Trust and compliance · 2026-09-11
Spain's AI statute and AESIA: what changes if you consume an LLM API
Which EU AI Act obligations already apply, where Spain's organic AI bill stands, what AESIA supervises, and which parts land on a team that integrates a language model API rather than training one.
What applies today, and what comes later
Regulation (EU) 2024/1689 did not switch on all at once; its obligations arrive in tranches. The Article 50 transparency duties have applied since 2 August 2026, and they cover telling a person they are interacting with an AI system and marking synthetic content.
Systems already on the market before that date were given additional room to meet Article 50(2). The duties tied to high-risk systems land later still, on staggered dates running into 2027 and 2028.
For a product team the practical consequence is that there is no single date to remember. One has already passed and touches almost any product that generates text, images or speech; the later ones depend on what the system is used for.
The Spanish layer: AESIA and the penalty regime
The European regulation needs a national statute in each member state to designate authorities and set penalties. In Spain that is the organic bill on the good use and governance of artificial intelligence, approved by the Council of Ministers on 26 May 2026 and published in the official gazette of the Cortes Generales on 12 June 2026.
The text designates the Spanish Agency for the Supervision of Artificial Intelligence, seated in A Coruña, as the central supervisory body, and sets out the national penalty regime alongside regulatory sandboxes.
Worth stating precisely: as of this article's publication date it is a bill in parliamentary passage, not a statute in force. What already binds is the European regulation; the Spanish text settles who supervises and with what consequences.
Where an API consumer sits
Most teams reading this do not train models; they integrate one over an API. That usually places them on the deployer side rather than the general-purpose model provider side, which changes which obligations arrive directly.
It does not remove them. Telling the person they are interacting with an AI system, and marking generated content, falls on whoever puts the product in front of the end user. The model belonging to a third party does not move that conversation to the third party.
The other effect is documentary. A general-purpose model provider has to be able to hand technical information to whoever integrates the model downstream. If your provider cannot tell you which model answered and at what version, you cannot build your own documentation on top of it.
What to ask an API provider before you sign
These five questions are answered by documents or by an API call, not by a marketing statement. If one of them has no checkable answer, that is already an answer.
- The exact identity of the model that answers, with its version, rather than an alias that can move underneath you unannounced.
- What happens when a model is retired: a silent failure, an explainable error, or a redirect to something else.
- Which technical documentation from the original model the provider can pass on to you.
- Whether usage records let you reconstruct, months later, which model served a specific request.
- Who is controller and who is processor in your contract, in writing.
Frequently asked questions
Does the AI Act reach me if I only call an API from my application?
Usually yes, but as a deployer rather than as a model provider. The Article 50 transparency duties look at whoever puts the system in front of the person, and that is normally your application.
Can AESIA already fine me?
The organic bill designating AESIA and setting the penalty regime was in parliamentary passage when this article was published. The European regulation, by contrast, already applies in the tranches that have entered into force.
Does choosing EU-hosted models help with the AI Act?
They are separate questions. Where processing happens is a data protection matter; the AI Act looks at use, risk and transparency. EU hosting does not replace the transparency duties, and meeting them does not settle the transfer question.