Artificial intelligence law in Spain: what changes for your game studio

Two different sets of rules that keep getting mixed up

The first clarification is the most important one, because everything else depends on it. Regulation (EU) 2024/1689, known as the Artificial Intelligence Act or AI Act, is a European regulation, and regulations apply directly in every Member State without anyone needing to transpose them. It is binding today, whatever the state of the Spanish parliamentary process.

The future Spanish law is not there to replace it or to repeat it. Its role is a different one: to designate which authorities supervise compliance with that Regulation in Spain, to set out the sanctioning procedure in line with Spanish administrative law, and to regulate the regulatory sandboxes. Put in more legal terms, it is a governance and enforcement statute, not a substantive AI statute.

That distinction has an immediate practical consequence. When someone says "let's wait and see what the Spanish law says", they are mixing up the two levels: the underlying obligation already exists, and what remains to be settled is who knocks on the door and under what procedure.

What already applies, and since when

The EU Regulation entered into force in 2024 and rolls out its obligations in stages. For a game studio, these are the two dates that matter:

• 2 February 2025: the prohibited practices and the AI literacy obligations become applicable.
• 2 August 2026: among others, the transparency obligations under Article 50 and the bulk of the governance and penalties regime become applicable.

In other words, the transparency obligations are not a matter for the future: they have been enforceable for days now. And they are precisely the ones that reach the everyday practice of a studio using generative AI.

Article 50: the notices you have to give

Article 50 of the Regulation lays down transparency obligations that boil down, in essence, to two ideas: the user has to know when they are talking to a machine, and they have to be able to know when content is not real.

Translated into a video game, this touches very specific scenarios that are commonplace today:

• Conversational NPCs powered by generative AI. If the player can hold an open-ended conversation with a character driven by a language model, we are looking at a system intended to interact directly with natural persons. The information that it is an AI must be given clearly, and the natural moment to do so is the first interaction or the game settings, not a paragraph buried in the terms of use.
• Assistants and support chatbots on the studio's website or inside the game client. It is the same scenario.
• Content generated or manipulated with AI that reproduces existing people, voices or images in a way that appears authentic. This is where synthetic dubbing, cloning an actor's voice and using a real person's likeness come in.

This obligation should not be read as a cosmetic formality. The notice is what fulfils the rule, so it cannot be watered down until it becomes irrelevant: if the player never actually finds out, the obligation is not fulfilled no matter where the sentence sits.

There is a nuance that tends to be overlooked and that matters to studios: the obligation to label artificially generated content allows for exceptions for manifestly artistic, creative or fictional works, where transparency is satisfied in a way that does not hamper the display or enjoyment of the work. A video game is, by definition, a work of fiction. But that modulation is not a blank exemption, and it does not cover the use of a real person's voice or likeness, which in addition drags along its own problem of image rights and of the contract with the performer.

What the Spanish law adds

The Spanish text has already travelled a long road. The Council of Ministers approved the preliminary draft on 11 March 2025, the Economic and Social Council issued its opinion in March 2026, and the bill was approved at second reading on 26 May 2026 and sent to the Congreso de los Diputados. It is still going through Parliament, so its content may still change.

Its personal scope is deliberately broad: it reaches public and private operators acting as developers, deployers or professional users of AI systems. A game studio integrating a model into its product falls squarely within it.

The text respects the risk categorisation of the EU Regulation, distinguishing between prohibited, high-risk, limited-risk and minimal-risk systems, and deals with four blocks: governance and market surveillance, regulatory sandboxes, proper use of AI in the state public sector, and the penalties regime.

Who supervises: AESIA and the other authorities

The backbone of the system is the Spanish Agency for the Supervision of Artificial Intelligence (Agencia Española de Supervisión de la Inteligencia Artificial, AESIA), designated as the market surveillance authority for most systems and as the single point of contact before the European Commission. In practice, it is the door any proceedings will come through.

Alongside it, the model is one of distributed governance, with sectoral authorities keeping their competence within their own remit: the Bank of Spain and the CNMV in the financial sector, the Spanish Data Protection Agency for biometric and especially sensitive processing, and the General Council of the Judiciary for systems used in the courts. To stop that dispersion turning into legal uncertainty, a coordination committee chaired by AESIA is envisaged.

For a studio, the reading is simple: if the problem concerns personal data, your counterpart will still be the Spanish Data Protection Agency; if it concerns the conformity of the AI system, it will be AESIA. And nothing prevents one and the same event from triggering both.

Prohibited practices and high-risk systems

The Spanish legislator lines up with the prohibitions of the EU Regulation: real-time biometric identification systems in public spaces for law-enforcement purposes, systems that manipulate behaviour through subliminal techniques, systems that exploit vulnerabilities, and social scoring systems are all outlawed.

It does introduce a flexibility worth noting: the possibility of authorising real-time biometric identification in exceptional cases and subject to judicial authorisation, specifically in counter-terrorism, locating missing persons or preventing organ trafficking. Not every Member State has adopted that enabling clause.

For the video game sector, the relevant category is usually not high risk but limited risk, which is exactly where the transparency obligations live. That said, two grey areas deserve a case-by-case review: emotion-recognition systems and those analysing the player's biometric features, which do receive specific and more demanding treatment.

Deepfakes and digital impersonation

This is the change with the most practical mileage. The Spanish text expressly classifies as a serious infringement the creation and dissemination of AI-falsified content — what the bill calls "ultrasuplantación digital" (digital impersonation) — when done without the consent of the person affected or for purposes of manipulation or disinformation.

What matters is not only that it is classified as an infringement, but who it reaches: liability does not fall solely on the provider that develops the technology, but also on the user who employs it unlawfully. A studio that generates a well-known actor's voice for a trailer, or that builds a real person's likeness into a character, cannot hide behind the fact that the tool belonged to a third party.

To this you have to add what already existed and remains fully in force: the affected person's image and voice rights, and the contract with the performer. It is exactly the ground on which the open conflict between the industry and voice and motion-capture actors is being fought.

The penalties

The penalties scheme reproduces the EU one, adapted to Spanish administrative law and graded by seriousness. At its top tiers:

• Prohibited systems: up to 35 million euros or 7% of worldwide annual turnover, whichever is higher.
• Very serious infringements involving high-risk systems: up to 15 million or 3%.
• Serious infringements: up to 7.5 million or 2%.
• Minor infringements: up to 500,000 euros or 1%.

On top of that, additional measures are envisaged, such as immediate withdrawal of the system from the market or a ban on its use. For a studio, that ancillary measure can be far more serious than the fine: it means switching off a feature of the game with the title already released.

A note of realism is in order. These figures are designed for the big model providers, and the legislation itself requires proportionality. A small studio should not read them as its likely scenario, but it should understand that non-compliance carries real economic consequences, not merely reputational ones.

What to do in your studio

With all of the above on the table, the reasonable groundwork for a studio is short and very concrete:

• An inventory of AI uses. Which models are used, in which part of the game and of the pipeline, with which provider and under what terms. Without this, nothing can be answered.
• Review the notices to the player. Make sure clear information exists about AI-driven NPCs and assistants, somewhere the player will actually see it.
• Chain of rights in the generated material. What was trained, on what, and what the provider's terms say about ownership and commercial use of the outputs.
• Voices and likenesses of real people: written consent, with scope, duration and uses clearly delimited. The AI Act alone is not enough here.
• Document who decides. Human oversight is a principle of the Regulation and, in proceedings, it is evidenced with documents, not intentions.

None of these five things calls for multinational-grade compliance machinery. They call for half a morning and someone to write them down.

Frequently asked questions

Sources

• Regulation (EU) 2024/1689 on Artificial Intelligence (EUR-Lex)
• Bill on the governance of artificial intelligence (Congreso de los Diputados)
• Spanish Agency for the Supervision of Artificial Intelligence (AESIA)
• Ministry for Digital Transformation and the Civil Service