AI Act and GDPR: what they require of each department in your company

Almost everything marketing generates with AI is minimal risk and needs no notice, but anything that looks real and is not (altered photos, or realistic people, places, videos or voices) must be clearly disclosed from August 2, 2026. Rules on misleading advertising, consumer protection, the Spanish Information Society Services Act (LSSI) and image rights also continue to apply.

• Menu written or designed with AI Minimal
• Real photos enhanced without changing what is shown (cropping, color, lighting, sharpness) Minimal
• Real photos with elements changed or added with AI Transparency
• Photorealistic generated images of the premises, the product or the surroundings Transparency
• Clearly artistic illustrations created with AI Minimal
• Photorealistic invented people Transparency
• Videos with realistic people or places generated or manipulated with AI Transparency
• Cloned voice of a real person Transparency
• Landing page generated with AI (copy and design) Minimal
• Campaign chat on the website Transparency
• Text posts on social media written with AI Minimal
• Newsletters and commercial emails written with AI Minimal
• Translations made with AI Minimal
• Replies to reviews written with AI Minimal
• Algorithmically personalized prices Outside the AI Act

AI chat, WhatsApp assistants and AI phone systems must say they are AI from the first contact, and customers must be able to speak to a person. Analyzing the text of messages is minimal risk; inferring emotions from voice or face is high-risk where customers are concerned and prohibited where the company's own agents are concerned.

• Chat on the website or app that answers customer questions Transparency
• AI assistant on WhatsApp or messaging apps Transparency
• Voice agent that answers calls (AI phone system) Transparency
• Email replies drafted by AI and reviewed by a person Minimal
• Automatic replies sent without human review Transparency
• Classifying and routing inquiries or complaints with AI Minimal
• Text sentiment analysis (emails, chats, reviews) Minimal
• Analysis of customer emotions from voice or face High risk
• Analysis of agents' emotions from their voice or face (quality control) Prohibited
• Evaluating or scoring agents' performance with AI High risk
• Summaries and transcription of calls or meetings with customers Minimal
• Machine translation of conversations with customers Minimal
• Knowledge base or FAQs generated with AI Minimal
• Replies to public reviews with AI Minimal
• Cloned voice of a real person in the phone system Transparency
• Automated decisions about the customer (refusing a refund, blocking an account, scoring creditworthiness) Outside the AI Act
• Guest service chat or assistant (booking engine or third-party) Transparency
• Chat or assistant that receives queries and documents from clients of the gestoría (tax, accounting and labor advisory firm) Transparency

This is the department on which the AI Act imposes the most obligations: using AI to select staff, allocate tasks based on behavior, evaluate workers or take decisions about them is high-risk from December 2, 2027, and inferring the emotions of employees or candidates has been prohibited since February 2, 2025. The GDPR, the Spanish Data Protection Act (LOPDGDD) and the works council's right to be informed about algorithms already apply today.

• Writing job offers and job descriptions with AI Minimal
• Targeting who is shown a job advertisement High risk
• Screening or scoring CVs with AI High risk
• Summarizing a CV at the recruiter's request, without scoring or ranking Minimal
• Video interviews analyzed by AI (expressions, tone, “attitude”) Prohibited
• Chat for candidates or employees (holidays, payslips, policies) Transparency
• Allocating shifts or tasks based on behavior or personal traits High risk
• Shift rotas based only on availability and objective rules (collective agreement, rest periods) Minimal
• Evaluating workers' performance or behavior with AI High risk
• Deciding promotions, dismissals or working conditions with the help of AI High risk
• Emotion recognition of employees (cameras, voice, typing patterns) Prohibited
• Time and attendance control with biometrics (fingerprint, face) Outside the AI Act
• Monitoring of computer activity or geolocation analyzed with AI High risk
• Staff training in the use of AI Minimal
• Employees using free AI with data about colleagues or candidates Outside the AI Act
• Seasonal recruitment and rotas with AI in hotels, restaurants and retail High risk
• Gestorías (tax, accounting and labor advisory firms) that handle their clients' payroll and HR with AI Outside the AI Act

The AI Act imposes few obligations here, except when AI is used to evaluate the creditworthiness of natural persons (consumers and self-employed individuals) or to price life and health insurance: high-risk from December 2, 2027, with a fundamental rights impact assessment (FRIA) before first use. What already applies is the GDPR, directors' duties of secrecy and diligence, trade secrets and, depending on the company, anti-money laundering rules, DORA or market abuse rules.

• Dashboards and reports with AI Minimal
• Cash-flow forecasts, budgets and planning with AI Minimal
• Support for strategic decisions (investments, pricing, company acquisitions) with an AI chat Minimal
• Using general-purpose AI assistants with confidential financial information Outside the AI Act
• Summaries and minutes of board and general meetings from the recording Minimal
• Management report, press releases or investor information written with AI and published Minimal
• Using AI to evaluate the creditworthiness of customers who are natural persons (consumers, self-employed individuals) in order to grant credit, financing or deferred payment High risk
• Creditworthiness of customers that are companies (commercial risk, credit limits) Minimal
• Financial fraud detection (anomalous payments, forged documents in applications) Minimal
• Supplier evaluation with AI (risk, creditworthiness, ESG criteria) Minimal
• Anti-money laundering with AI: customer identification, list screening and alerts (obliged entities only) Minimal
• Insurance: pricing or underwriting life and health risks of individuals (insurers and intermediaries) High risk
• Financial entities using AI from external providers Outside the AI Act
• Listed company using AI with inside information Outside the AI Act
• Training management in the use of AI Minimal
• Board decisions supported by AI (directors' liability) Outside the AI Act
• Fraud detection in bookings and payments (hotels) Minimal
• Anti-money laundering and clients' financial data in gestorías (tax, accounting and labor advisory firms) Minimal

Reading invoices, bookkeeping, reconciling or preparing payments with AI is minimal risk. What governs here is commercial and tax law: the company is responsible for its accounts even if an AI keeps them, invoicing software must be adapted to VERI*FACTU, and B2B e-invoicing arrives on October 6, 2027, and October 6, 2028.

• Reading incoming invoices with AI and posting them automatically Minimal
• Digitizing paper invoices and destroying the original Minimal
• Automatic bank reconciliation with AI Minimal
• Proposing and approving payments (direct debit batches, due dates) with AI or an agent Minimal
• Detecting errors, duplicates or fraud in supplier invoices and payments Minimal
• Issuing invoices with AI or an agent (from the chat, from orders) Minimal
• B2B e-invoicing: issuing, receiving and reading structured invoices Minimal
• Keeping documents and records, including what the AI tool stores Outside the AI Act
• Personal data of self-employed suppliers and of employees in invoices, expenses and payments Outside the AI Act
• Drafting submissions to the Spanish Tax Agency (AEAT) or the Social Security with AI (information requests, pleadings, appeals) Minimal
• Filing with a digital certificate or letting an AI agent fill in forms on the electronic office (sede electrónica) Minimal
• Using general-purpose AI assistants with accounting or tax data Outside the AI Act
• Internal assistant that answers administrative queries from employees or suppliers (status of an invoice or payment) Transparency
• Year-end close and annual accounts prepared with AI (companies) Minimal
• Personal data breach in the tool (leak of bank data, payroll, invoices) Outside the AI Act
• Training administration staff in the use of AI Minimal
• Simplified invoices at the front desk and in food & beverage (hotels) Minimal
• Gestorías (tax, accounting and labor advisory firms) that keep their clients' accounts and file their taxes with AI Minimal

IT makes it possible for the rest of the company to comply: it chooses the tools, reviews the contracts, decides where data are processed and keeps the logs. The AI Act asks little of it directly; what is enforceable today comes mainly from the GDPR (processing agreement, security, breaches and transfers) and from cybersecurity and data legislation.

• Shadow AI: employees using personal AI accounts with company data Outside the AI Act
• Subscribing to business accounts for generative AI Minimal
• Microsoft 365 Copilot: permissions, data residency and web search Minimal
• Google Workspace with Gemini: data regions and sources it consults Minimal
• International transfers of data to US AI providers Outside the AI Act
• AI agents with access to systems (email, CRM, ERP, folders) that send emails or modify records Minimal
• Code generation with AI Minimal
• Own internal assistant built on a model's API, under the company's name Transparency
• Security of AI tools (prompt injection, leaks through permissions, DLP) Outside the AI Act
• AI-related personal data breach Outside the AI Act
• Inventory of AI systems and use policy Outside the AI Act
• Staff training in the use of AI Minimal
• Detecting staff use of AI (usage reports, tools that log prompts) Outside the AI Act
• Switching cloud provider or cloud AI provider Outside the AI Act
• Manufacturers: products with software that the company manufactures or places on the market (connected devices, applications, firmware) Outside the AI Act
• Cybersecurity of essential and important entities (NIS2) Outside the AI Act
• Public sector suppliers: systems that provide services or solutions to public administrations Outside the AI Act
• Hotels: property management system, booking engine and payment gateways with AI features Outside the AI Act
• Gestorías (tax, accounting and labor advisory firms): using an AI tool with their clients' data Outside the AI Act

In sales, the AI Act only really bites when AI evaluates the company's own salespeople or the creditworthiness of customers who are natural persons, and it prohibits analyzing salespeople's emotions from their voice or face. Everything else (lead scoring, contact enrichment, writing emails, calling) is governed today by the GDPR, the Spanish Data Protection Act (LOPDGDD), the Spanish Information Society Services Act (LSSI), the Spanish General Telecommunications Act and, with consumers, by consumer protection and unfair competition law.

• Scoring leads or prioritizing opportunities in the CRM Minimal
• Enriching contacts with commercial databases Minimal
• Extracting data from websites or LinkedIn (scraping) with AI or browsing agents Minimal
• Prospecting emails written or sent in sequence by AI Minimal
• Sales calls made by people using a script or list prepared by AI Minimal
• Outbound AI voice agents that call customers or leads Transparency
• Sales chatbot on the website, WhatsApp or social media Transparency
• Proposals, quotes and offers written with AI Minimal
• Algorithmically personalized prices based on the customer's profile Minimal
• Recording, transcribing and analyzing sales calls or video calls Minimal
• Detecting salespeople's emotions from their voice or face Prohibited
• Detecting the customer's emotions from their voice or face during the call High risk
• Evaluating or scoring salespeople with AI (call grading, rankings, “coaching” that reaches management) High risk
• Allocating leads, accounts or territories among salespeople based on their behavior or performance High risk
• Evaluating the creditworthiness of customers who are natural persons (consumers, self-employed individuals) in order to grant credit, deferred payment or terms High risk
• Sales forecasting and pipeline analysis with AI Minimal
• Salespeople using free AI with customer data (pasting the CRM or an email into a personal chat) Outside the AI Act
• Hotels: direct sales to guests, dynamic rates and campaigns to former guests Minimal
• Gestorías (tax, accounting and labor advisory firms): using their clients' data to sell other services Outside the AI Act

Most of the AI in this department works with data about things (stock, orders, routes, machines), and there the AI Act imposes hardly any obligations. Obligations arise when AI measures, allocates tasks to or monitors people, when cameras capture people, and when AI is built into the machinery or products the company manufactures or places on the market.

• Evaluating and selecting suppliers (price, lead times, quality, risk) Minimal
• Demand and inventory forecasting, automatic replenishment Minimal
• Drafting purchase orders, comparing offers or negotiating with an AI assistant or agent Transparency
• Optimizing delivery or collection routes (traffic, time windows, load) Minimal
• Allocating tasks, routes or orders to operatives or delivery drivers based on their performance, behavior or traits High risk
• Measuring the productivity of operatives or delivery drivers (units per hour, picking times, stops) High risk
• Geolocating vehicles or delivery drivers (telematics) Outside the AI Act
• AI cameras in the cab that detect driver distraction, mobile phone use or drowsiness Minimal
• Computer vision for product quality control (defects, labeling, packaging) Minimal
• AI cameras that monitor people in the warehouse or plant (PPE, danger zones, falls) Minimal
• Facial recognition to access the warehouse or plant, or to clock in Minimal
• Predictive maintenance (vibrations, temperatures, consumption of machines, installations or fleet) Minimal
• AI built into machinery the company manufactures (robots, autonomous forklifts, vision cells) High risk
• AI built into other regulated products the company manufactures (lifts, pressure equipment, PPE, radio equipment, toys, medical devices) High risk
• Placing on the market under your own brand a product or tool with AI made by someone else, or substantially modifying it High risk
• Liability if the product with AI causes damage Outside the AI Act
• Procuring AI tools: clauses with the provider Outside the AI Act
• Data generated by connected machines, vehicles or equipment that the company buys Outside the AI Act
• Chat or assistant for suppliers, carriers or customers (order status, dock appointments) Transparency
• Training warehouse, fleet and procurement staff Minimal
• Hotels: allocating rooms to housekeeping room attendants based on their performance or their times High risk
• Gestorías (tax, accounting and labor advisory firms): managing procurement or logistics for their clients Outside the AI Act

Legal uses AI in its own work (contracts, research, whistleblowing channel) and, above all, governs the use of AI across the whole company: which tools exist, what risk they carry, what role the company plays in each one and what must be done before using them. Spain does not yet have its own penalty regime for the AI Act, but GDPR and Spanish Data Protection Act (LOPDGDD) penalties already apply.

• Inventory of the company's AI systems Outside the AI Act
• Classifying each system by risk level and by the company's role (provider or deployer) Minimal
• AI use policy for staff Outside the AI Act
• AI training (AI literacy) Minimal
• Data protection impact assessment (DPIA) of AI uses Outside the AI Act
• Fundamental rights impact assessment (FRIA) High risk
• Reviewing or drafting contracts with AI Minimal
• Legal research with AI (case law, legislation, legal scholarship) Minimal
• Whistleblowing channel with AI (transcribing, translating, classifying or summarizing reports) Minimal
• Record of processing activities including AI uses Outside the AI Act
• International transfers to AI providers outside the EEA Outside the AI Act
• AI transparency across the company (chats, generated content, deepfakes) Transparency
• Relationship with the data protection officer (DPO) Outside the AI Act
• Regulatory monitoring (guidelines, codes, Spanish rules) Outside the AI Act
• AI audits (internal or external) Outside the AI Act
• Governance and privacy platforms with AI Minimal
• Employees using free AI with contracts, customer data or confidential information Outside the AI Act
• Own assistant developed by the company on a model's API and made available under its brand Transparency
• Hotels: third-party tools with built-in AI (booking engine, property management system, chats) and whistleblowing channel Outside the AI Act
• Gestorías (tax, accounting and labor advisory firms): using AI with client data and advising their clients on AI compliance Outside the AI Act

What is penalized most at the front desk is not AI but copying guests' identity documents. Here the AI Act mainly requires transparency in chats and voice agents and caution with biometrics; guest registration (the traveler register required by Spanish law), the GDPR and consumer law weigh more.

• In-person check-in reading the identity document on a local device (NFC chip or MRZ zone) that extracts only the required fields and discards the image Minimal
• Scanning, photocopying or photographing the identity document and keeping the image (including so that an AI can “read” it later) Outside the AI Act
• Online check-in with upload of a photo of the identity document Minimal
• Facial verification: selfie compared with the photo on the document Minimal
• Facial recognition on arrival (camera that identifies VIP or regular guests) High risk
• Automatic submission of guest registration forms from the PMS to the police platform Minimal
• Using the guest register for marketing, to enrich profiles or to train an AI Outside the AI Act
• Front desk chat on the website, app, WhatsApp or social media Transparency
• Voice agent answering the switchboard Transparency
• AI booking engine (assistant that quotes and books, room recommendations) Transparency
• Dynamic pricing based on demand and occupancy Minimal
• Personalized pricing based on the guest's profile (history, device, loyalty) Minimal
• Upselling and personalized offers before or during the stay (room upgrade, late check-out, spa) Minimal
• Guest profiles with preferences and requests (pillow, allergies, reduced mobility, cot) Minimal
• Automated decisions about the guest: refusing a booking, requiring a deposit or “blacklisting” based on a risk or no-show score Minimal
• Machine translation at the desk (app or device) with guests Minimal
• Classifying and answering complaints with AI Minimal
• AI-written replies to reviews Minimal
• Pre-arrival messages (confirmation, instructions, link to online check-in, access code) Minimal
• Promotions and newsletters to former guests, written or segmented with AI Minimal
• AI assistant as a permanent customer service or incident channel in Catalonia (hotels and tourist rental homes) Transparency

This is the hotel department where AI affects staff the most: room allocation, cleaning times, fault reports and cameras. Labor and data protection law, which already apply today, weigh heavily and, from December 2, 2027, so does the high-risk regime when AI allocates tasks by performance or measures productivity.

• Voice dictation of incidents, reports and room status Minimal
• Allocating rooms to housekeeping room attendants using objective rules (departures, arrivals, floors, room type, availability, quota under the collective agreement) Minimal
• Allocating rooms according to each housekeeping room attendant's performance or history (speed, incidents, guest ratings) High risk
• Measuring staff productivity: minutes per room, rankings, alerts to the supervisor High risk
• Cleaning times forecast by AI to plan the day, without evaluating anyone Minimal
• Locating staff within the hotel (beacons, Wi-Fi, task app) High risk
• Detecting staff emotions or stress via camera, voice or wristband Prohibited
• Sensors and predictive maintenance (boilers, air conditioning, leaks, water and energy consumption) Minimal
• Sensors in rooms or apartments (presence, noise, smoke, door opening) Minimal
• Cameras with analytics in common areas: abandoned objects, capacity, falls or intrusion Minimal
• Facial recognition with cameras to identify people High risk
• Lost property: log with photos and search for the owner by cross-checking bookings Minimal
• Guest data in fault reports and tasks (“allergic guest,” “reduced mobility,” guest's name) Minimal
• Internal assistant that answers with the hotel's procedures (cleaning, chemicals, occupational risk prevention) Transparency
• Inventory forecasting for linen, products and spare parts Minimal

The greatest risk in food & beverage is not the AI Act but food information: if the AI gets an allergen wrong, the establishment is liable. In addition, assistants must say they are an AI and generated photos of dishes must not mislead.

• Menu written, translated or designed with AI Minimal
• Assistant (chat, QR code at the table, WhatsApp) that answers questions about dishes and allergens Transparency
• AI-generated photos of dishes that look real (digital menu, website, social media, delivery platforms) Transparency
• Real photos of dishes retouched without changing what is shown (light, color, framing) Minimal
• Table bookings via AI chat or WhatsApp Transparency
• Voice agent that answers the phone and takes bookings Transparency
• No-show prediction and deposit or guarantee card depending on the customer's score Minimal
• Allergies or intolerances stored in the customer's record for future visits Minimal
• AI-written replies to reviews Minimal
• Dynamic pricing in the restaurant (by time of day, demand or hotel occupancy) Minimal
• Purchasing and production forecasting (covers, waste, orders to suppliers) Minimal
• AI shift planning for kitchen and dining room High risk
• AI cameras in the kitchen or dining room (hygiene, plating times, queues) High risk
• Marketing to restaurant customers using booking data (emails, WhatsApp, SMS) Minimal
• Recommender of dishes, wines or extras on the digital menu Minimal
• Menus, signs and assistants translated or operated with AI in Catalonia Minimal

Preparing and filing taxes with AI is minimal risk under the AI Act. What really creates obligations is that the firm is liable for what it files, needs the client's authorization to act as representative and its own digital certificate, personal income tax returns contain special categories of data, and tax advisers are obliged entities for anti-money laundering purposes. Its key points apply to the whole gestoría (tax, accounting and labor advisory firm).

• Preparing tax returns with AI (personal income tax, VAT, corporate income tax): reconciling data, proposing boxes and deductions Minimal
• Reading client documents with AI (withholding certificates, tax data from the Spanish Tax Agency (AEAT), notarial deeds, invoices, receipts) Minimal
• Researching the law with AI (legal or general-purpose assistants) Minimal
• Electronic filing of tax returns on behalf of clients Minimal
• Keeping clients' digital certificates at the firm or giving them to an AI tool Outside the AI Act
• AI agents that file returns, answer requests from the authorities or carry out procedures on the electronic office (sede electrónica) without human intervention Minimal
• AI that monitors the Spanish Tax Agency (AEAT) notifications inbox, summarizes requests and flags deadlines Minimal
• VERI*FACTU: advising clients on their invoicing systems (including those that generate invoices with AI) Minimal
• Mandatory B2B e-invoicing: getting clients ready Minimal
• Chat or assistant for clients (income tax queries, missing documents, file status) Transparency
• Collecting documents by email, WhatsApp or portal with automatic classification by client and financial year Minimal
• Tax planning or simulations with AI for a client Minimal
• Report on an individual's income or financial capacity for a bank or landlord, with an AI score High risk
• Anti-money laundering customer due diligence with AI (identification, beneficial owner, sanctions lists) Minimal
• Firm employees using free AI tools with clients' tax returns Outside the AI Act
• Retention of tax returns, supporting documents and conversations with the AI Outside the AI Act
• Using AI with client data without having established whether the firm is processor or controller for each service Outside the AI Act
• Cloud AI provider processing the firm's client data Minimal
• Sending client data to AI providers outside the European Economic Area Minimal
• Confidentiality and professional secrecy when the firm uses AI Outside the AI Act
• The firm as an obliged entity for anti-money laundering purposes Outside the AI Act
• AI literacy of the firm's staff Minimal
• Processing health or trade union data from personal income tax returns with AI on a large scale (large firm or office network) Minimal

Almost everything AI does in accounting is minimal risk. What creates obligations is the usual: the accounts remain the business owner's responsibility even if the firm keeps them, the annual accounts are prepared and signed by the directors and, as an external accountant, the firm is an obliged entity for anti-money laundering purposes.

• Automatic reading of invoices (AI-based OCR) and proposed journal entry Minimal
• Automatic bank reconciliation Minimal
• Accounting classification and assignment of Spanish General Accounting Plan (PGC) accounts by the AI Minimal
• Year-end closing and draft annual accounts prepared with AI Minimal
• Legalization of accounting books and filing of annual accounts with the help of AI Minimal
• Management report or notes to the accounts drafted with AI Minimal
• Management information for clients (dashboards, forecasts, cash flow commentary) generated with AI Minimal
• Detecting errors, anomalies or possible fraud in the client's accounts Minimal
• Assistant answering accounting questions from the firm's staff (PGC, ICAC resolutions, queries) Minimal
• Chat or portal for clients that answers questions about their accounts (balances, outstanding invoices, deadlines) Transparency
• Evaluating the creditworthiness of individual clients (natural persons) for financing, rentals or payment deferrals High risk
• Data on suppliers who are self-employed individuals and on individual customers appearing in the accounts Outside the AI Act
• AI-assisted anti-money laundering due diligence on the firm's clients Minimal
• Firm that, in addition to bookkeeping, audits accounts Minimal
• Firm employees using free AI tools with clients' accounts Outside the AI Act
• Retention of digitized accounting records and AI logs Outside the AI Act

Drafting corporate documents with AI is minimal risk. What creates obligations: minutes state what was resolved and are signed by whoever holds the authority to do so; anyone who forms companies is an obliged entity for anti-money laundering purposes and may not rely solely on the beneficial ownership register; due diligence involves trade secrets; and electronic signatures have their own rules.

• Company formation with AI: draft articles of association, single electronic document (DUE), company name reservation, documentation for the notary Minimal
• Minutes of general meetings or board meetings drafted with AI (from notes, the notice of meeting or a recording) Minimal
• Certificates of resolutions and notarization (elevación a público) prepared with AI Minimal
• Corporate books (minute book, register of shareholders) kept or prepared with AI Minimal
• Commercial Registry: electronic filing, reading the registrar's assessments and correcting defects with AI Minimal
• AI-assisted identification of the beneficial owner and due diligence (Beneficial Ownership Register, sanctions lists, politically exposed persons) Minimal
• Non-face-to-face identification of clients by video or with automatic biometric verification Minimal
• Indications of money laundering detected by the AI in a corporate transaction (opaque structures, ownership changes without business rationale, serial registered addresses) Minimal
• Powers of attorney and deeds: drafts and instructions for the notary containing data on shareholders, directors and attorneys Minimal
• Due diligence with AI (bulk review of contracts, litigation, employment, industrial property) in an acquisition or the entry of new shareholders Minimal
• Family protocol (family business charter) drafted with AI Minimal
• Electronic signature of minutes, contracts or certificates and their automated management with AI Minimal
• Assistant answering corporate law questions from staff (queries, DGSJFP resolutions, deadlines) Minimal
• Chat for clients (status of a company formation, pending documents, notary appointments) Transparency
• AI analysis of public data on companies and directors (Official Gazette of the Commercial Registry (BORME), Commercial Registry) to acquire clients or for profiling Outside the AI Act
• Firm employees using free AI tools with articles of association, shareholders' agreements or data rooms Outside the AI Act

The firm handles human resources for its clients and processes their employees' data: payroll, sick leave, dismissals and, sometimes, criminal records. Recruiting or making decisions about workers with AI is high risk from December 2, 2027, and already today the GDPR, the Workers' Statute (Estatuto de los Trabajadores) and, from October 5, 2026, the requirement to provide written information on algorithms apply.

• Interpreting the collective agreement or reviewing payroll issues with an AI assistant Minimal
• Employment contracts and onboarding information drafted with AI Minimal
• Social Security registrations and deregistrations of workers prepared or submitted automatically Minimal
• Calculating final settlements and severance pay for a dismissal already decided by the client Minimal
• AI that proposes whom to dismiss, whom to include in a temporary lay-off scheme (ERTE) or whom to promote High risk
• Temporary lay-off scheme (ERTE): report, communications and documentation drafted with AI Minimal
• Sick leave and temporary incapacity: handling medical certificates and calculating benefits Minimal
• Recruitment for a client with AI: filtering, scoring or ranking CVs High risk
• Summarizing CVs at the recruiter's request, without scoring or ranking Minimal
• Job advertisements drafted with AI for clients Minimal
• Clients' working time records kept with software Minimal
• Biometric working time records (fingerprint or face) Outside the AI Act
• Equality plans and the preliminary diagnosis prepared with AI Minimal
• Pay register and pay audit with AI Minimal
• Submissions and replies to the Labor and Social Security Inspectorate drafted with AI Minimal
• Q&A chat for clients' employees (payslips, holidays, leave) Transparency
• Sexual offenses certificates for workers in contact with minors Minimal
• Evaluating the performance of a client's employees (HR consultancy) High risk
• Emotion recognition of a client's staff (voice, camera, typing patterns) Prohibited
• Firm staff using free AI tools with clients' payroll or contracts Outside the AI Act
• Record of processing activities of the payroll firm, even if it has fewer than 250 staff Outside the AI Act

Here AI does not just draft: it fills in forms, monitors notifications and can file documents on behalf of a client and with credentials. The AI Act imposes hardly any obligations; what does is administrative law, representation, security and the firm's professional liability.

• Vehicle transfers before the Directorate-General for Traffic (DGT): reading registration documents and contracts and preparing the file with AI Minimal
• AI agent that fills in forms on an electronic office (sede electrónica) and leaves submission to a person Minimal
• AI agent that files or signs documents without human review Minimal
• Keeping clients' digital certificates on the firm's computers Outside the AI Act
• Client's Cl@ve or passwords stored by the firm or used by an AI agent Outside the AI Act
• AI monitoring of electronic notifications (e-office inboxes, the single authorized electronic address, DEHú) Minimal
• Calculating administrative deadlines with AI Minimal
• Classifying and summarizing requests and notifications received Minimal
• Immigration: preparing files (residence permits, residence on grounds of settlement (arraigo), renewals) with AI Minimal
• Criminal record certificates collected for a procedure Minimal
• Business activity or building permits: reports and documentation drafted with AI Minimal
• Grants and subsidies: applications prepared with AI Minimal
• Using AI to predict whether an application will succeed, in order to advise the client Minimal
• File tracking chat for clients Transparency
• Firm staff using free AI tools with client documents Outside the AI Act

This is the entry point for all the firm's data: ID cards (DNI), payslips, deeds, sick notes and certificates arrive by email, WhatsApp or portal, and here AI classifies, reads and files them. Almost everything is minimal risk; what creates obligations is the GDPR: data minimization, channel security, retention periods and the firm's role as processor.

• Automatic classification of incoming documents (by client, type and procedure) Minimal
• Shared email inbox with AI that reads, summarizes and routes messages Minimal
• Receiving documents via WhatsApp Minimal
• Client portal with document upload and automatic reading Minimal
• OCR of ID cards (DNI) and identity documents Minimal
• Extracting data from invoices, payslips or deeds with AI Minimal
• Sick notes, medical reports or criminal record certificates arriving at reception Minimal
• Automated retention and deletion by retention period Minimal
• Smart search of the archive (asking the AI about client documents) Minimal
• Customer service chat on the website or portal Transparency
• Voice assistant on the firm's switchboard Transparency
• Electronic signature of engagement letters, mandates and documents with clients Minimal
• Replies to clients drafted by AI and reviewed Minimal
• Sending documents to clients by email with AI Minimal
• Record of processing activities including AI processing Outside the AI Act
• Staff forwarding client documents to their personal email or to a free AI tool Outside the AI Act
• Keeping a copy of the client's ID card (DNI) when the firm is an obliged entity for anti-money laundering purposes (tax advice, external accounting, company formation, registered office services) Outside the AI Act
• Keeping a copy of the ID card (DNI) for services not covered by Ley 10/2010 (for example, only Directorate-General for Traffic (DGT) procedures or only payroll) Outside the AI Act

• Mercadona, S.A. (2021): Installed facial recognition in its shops to detect persons subject to restraining orders. €2,520,000 (€3,150,000 initially; −20% for voluntary payment) · GDPR, Articles 6 and 9, 12 and 13, 5(1)(c), 25(1) and 35 · official source
• AENA, S.M.E., S.A. (2024): Used facial recognition for passenger access to airport areas without a valid impact assessment. €10,043,002 · GDPR, Article 35 · official source
• Yoti Ltd (2025): Facial age verification provider: by default it used biometric data, including those of minors, for “research and development.” €950,000 (€500,000 + €200,000 + €250,000) · GDPR, Articles 9, 7 and 5(1)(e) · official source
• Universitat Internacional Valenciana – Valencian International University, S.L. (25-4-2025): Online exams proctored with facial recognition, artificial intelligence and automated decision-making, with no alternative for students. €650,000 (€300,000 + €350,000) · GDPR, Articles 9 and 5(1)(c) · official source
• Universidad Europea de Valencia, S.L. (2025): Required the use, in online exams, of software with facial recognition and camera and microphone monitoring. €160,000 (€200,000 initially; −20% for voluntary payment) · GDPR, Articles 9 and 35 · official source
• Fundació per a la Universitat Oberta de Catalunya (UOC) (2022): Required students to register with a facial recognition tool in order to take remote assessments. €20,000 · GDPR, Articles 5(1)(a) and 9 · official source
• Liga Nacional de Fútbol Profesional (2023): Imposed biometric access to the supporters' stands at stadiums without a valid impact assessment. €1,000,000 · GDPR, Article 35 · official source
• SIDECU, S.A. (gimnasios) (2024): Switched access to its gyms to facial recognition and refused entry to anyone who did not accept it. €96,000 (€160,000 initially; −40% for early payment and acknowledgment of liability) · GDPR, Articles 9 and 35 · official source
• Loro Parque, S.A. (2023): Took the fingerprints of visitors holding a two-park ticket, to check that it was the same person. €250,000 · GDPR, Article 9 · official source
• CTC Externalización, S.L. (2023 · SAN of 30-6-2026): Staff clocking-in by fingerprint without adequate information, without sufficient security measures and without an impact assessment. €50,000 after the National High Court ruling (€365,000 initially: €200,000 + €65,000 + €100,000) · AEPD: GDPR, Articles 13, 32 and 35. National High Court: the Article 13 infringement becomes a minor infringement (LOPDGDD, Article 74.a, €10,000), the Article 32 fine stays at €40,000 and the Article 35 fine is annulled · official source
• MAXAMCORP International, S.L. (1-3-2026): Replaced cards with fingerprints for clocking in, without a valid legal basis or an impact assessment. €400,000 (€300,000 + €100,000) · GDPR, Articles 9 and 35 · official source
• Cartonajes Bañeres, S.A. (2023): Clocking-in by facial recognition without an impact assessment; it also failed to reply to a former employee who requested their data. €220,000 (€200,000 + €20,000) · GDPR, Articles 35 and 15 · official source
• Ares Capital, S.A. (ride-hailing) (2024): Required drivers to use work apps on their personal mobile phones, with geolocation, and collected more data than necessary. €200,000 · GDPR, Articles 13, 5(1)(c) and 6(1) · official source
• GlovoApp23, S.A. (2022 · decision of 7-3-2023): Misconfigured permissions: customer service staff in other countries could see couriers' data (location, ratings). €550,000 + warning (apercibimiento) · GDPR, Articles 25 and 32 (fine) and 13 (warning) · official source
• Posada del León de Oro, C.B. (hotel, Madrid) (2025): Camera recording image and audio at the front desk, which any employee could watch live. €240 (€400 initially; −40%) · GDPR, Articles 5(1)(c) and 13 · official source
• Universitat Autònoma de Barcelona (7-10-2025): An AI meeting assistant (Read.ai) recorded and transcribed a Teams meeting without the participants knowing, and sent the summary by email. No fine (public authority: declaration of infringement only) · GDPR, Articles 25 and 5(1)(a) · official source
• Adverbis Spain, S.L. (2024): Made an automated call (recorded message) to a number registered on the Robinson List (Spanish advertising opt-out register). €5,000 · Spanish General Telecommunications Act (Ley 11/2022, LGTel), Article 66.1.b, offense defined in Article 107.30 · official source
• Más Sol Energía 15, S.L. (28-4-2026): Called a number on the Robinson List (Spanish advertising opt-out register) and could not say where it had obtained the telephone number. €10,000 (€5,000 + €5,000) · Spanish General Telecommunications Act (LGTel), Article 66.1.b; GDPR, Article 14 · official source
• Napptive Solutions, S.L. (2024): Used an email address published on GitHub for prospecting without informing the person of the source of their data (web scraping). No fine (warning) · GDPR, Article 14 · official source
• Informa D&B, S.A. (2024 · decision of 14-4-2025): Bought a file with data on self-employed individuals from a third party and marketed it without a legal basis or informing them. €1,800,000 (€900,000 + €900,000) · GDPR, Articles 6(1) and 14 · official source
• Axesor Conocer para Decidir, S.A.U. (2025): Marketed data on self-employed individuals taken from the Chamber of Commerce census, without a legal basis or informing them. €128,000 (€160,000 initially; −20%) · GDPR, Articles 6(1) and 14 · official source
• CaixaBank, S.A. (Decision of 5-1-2021 · SAN of 8-5-2025): Built commercial profiles of its customers on the basis of improperly obtained consent and informed them in a confusing way (the AEPD declared that it did not infringe Article 22 GDPR). €2,000,000 after the National High Court ruling (€6,000,000 initially) · GDPR, Articles 6, 13 and 14 · official source
• Banco Bilbao Vizcaya Argentaria, S.A. (Decision of 18-11-2020 · STS of 11-11-2024): Processing of customer data for commercial purposes without a valid legal basis and with insufficient information. €5,000,000 (€2,000,000 + €3,000,000) · GDPR, Articles 13, 14 and 6 · official source
• Vodafone España, S.A.U. (Decision of 11-2-2021 · SAN of 29-10-2024): Mass marketing campaigns (calls, SMS, emails) carried out by suppliers without control and without respecting objections. €4,580,000 after the National High Court ruling (€8,150,000 initially) · GDPR, Articles 28 and 24, Article 44; Spanish Information Society Services Act (LSSI), Article 21; former Spanish General Telecommunications Act (Ley 9/2014, LGTel), Article 48.1.b · official source
• Gestores Administrativos Reunidos, S.A. (GARSA) (2026): Gestoría administrativa (administrative services firm) working for the banking sector: suffered a breach of client data and the AEPD had to order it to notify those affected. €75,000 (€125,000 initially: €100,000 + €25,000; −40%) · GDPR, Articles 5(1)(f) and 33 · official source
• Administraciones Benipon, S.L. (2025): Property manager for a residents' association (acting as processor) that subcontracted without authorization and did not notify the controller of a breach. €1,100 (€300 + €300 + €500) · GDPR, Articles 28(2), 28(4) and 33(2) · official source
• Konecta BTO, S.L. (2025): Call center working as a processor: unauthorized access to its systems exposed the data of its client's customers. €300,000 (€500,000 initially; −40%) · GDPR, Article 5(1)(f) · official source
• Coyare, S.L.U. (Bufete-RA) (2023): Law firm that sent advertising to 95 people with all the addresses visible in copy (CC). €2,500 (€2,000 + €500) · GDPR, Articles 5(1)(f) and 32 · official source
• Marina Salud, S.A. (2024): As processor for the regional health department (Conselleria), it engaged sub-processors without first informing the controller of the changes. €500,000 · GDPR, Article 28(2) · official source
• Endesa Energía, S.A.U. (Decision of 25-10-2023): Unauthorized access to its commercial systems containing customer data; it failed to notify the breach and to inform those affected, and made international transfers without safeguards. €6,100,000 (€2,500,000 + €1,500,000 + €800,000 + €800,000 + €500,000) · GDPR, Articles 5(1)(f), 32, 33, 34 and 44 · official source
• Fundació Universitat Oberta de Catalunya (UOC) (27-8-2026): After running assignments through a plagiarism detection tool, a lecturer sent three students, in a single email, the names and assignments of all three accused. €1,800 (€2,250 initially; −20%) · GDPR, Article 5(1)(f) · official source
• Suneris, S.A. (hotel) (2024 · payment on 28-6-2025): Scanned guests' identity documents at check-in. €5,400 (€9,000 initially; −40%) · GDPR, Article 5(1)(c) · official source
• Unique Hotel Apartment, S.L. (2023): Kept scanned copies of guests' ID cards (DNI). €2,000 · GDPR, Article 5(1)(c) · official source
• A private individual (Decision of 12-9-2025 · later revoked): Distributed fake nude images of minors created with AI (the case known in the press as Almendralejo). €1,200 paid (€2,000 initially; −40%) · GDPR, Article 6(1) · official source
• Fifteen minors (not identified) (20-6-2024): Used AI apps to create fake nude images of female classmates from their social media photos and distributed them. One year of supervised probation for each · Spanish Criminal Code (Código Penal): child pornography and offenses against moral integrity (20 counts of each) · official source
• GlovoApp23, S.L. (25-9-2020): The Supreme Court held that a courier's relationship with Glovo was an employment relationship: the algorithm allocated orders and time slots according to the courier's rating. — · Workers' Statute (Estatuto de los Trabajadores), Articles 1.1 and 8.1 · official source
• Foundever Spain, S.A. (4-7-2025): Failed to inform trade union representatives of the parameters of the algorithm that allocated staff days off. €6,250 in damages to the trade union · Workers' Statute (Estatuto de los Trabajadores), Article 64.4.d; freedom of association (Spanish Constitution, Article 28.1) · official source
• Spanish State Administration (BOSCO, electricity social discount) (11-9-2025): The Supreme Court recognized a foundation's right to access the source code of the program that decides who receives the social electricity tariff (bono social). — · Spanish Transparency Act (Ley 19/2013) · official source
• Make Packing, S.L. y Art & Graphic Packaging, S.L. (15-1-2026): Introduced clocking-in by facial recognition without consulting or involving staff (2023-2025). €7,501 in damages to one worker · Right to one's own image in connection with data protection (Spanish Constitution, Articles 18.1 and 18.4) · official source
• Tiendas Conexión, S.L.U. (15-9-2020): Upheld a dismissal based on the GPS of the company car: the worker knew the vehicle was fitted with it. — · Spanish Constitution, Articles 18.1 and 18.4 (privacy and data protection); disciplinary dismissal (Workers' Statute (Estatuto de los Trabajadores), Article 54) · official source
• OpenAI (ChatGPT) (02-11-2024 (press release 20-12-2024)): Trained ChatGPT with personal data without a legal basis, provided poor information, did not verify age and did not notify a personal data breach. €15,000,000 · GDPR: legal basis, transparency, age verification and breach notification. The exact articles cannot be verified: the decision has been removed from the website · official source
• Luka Inc. (Replika chatbot) (10-04-2025 (press release 19-05-2025)): Offered a “companion” chatbot without a legal basis for processing data, with a deficient privacy policy and without verifying age. €5,000,000 · GDPR, Articles 5(1)(a), 5(1)(c), 6, 12, 13, 24 and 25(1) · official source
• Character Technologies Inc. (Character.AI) (03-07-2026 (press release 09-07-2026)): Its character chatbots provided deficient information, it carried out the impact assessment and appointed its EU representative late, and it gave minors little protection. €158,000 · GDPR, Articles 5(2), 12, 13, 14, 24(1), 25(2), 27 and 35(1) · official source
• Hangzhou DeepSeek Artificial Intelligence y Beijing DeepSeek Artificial Intelligence (30-01-2025): Processed data of users in Italy with insufficient information, without an EU representative and storing them in China, and was banned from continuing to do so with immediate effect. No fine · GDPR, Articles 6, 12, 13, 14, 27, 31 and 32 and Chapter III; measure under Article 58(2)(f) · official source
• Company based in the British Virgin Islands that runs the Clothoff app (the Garante does not publish its name) (01-10-2025 (press release 03-10-2025)): App that uses AI to “undress” real people, including minors, without checking consent or age. No fine · GDPR (urgent measure; see the provvedimento) · official source
• R.T.I. – Reti Televisive Italiane S.p.A. (23-07-2026 (press release 07-08-2026)): Broadcast deepfake videos of a journalist, with his voice imitated by AI, and the “made with AI” notice was not clear enough. No fine · GDPR, Articles 5 and 25; measures under Article 58(2)(b) and 58(2)(f) · official source
• Myndoor S.r.l. (14-05-2026 (press release 28-05-2026)): Offered a Slack and Teams add-on that uses AI to measure employees' stress from what they write, and the Garante issued a warning citing the prohibition on emotion recognition in the workplace. No fine · GDPR, Article 58(2)(a) and Italian Privacy Code, Article 154(1)(f); Article 5(1)(f) of Regulation (EU) 2024/1689 is cited · official source
• Foodinho s.r.l. (Glovo group) (13-11-2024 (press release 22-11-2024)): Algorithmic management of more than 35,000 couriers: facial recognition, location tracking outside working hours and deactivation of accounts without explaining how to challenge it or offering human intervention. €5,000,000 · GDPR, Articles 5(1)(a), (c), (d) and (e), 6, 9(2)(b), 12, 13, 22(3), 25, 28, 32, 35 and 88; Italian Privacy Code, Articles 2-septies and 114; D. Lgs. 81/2015, Article 47-quinquies · official source
• Deliveroo Italy s.r.l. (22-07-2021 (newsletter 02-08-2021)): Opaque algorithm for allocating orders among some 8,000 couriers, with continuous geolocation and a risk of discrimination. €2,500,000 · GDPR, Articles 5(1)(a), (c) and (e), 13, 22(3), 25, 30(1), 32, 35, 37(7) and 88 · official source
• Comune di Trento (11-01-2024 (press release 25-01-2024)): Research projects that used AI to analyze street cameras and microphones and social media messages, without a legal basis or an impact assessment. €50,000 · GDPR, Articles 5(1)(a), 6, 9, 10, 13 and 14 and 35; Italian Privacy Code, Articles 2-ter, 2-sexies and 2-octies · official source
• Clearview AI (10-02-2022 (press release 09-03-2022)): Created a facial recognition database with photos scraped from the internet, and was banned from processing data of people in Italy. €20,000,000 · GDPR, Articles 5(1)(a), (b) and (e), 6, 9, 12, 13, 14, 15 and 27 · official source
• Clearview AI (name per the EDPB; Légifrance now anonymizes it, as the CNIL stops naming the company after two years) (17-10-2022 and 17-04-2023): Used facial recognition without a legal basis, did not comply with requests for access and erasure, and did not comply with the CNIL's order either. €20,000,000 + €5,200,000 (periodic penalty payment) · GDPR, Articles 6, 12, 15 and 17 · official source
• Clearview AI Inc. (16-05-2024 (published 03-09-2024)): Unlawful biometric database with photos of people in the Netherlands, poor transparency and access requests left unanswered. €30,500,000 (plus four orders subject to periodic penalty payments) · GDPR, Articles 5(1)(a) with 6(1), 9(1), 12(1) with 14(1) and 14(2), 12(2) and 12(3) with 15, and 27(1) · official source
• Clearview AI Inc. (Fine of May 2022; Upper Tribunal 06-10-2025): The same Clearview facial database; in 2025 the Upper Tribunal restored the ICO's jurisdiction, which a tribunal had denied in 2023. ≈ £7,500,000 (“£7.5m”, ICO) · UK GDPR (territorial and material scope, Articles 2 and 3) · official source
• Uber (22-07-2024 (published 26-08-2024)): Sent data of European drivers (documents, location, photos and, in some cases, criminal and medical data) to the US without transfer safeguards. €290,000,000 · GDPR, Articles 44, 46 and 49 · official source
• Uber B.V. (Published by the EDPB on 08-10-2026): Deactivated drivers' accounts fully automatically on suspicion of fraud or because of poor ratings, without informing them properly. €824,990,000 · GDPR, Articles 22 and 13 · official source
• Amazon France Logistique (CNIL 27-12-2023; Conseil d'État 23-12-2025): Its warehouse scanners measured each worker to the second and kept all indicators for 31 days, an excess of data confirmed by the Conseil d'État. €32,000,000 → €15,000,000 · GDPR, Articles 5(1)(c), 12, 13 and 32 (the Article 6(1)(f) infringement is annulled) · official source
• LinkedIn Ireland Unlimited Company (22-10-2024 (press release 24-10-2024)): Analyzed its users' behavior for targeted advertising without a valid legal basis or sufficient transparency. €310,000,000 · GDPR, Articles 5(1)(a), 6, 13(1)(c) and 14(1)(c) · official source
• TikTok Technology Limited (30-04-2025 (press release 02-05-2025)): Allowed access from China to European users' data without guaranteeing equivalent protection and without explaining it. €530,000,000 (€485 million + €45 million) · GDPR, Articles 46(1) and 13(1)(f) · official source
• X (Grok) (08-08-2024; closed on 04-09-2024): Used public posts by European users to train Grok and gave an undertaking before the court to stop processing those data permanently. No fine · GDPR (lawfulness of processing) · official source
• Hangzhou DeepSeek Artificial Intelligence Co., Ltd. y Beijing DeepSeek Artificial Intelligence Co., Ltd. (16-12-2025 (press release 30-04-2026)): Its chatbot did not warn that it may “hallucinate” (make up information), and it undertook to display permanent warnings and improve its information. No fine · Italian Consumer Code, Articles 20, 21 and 22 (closed under Article 27(7), without a finding of infringement) · official source
• SCHUFA Holding (credit reference agency) (07-12-2023): Automatically calculating the probability that a person will default is an “automated decision” if a third party (a bank, for example) relies on it to grant or refuse a contract. Not applicable · GDPR, Article 22(1) (interpretation) · official source
• Dun & Bradstreet Austria GmbH (27-02-2025): A person refused a contract on the basis of an automated credit profile must be given an understandable explanation of how the result was reached, and trade secrecy does not allow a straightforward refusal. Not applicable · GDPR, Articles 15(1)(h) and 22(1) (interpretation) · official source
• Uber B.V. (04-04-2023): Deactivated drivers without genuine human intervention, and the court ordered it to explain the logic of the decision to them. €4,000/day periodic penalty payment · GDPR, Articles 15(1)(h) and 22 · official source
• (European Commission; affects any company sending data to the US) (03-09-2025; appeal of 31-10-2025): The General Court upheld the EU-US data transfer framework (Data Privacy Framework), and the judgment is under appeal before the Court of Justice. Not applicable · Adequacy decision (EU) 2023/1795; GDPR, Article 45 · official source