There's a reassuring idea circulating among many SMEs: "the AI Act doesn't fully apply to me yet, so I have time." The first half is debatable; the second is simply false. Because oversight of AI use in Spain didn't start with the AI Act. It started years ago, with a rule that has been fully in force all along and an authority that supervises it: the GDPR and the Spanish Data Protection Agency (AEPD).
AI is already covered by the GDPR
An AI system that processes personal data is, in the eyes of the GDPR, a processing activity like any other — with the added complication that it tends to combine the factors the regulation treats as highest-risk: new technology, systematic evaluation of people, decisions with significant effects. There's no need to wait for any AI Act date for that processing to be subject to oversight. It has been from day one of use. The five GDPR articles that weigh most in that processing are set out in a map of their own.
The AEPD is the authority that supervises that processing in Spain. These are four situations in which the GDPR already requires something when AI is involved, and all four are avoidable:
The impact assessment that was never done. The processing required a Data Protection Impact Assessment (DPIA, Article 35 GDPR) — because it processed special categories of data on a large scale, because it evaluated people systematically and extensively to take decisions with significant effects, or because it met the criteria on the AEPD's list — and the organisation deployed the system without carrying one out. It isn't a technical error: it's an omission of diligence.
Automated decisions without safeguards. Systems that decide on or profile people without the safeguards of Article 22 GDPR: no meaningful human intervention, no information given to the person affected, no way to challenge the decision. A scoring system that opaquely screens out candidates or customers runs up against those safeguards, AI Act or no AI Act.
Biometrics without a prior assessment. Processing biometric data — attendance control, identity verification — without first checking whether it requires an impact assessment, and without the proportionality judgement that processing a special category of data calls for. There is a concrete file behind this situation: PS/00120/2021, on a facial recognition system deployed in retail stores. The draft decision imputed five groups of GDPR articles: Articles 6 and 9 — lawfulness and special categories of data — at €2,000,000; 5(1)(c) — minimisation — at €500,000; 25(1) — data protection by design — at €500,000; 12 and 13 — information — at €100,000; and 35 — impact assessment — at €50,000 — and its operative part reads, literally: “DECLARAR la terminación del procedimiento sancionador […] sancionando a […] por la infracción de los siguientes artículos […] Prohibir todo el tratamiento de datos personales relativo al reconocimiento facial en sus establecimientos, de acuerdo con el artículo 58.2.f)” — the decision exists only in Spanish, the company name is elided here on purpose, and the full literal is in the source cited below. Any rendering of it in English in this piece is an unofficial translation. The file ended on 19 July 2021 through voluntary payment of €2,520,000 — an amount that already includes the 20% reduction, with a waiver of appeal.
And the split says more than the total: the impact assessment carried the smallest of the five fines. What was expensive was not the missing paperwork but the absence of a lawful basis for processing biometric data. Two further precisions: it is not a final sanction after contested proceedings but an early termination; and it is not a precedent on automated decisions, because Article 22 is not among those imputed. It is a case, not a rule.
Breaches involving data processed by AI systems. When data moves to external providers and services without proper security measures and data processing agreements in place, a breach stops being just a technical incident: the controller has to notify the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to people's rights and freedoms (Article 33).
What the AI Act changes (and what it doesn't)
The AI Act doesn't inaugurate AI enforcement in Spain: it expands it. Since 2 August 2025, the AI Regulation's governance — with its own authorities, designated under Chapter VII — and its own penalties regime have sat on top of the GDPR regime; and, on the Regulation’s general date of application, so has Chapter IX market surveillance, which also has Article 50 to supervise. In other words: the company that uses AI with personal data today already answers to the AEPD, and answers to the AI Act authorities too.
Read that way, the fear-based sales pitch ("get ready for the AI Act fines") falls short and arrives late at the same time. An SME's real exposure isn't in the future: it's in the present, and it has the names of GDPR articles that have been applying for years.
The common denominator: evidence
Looking at the patterns above, they all share the same root. What the GDPR asks is not that you stop using AI: it's that you can show you used it with due care. The assessment that doesn't exist, the safeguard that was never implemented, the data processing agreement that was never signed: these are, all of them, failures of documented diligence.
That's why sensible preparation isn't about waiting for the AI Act or stockpiling folders for when it arrives. It's about doing, right now, what the GDPR already requires: knowing which AI systems the organisation actually uses, assessing the ones that need it, putting safeguards in place wherever there are decisions about people, and keeping the evidence of all of it. Whoever has that in order will reach the AI Act with most of the work already done; whoever doesn't is already exposed today.
An honest starting point is to measure where you stand: our free situation diagnostic gives you that first snapshot in a few minutes. The snapshot isn't the evidence — but it tells you what's missing.
This article is for informational purposes only and does not constitute legal advice.