This article is for anyone in a Spanish company who uses, or plans to use, AI to organise, measure or monitor their staff's work: a tool that scores productivity, an agent that messages employees, a camera with analytics, fleet telematics. Before the AI Act, a Spanish law already reaches every one of those cases: Articles 87 to 91 of Ley Orgánica 3/2018 (LOPDGDD), the block on digital rights in the employment context.
The GDPR leaves room for rules like these: its Article 88 allows Member States to provide, "by law or by collective agreements", for more specific rules on the processing of employees' personal data. The five LOPDGDD articles do not talk about AI, but about devices, disconnection, cameras and geolocation. Each of them, though, has an AI case that falls squarely within it.
Article 87 · A tool that measures productivity
The case. A tool analyses corporate email, calendars or application use to score each employee's productivity.
What the Article says. Workers have the right to the protection of their privacy when using the digital devices their employer provides. The employer may access the content solely to monitor compliance with employment or statutory obligations and to protect the integrity of those devices. And there must be rules first: employers must set criteria for the use of digital devices, workers' representatives must take part in drawing them up, and workers must be informed of them.
In practice, that is a use policy with the criteria written down before the tool is switched on. And if the score is used to decide about people, another regime comes in: Annex III of the AI Act, point 4(b), covers systems intended "to monitor and evaluate the performance and behaviour of persons in such relationships". We cover it in high risk is not in your business, it is in HR.
Article 88 · An agent that writes outside working hours
The case. An AI agent handling tickets or orders messages employees at any hour, or assigns them tasks at eleven at night.
What the Article says. Workers have the right to digital disconnection outside their legally or contractually established working time. And the employer, after consulting workers' representatives, must draw up an internal policy setting out how that right is exercised and the training and awareness measures on a reasonable use of technological tools.
Disconnection makes no distinction between a message written by a person and one written by an agent. Configuring the agent's hours, and stating in the policy who answers for what it sends out of hours, is how it is respected.
Article 89 · A camera with analytics
The case. The warehouse cameras include analytics that count people, detect falls or flag behaviour.
What the Article says. The employer may process the images for the monitoring functions of Article 20.3 of the Estatuto de los Trabajadores, provided those functions are exercised within their legal framework and its limits, and must inform workers and, where applicable, their representatives beforehand, expressly, clearly and concisely; where the flagrant commission of an unlawful act is captured, the information sign of Article 22.4 of the same law is enough. Cameras and sound recording are never allowed in rest areas such as changing rooms, toilets or canteens. And sound recording in the workplace is only allowed where there are relevant security risks, with proportionality and minimal intervention.
Analytics add the AI Act layers. If the camera infers employees' emotions, it runs into Article 5(1)(f), which prohibits AI systems to infer the emotions of a natural person in the workplace, except for medical or safety reasons. If it identifies people by their face, it is biometrics, and there verification is not identification.
Article 90 · Fleet telematics
The case. Telematics records each vehicle's position, speed and braking, and a model uses them to score drivers.
What the Article says. The employer may process geolocation data for monitoring functions, within their legal framework. Beforehand, it must inform workers and, where applicable, their representatives, expressly, clearly and unequivocally, about the existence and characteristics of those devices, and about the rights of access, rectification, restriction of processing and erasure.
While telematics serves safety, that and the GDPR are the framework. When its data feed the evaluation of drivers, Annex III, point 4, comes back: it is the boundary we explain in AI in logistics and transport and on the logistics and transport sector page.
Article 91 · The collective agreement
The case. The applicable collective agreement, or the one being negotiated, deals with algorithms, geolocation or disconnection.
What the Article says: collective agreements may set additional safeguards for the rights and freedoms relating to the processing of workers' personal data and the protection of digital rights at work. The LOPDGDD safeguards are a floor, and the agreement can raise it.
What does not wait for 2027
None of the above depends on the AI Act timetable. The five articles bind any company with staff in Spain, whether or not the system is high-risk.
The AI Act will add its layer for high-risk systems. Its Article 26(7) requires deployers who are employers to inform workers' representatives and the affected workers before putting into service or using a high-risk system at the workplace. Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach Annex I, Section B products.
And part of that ground is already covered by Spanish law: the works council has the right to be informed of the parameters, rules and instructions on which the algorithms or AI systems are based that affect decision-making which may influence working conditions, access to and retention of employment, including profiling (Article 64.4(d) of the Estatuto de los Trabajadores).
What to have in writing
For each tool that touches your staff's work:
- Which article applies: devices (87), disconnection (88), cameras (89), geolocation (90).
- The criteria for use, written down and, where digital devices are involved, drawn up with the workers' representatives.
- The prior information to workers, dated, where there are cameras or geolocation.
- What the collective agreement says, in case it adds safeguards.
- Whether the system decides about people or evaluates them, because then the AI Act adds to all of this.
Related reading: since 5 October 2026, Spain's RD 723/2026 adds individual written information for each worker. From 5 October, your staff have the right to know which systems decide about their work.
Content in accordance with Articles 87 to 91 of Spain's Ley Orgánica 3/2018, Article 88 of Regulation (EU) 2016/679, Article 64.4(d) of Spain's Estatuto de los Trabajadores, and Articles 5 and 26 and Annex III of Regulation (EU) 2024/1689.
This article is for informational purposes only and does not constitute legal advice.