensure their staff have a sufficient level of AI literacy. In practice: training matched to the role, documented per person, kept current — and provable in an inspection.
For information only — this is not legal advice. Check dates and thresholds with your adviser.
This obligation is organised with an international management system standard. If your group is already certified, you have half the road done — and the same holds in the other countries where you operate.