Blog
Regulatory analysis of the AI Act and the GDPR for SMEs
What you can ask your tax advisor about AI — and what's not in their power to give you
For most Spanish SMEs, the tax advisor is the first place they ask. Some things it handles well, others depend on information only you have, and one thing no outsider can take on.
AI in logistics and transport: telematics, fatigue and the two boundaries you need to know
Routes, warehouse, ETA, telematics: the technological core of a logistics operator is minimal risk under the AI Act. The two boundaries that do need watching — the employment use of telematics and the fatigue camera — each have their own pathway, timeline and nuance.
What the Digital Omnibus changes in the AI Act
Regulation (EU) 2026/1744 amends the AI Act: high-risk obligations move to December 2027 and August 2028, while Article 50(1), (3) and (4) keep their date.
Your company's high risk probably isn't in your business: it's in HR
Almost everyone looks for high risk in the AI they use to produce. Annex III of the AI Act puts it somewhere else: in the systems that select staff and evaluate performance. And HR bought those, not operations.
How much does it cost to comply with the AI Act? Three scenarios with their hypotheses in view
Internal hours, subscription, external support and maintenance for 20, 80 and 300 employees, with every hypothesis declared. The inventory sets the cost.
The AI Act doesn't require you to keep an inventory. It's the precondition for almost everything that does
The word "inventory" doesn't appear once in the Regulation. And yet every obligation on deployers is written per system — none of them can be applied to a fleet nobody knows about.
The two new Article 5 prohibitions aren't 'category 9'
The Digital Omnibus added two prohibited practices concerning non-consensual intimate images and child sexual abuse material. They aren't appended at the end of the list: they're inserted as points (ba) and (bb), and their internal numbering isn't the Regulation's.
When an agent chains actions, who's responsible? Article 26(2) answers with three words
The AI Act requires assigning human oversight to people with the necessary competence, training and authority. The third is the one that gets skipped, and it's the only one that matters once the system has already acted.
AI literacy: the free resources AESIA promotes, and how to turn them into evidence
Meeting Article 4 doesn't require buying expensive training. It requires training that's adequate to the context and, above all, demonstrable. A practical walkthrough: choosing a resource, adapting it to how your company actually uses AI, and keeping the record someone will one day ask for.
An agent with broad permissions can drift outside its intended purpose without anyone deciding it should
Article 26(1) requires adopting technical and organisational measures to use the system in accordance with its instructions. With a system that suggests, the person who decides upholds that. With one that acts, the permissions do.