{"id":3620,"date":"2026-10-23T10:09:25","date_gmt":"2026-10-23T10:09:25","guid":{"rendered":"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/"},"modified":"2026-10-23T10:09:25","modified_gmt":"2026-10-23T10:09:25","slug":"eu-ai-act-for-businesses","status":"publish","type":"page","link":"https:\/\/robustdatasolutions.com\/en\/ley-de-ia-empresas\/","title":{"rendered":"AI Act by department"},"content":{"rendered":"<p>[et_pb_section fb_built=\u00bb1&#8243; fullwidth=\u00bbon\u00bb admin_label=\u00bbBuscador Ley de IA\u00bb _builder_version=\u00bb4.27.5&#8243; custom_padding=\u00bb0px||0px||false|false\u00bb global_colors_info=\u00bb{}\u00bb][et_pb_fullwidth_code admin_label=\u00bbBuscador (shortcode)\u00bb _builder_version=\u00bb4.27.5&#8243; global_colors_info=\u00bb{}\u00bb]<div id=\"ley-ia\" class=\"ley-ia\" data-ley-ia-lang=\"en\">\r\n<script type=\"application\/json\" id=\"ley-ia-arranque\" data-no-translation data-no-dynamic-translation>{\"lang\":\"en\",\"textos\":{\"locale\":\"en-US\",\"saltar\":\"Skip to the search\",\"buscar_label\":\"Search for a use of AI in your company\",\"placeholder\":\"What does AI require of me?\",\"borrar_busqueda\":\"Clear the search\",\"sugerencias_aria\":\"Example searches\",\"sugerencias\":[\"chatbot\",\"CV\",\"images\",\"video\",\"voice\",\"reviews\",\"invoices\",\"ID\"],\"cifras\":[\"AI uses analyzed\",\"departments\",\"real cases\"],\"nav_aria\":\"Report sections\",\"nav_usos\":\"AI uses\",\"nav_casos\":\"Real cases\",\"nav_fechas\":\"Key dates\",\"ante_usos\":\"AI uses\",\"ante_casos\":\"Spain and Europe\",\"ante_fechas\":\"Calendar\",\"ante_indice\":\"Report index\",\"tu_sector\":\"Your sector\",\"departamento\":\"Department\",\"nivel\":\"Level\",\"donde\":\"Where\",\"sector\":\"Sector\",\"generales_toggle\":\"Also include what applies to any company\",\"leyenda_titulo\":\"What does each level and notice mean?\",\"quitar_filtros\":\"Clear filters\",\"todos\":\"All\",\"generales\":\"General\",\"corto\":{\"todos\":\"Any company\",\"hoteles\":\"Hotels\",\"gestorias\":\"Advisory firms\"},\"uso\":\"use\",\"usos\":\"uses\",\"ningun_uso\":\"No uses match these filters\",\"tambien_en\":\"Also appears in:\",\"sin_resultados_t\":\"No results\",\"sin_resultados_p\":\"Try another word or level, or clear the filters.\",\"ver_mas\":\"Show {n} more ({q} left)\",\"ya_exigible\":\"Already applicable\",\"desde_futuro\":\"From {f}\",\"desde_pasado\":\"Applicable since {f}\",\"ej\":\"E.g.: \",\"icono_ue\":\"Official EU icon (optional)\",\"ver_ficha\":\"See details\",\"cerrar_ficha\":\"Close details\",\"que_exige\":\"What the law requires\",\"normas\":\"Rules\",\"que_recomienda\":\"What Robust recommends\",\"casos_rel\":\"Related real cases\",\"copiar\":\"Copy link to this entry\",\"copiado\":\"Link copied\",\"ambito_es\":\"Spain\",\"ambito_eu\":\"Europe\",\"todos_sectores\":\"All sectors\",\"todos_deps\":\"All departments\",\"c_norma\":\"Rule\",\"c_referencia\":\"Reference\",\"c_sector\":\"Sector\",\"c_departamentos\":\"Departments\",\"c_fuente\":\"See the official source \u2197\",\"caso\":\"case\",\"casos\":\"cases\",\"ningun_caso\":\"No cases match these filters\",\"sin_casos_t\":\"No cases\",\"sin_casos_p\":\"Try another sector or department.\",\"aviso_casos\":\"There are no fines under the AI Act yet; the existing ones come from data protection, e-commerce (LSSI) or employment law\",\"hoy\":\"Today\",\"ya_aplica\":\"In force\",\"faltan_dias\":\"{n} days to go\",\"faltan_meses\":\"{n} months to go\",\"mas_adelante\":\"Later\",\"ver_todas_fechas\":\"Show all dates ({n})\",\"ver_cercanas\":\"Show only the nearest dates\",\"leyenda_niveles\":\"Levels\",\"leyenda_avisos\":\"Public notices\",\"leyenda_nota\":\"The EU icons are optional; the obligation to disclose, where it exists, is not (European Commission Code of Practice on transparency, June 10, 2026).\",\"niveles\":{\"minimo\":[\"Minimal\",\"The AI Act adds no specific obligations for this use. Other rules, such as data protection, still apply.\"],\"transparencia\":[\"Transparency\",\"Disclosure is required: people must know they are talking to an AI, or that the content was generated or manipulated with AI (AI Act, Art. 50).\"],\"alto\":[\"High risk\",\"High-risk use under the AI Act: stricter obligations for the company that uses it.\"],\"prohibido\":[\"Prohibited\",\"Practice prohibited by the AI Act.\"],\"fuera\":[\"Outside the AI Act\",\"Not regulated by the AI Act, but another rule applies: data protection, LSSI (e-commerce), employment law or others.\"]},\"avisos\":{\"UE-generado\":[\"EU icon: AI-generated content\",\"Official EU icon \u201cFully AI-Generated\u201d: content entirely generated with AI.\"],\"UE-modificado\":[\"EU icon: AI-modified content\",\"Official EU icon \u201cPartially AI-Modified\u201d: human content partly modified with AI.\"],\"UE-basico\":[\"Basic EU AI icon\",\"Basic EU icon: AI was used in a deepfake or in a published text.\"],\"interaccion\":[\"\",\"Disclose that people are talking to an AI (indicative icon, not an official EU icon).\"],\"ninguno\":[\"\",\"No mandatory public notice.\"]},\"video_titulo\":\"Watch it in 1 minute\",\"video_subtitulo\":\"In Spanish, with subtitles \u00b7 AI-generated voice and images\",\"video_trans\":\"Video transcript (in Spanish)\",\"video_cerrar\":\"Close the video\",\"video_error\":\"The video could not be loaded.\",\"video_aria\":\"Video: AI Act by department\",\"aviso_legal_fuerte\":\"Information only, not legal advice.\",\"aviso_legal_fecha\":\"Checked against official sources on {f}.\",\"indice_intro\":\"{u} verified uses across {d} departments and {c} real cases. Tap a use to open its entry with what the law requires and what Robust recommends.\",\"indice_casos\":\"Real penalty cases\",\"indice_fuente\":\"official source\",\"fecha_linea\":\"{mes} edition \u00b7 Updated {fecha}\",\"cargando\":\"Loading the search\u2026\",\"error_datos\":\"The search data could not be loaded. Please reload the page.\",\"nombre_corto\":\"AI Act by department\"},\"datos_url\":\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/datos_en.json?v=8cd45dda02\",\"config\":{\"edicion\":\"2026-10-22\",\"fecha_larga\":\"October 22, 2026\"}}<\/script>\r\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"VideoObject\",\"@id\":\"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/#video\",\"name\":\"Ley de IA por departamentos: \u00bfse puede usar ChatGPT con datos de clientes?\",\"description\":\"Qu\u00e9 exige la ley cuando marketing crea im\u00e1genes con IA, recursos humanos filtra curr\u00edculums o recepci\u00f3n escanea el DNI. Presentaci\u00f3n del buscador gratuito Ley de IA por departamentos, de Robust Data Solutions.\",\"thumbnailUrl\":[\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_portada_16x9.jpg\",\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_portada.jpg\"],\"uploadDate\":\"2026-10-22T12:00:00+02:00\",\"duration\":\"PT55S\",\"contentUrl\":\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_16x9.mp4\",\"inLanguage\":\"es-ES\",\"publisher\":{\"@id\":\"https:\/\/robustdatasolutions.com\/#organization\"}}<\/script>\r\n<a class=\"saltar\" href=\"#buscar\" data-no-translation data-no-dynamic-translation>Skip to the search<\/a>\r\n<section class=\"hero\" aria-labelledby=\"titulo\">\r\n  <div class=\"envoltorio hero-in\">\r\n    <div class=\"hero-txt con-video\">\r\n    <p class=\"antetitulo\">Buscador por departamento y sector<\/p>\r\n    <h1 id=\"titulo\">Ley de IA y RGPD: qu\u00e9 exige a cada departamento de tu empresa<\/h1>\r\n    <p class=\"hero-informe\">Informe Robust de cumplimiento de IA y RGPD en la empresa espa\u00f1ola<\/p>\r\n    <p class=\"hero-fecha\" data-no-translation data-no-dynamic-translation><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><rect x=\"3.5\" y=\"5\" width=\"17\" height=\"15\" rx=\"2.5\"\/><path d=\"M3.5 10h17M8 3v4M16 3v4\"\/><\/svg><time datetime=\"2026-10-22\">October 2026 edition \u00b7 Updated October 22, 2026<\/time><\/p>\r\n    <p class=\"hero-valor\">Lo que tu equipo ya hace con IA, departamento a departamento: qu\u00e9 exige la ley, qu\u00e9 te recomendamos y qu\u00e9 multas reales ha habido.<\/p>\r\n    <div class=\"video-w\" data-no-translation data-no-dynamic-translation><button class=\"video-fachada tap\" type=\"button\" aria-haspopup=\"dialog\" data-src=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_9x16.mp4\" data-src-ancho=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_16x9.mp4\" data-poster-ancho=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_portada_16x9.jpg\" data-consulta-ancho=\"(min-width: 900px) and (orientation: landscape)\"><span class=\"video-mini\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_portada.jpg\" alt=\"\" width=\"72\" height=\"128\"><span class=\"play\" aria-hidden=\"true\"><\/span><\/span><span class=\"video-txt\"><strong>Watch it in 1 minute<\/strong><small>In Spanish, with subtitles \u00b7 AI-generated voice and images<\/small><\/span><\/button><details class=\"video-trans\"><summary class=\"tap\">Video transcript (in Spanish)<\/summary><p lang=\"es\">\u00bfSe puede usar ChatGPT con datos de clientes? Y no es la \u00fanica duda: marketing crea im\u00e1genes, recursos humanos filtra curr\u00edculums, recepci\u00f3n escanea el DNI. Cada uso tiene sus normas. Y siguen cambiando. Equivocarse sale caro: m\u00e1s de diez millones de multa a Aena, por usar reconocimiento facial sin una evaluaci\u00f3n de impacto v\u00e1lida. Por eso hemos publicado Ley de IA por departamentos, un buscador gratuito. Escribes ChatGPT y te lo dice: con una cuenta personal, meter datos de clientes puede ser una brecha. M\u00e1s de trescientos usos, con lo que exige la ley, lo que te recomendamos y casos reales. Y cada mes, al d\u00eda. No sustituye a tu asesor legal: te da el mapa. Y si quieres que la IA trabaje en tu empresa, la implantamos con la ley por delante. Empezamos por un diagn\u00f3stico. Robust Data Solutions. [Personas y escenas generadas con IA. Voz de Albert Lens generada con IA, con su consentimiento.]<\/p><\/details><\/div>\r\n    <div class=\"busca-w\" data-no-translation data-no-dynamic-translation>\r\n      <form class=\"busca\" id=\"buscar\" role=\"search\" onsubmit=\"return false\">\r\n        <label class=\"sr\" for=\"q\">Search for a use of AI in your company<\/label>\r\n        <svg class=\"busca-ic\" viewBox=\"0 0 24 24\" aria-hidden=\"true\"><circle cx=\"11\" cy=\"11\" r=\"7\"\/><path d=\"m20 20-3.6-3.6\"\/><\/svg>\r\n        <input id=\"q\" type=\"search\" autocomplete=\"off\" enterkeyhint=\"search\" placeholder=\"What does AI require of me?\">\r\n        <button type=\"button\" class=\"busca-x\" id=\"q-borrar\" aria-label=\"Clear the search\" hidden>\u00d7<\/button>\r\n      <\/form>\r\n      <div class=\"sugerencias\" id=\"sugerencias\" aria-label=\"Example searches\"><\/div>\r\n      <ul class=\"cifras\" id=\"cifras\"><\/ul>\r\n    <\/div>\r\n    <\/div>\r\n  <\/div>\r\n  <svg class=\"ola\" viewBox=\"0 0 1440 90\" preserveAspectRatio=\"none\" aria-hidden=\"true\"><path d=\"M0 60 C 240 10 480 10 720 45 S 1200 95 1440 35 V90 H0Z\" fill=\"#f4f7fe\"\/><path d=\"M0 75 C 300 35 560 40 800 62 S 1240 92 1440 58 V90 H0Z\" fill=\"#f4f7fe\" opacity=\".55\" transform=\"translate(0,-14)\"\/><\/svg>\r\n<\/section>\r\n\r\n<nav class=\"secciones\" aria-label=\"Report sections\" data-no-translation data-no-dynamic-translation>\r\n  <div class=\"envoltorio secciones-in\">\r\n    <a href=\"#usos\" class=\"sec tap\" data-sec=\"usos\">AI uses<\/a>\r\n    <a href=\"#casos\" class=\"sec tap\" data-sec=\"casos\">Real cases<\/a>\r\n    <a href=\"#fechas\" class=\"sec tap\" data-sec=\"fechas\">Key dates<\/a>\r\n  <\/div>\r\n<\/nav>\r\n\r\n<div class=\"ley-ia-cuerpo\">\r\n  <section id=\"usos\" class=\"bloque\" aria-labelledby=\"usos-t\">\r\n    <div class=\"envoltorio\">\r\n      <p class=\"antetitulo naranja\" data-no-translation data-no-dynamic-translation>AI uses<\/p>\r\n      <h2 id=\"usos-t\">Normativa de IA para empresas, por departamento y sector<\/h2>\r\n      <div data-no-translation data-no-dynamic-translation>\r\n      <div class=\"filtros\">\r\n        <div class=\"filtro\">\r\n          <span class=\"filtro-t\" id=\"ft-sector\">Your sector<\/span>\r\n          <div class=\"segmento\" id=\"f-sector\" role=\"group\" aria-labelledby=\"ft-sector\"><\/div>\r\n        <\/div>\r\n        <div class=\"filtro\">\r\n          <span class=\"filtro-t\" id=\"ft-dep\">Department<\/span>\r\n          <div class=\"fila-chips\" id=\"f-dep\" role=\"group\" aria-labelledby=\"ft-dep\"><\/div>\r\n        <\/div>\r\n        <label class=\"interruptor\" id=\"f-generales-w\" hidden>\r\n          <input type=\"checkbox\" id=\"f-generales\" checked>\r\n          <span class=\"interruptor-t\">Also include what applies to any company<\/span>\r\n        <\/label>\r\n        <div class=\"filtro\">\r\n          <span class=\"filtro-t\" id=\"ft-nivel\">Level<\/span>\r\n          <div class=\"fila-chips\" id=\"f-nivel\" role=\"group\" aria-labelledby=\"ft-nivel\"><\/div>\r\n        <\/div>\r\n      <\/div>\r\n      <div id=\"dep-resumen\"><\/div>\r\n      <div class=\"resultados-cab\">\r\n        <p class=\"resultados-n\" id=\"n-usos\" aria-live=\"polite\">Loading the search\u2026<\/p>\r\n        <button type=\"button\" class=\"enlace-btn tap\" id=\"limpiar\" hidden>Clear filters<\/button>\r\n      <\/div>\r\n      <div id=\"otros-sectores\"><\/div>\r\n      <details class=\"leyenda\">\r\n        <summary class=\"tap\">What does each level and notice mean?<\/summary>\r\n        <div class=\"leyenda-in\" id=\"leyenda\"><\/div>\r\n      <\/details>\r\n      <div class=\"lista-usos\" id=\"lista-usos\"><\/div>\r\n      <div class=\"mas-w\"><button type=\"button\" class=\"btn-sec tap\" id=\"mas-usos\" hidden><\/button><\/div>\r\n      <\/div>\r\n    <\/div>\r\n  <\/section>\r\n\r\n  <section id=\"casos\" class=\"bloque bloque-blanco\" aria-labelledby=\"casos-t\">\r\n    <div class=\"envoltorio\">\r\n      <p class=\"antetitulo naranja\" data-no-translation data-no-dynamic-translation>Spain and Europe<\/p>\r\n      <h2 id=\"casos-t\">Casos reales sancionados<\/h2>\r\n      <div data-no-translation data-no-dynamic-translation>\r\n      <div class=\"aviso-casos\" role=\"note\">\r\n        <svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M12 3 2 21h20L12 3Z\"\/><path d=\"M12 10v5M12 18v.01\"\/><\/svg>\r\n        <p id=\"aviso-casos-t\">There are no fines under the AI Act yet; the existing ones come from data protection, e-commerce (LSSI) or employment law<\/p>\r\n      <\/div>\r\n      <div class=\"filtros filtros-casos\">\r\n        <div class=\"filtro\">\r\n          <span class=\"filtro-t\" id=\"ft-ambito\">Where<\/span>\r\n          <div class=\"segmento\" id=\"c-ambito\" role=\"group\" aria-labelledby=\"ft-ambito\"><\/div>\r\n        <\/div>\r\n        <div class=\"selects\">\r\n          <label class=\"sel\"><span class=\"filtro-t\">Sector<\/span><select id=\"c-sector\"><\/select><\/label>\r\n          <label class=\"sel\"><span class=\"filtro-t\">Department<\/span><select id=\"c-dep\"><\/select><\/label>\r\n        <\/div>\r\n      <\/div>\r\n      <div class=\"resultados-cab\"><p class=\"resultados-n\" id=\"n-casos\" aria-live=\"polite\"><\/p><\/div>\r\n      <div class=\"lista-casos\" id=\"lista-casos\"><\/div>\r\n      <div class=\"mas-w\"><button type=\"button\" class=\"btn-sec tap\" id=\"mas-casos\" hidden><\/button><\/div>\r\n      <\/div>\r\n    <\/div>\r\n  <\/section>\r\n\r\n  <section id=\"fechas\" class=\"bloque\" aria-labelledby=\"fechas-t\">\r\n    <div class=\"envoltorio\">\r\n      <p class=\"antetitulo naranja\" data-no-translation data-no-dynamic-translation>Calendar<\/p>\r\n      <h2 id=\"fechas-t\">Fechas clave<\/h2>\r\n      <div data-no-translation data-no-dynamic-translation>\r\n      <ol class=\"linea\" id=\"linea\"><\/ol>\r\n      <div class=\"mas-w\"><button type=\"button\" class=\"btn-sec tap\" id=\"mas-fechas\" hidden><\/button><\/div>\r\n      <\/div>\r\n    <\/div>\r\n  <\/section>\r\n\r\n<section id=\"indice\" class=\"bloque\" aria-labelledby=\"indice-t\"><div class=\"envoltorio\"><p class=\"antetitulo naranja\" data-no-translation data-no-dynamic-translation>Report index<\/p><h2 id=\"indice-t\">Todos los usos de la IA analizados, departamento a departamento<\/h2><div data-no-translation data-no-dynamic-translation><p class=\"indice-intro\">327 verified uses across 18 departments and 65 real cases. Tap a use to open its entry with what the law requires and what Robust recommends.<\/p><div class=\"indice\"><details><summary>Marketing and communications<span class=\"n\">15<\/span><\/summary><div class=\"indice-cuerpo\"><p>Almost everything marketing generates with AI is minimal risk and needs no notice, but anything that looks real and is not (altered photos, or realistic people, places, videos or voices) must be clearly disclosed from August 2, 2026. Rules on misleading advertising, consumer protection, the Spanish Information Society Services Act (LSSI) and image rights also continue to apply.<\/p><ul><li><a href=\"#dep=01&amp;uso=01-01\">Menu written or designed with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-02\">Real photos enhanced without changing what is shown (cropping, color, lighting, sharpness)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-03\">Real photos with elements changed or added with AI<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-04\">Photorealistic generated images of the premises, the product or the surroundings<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-05\">Clearly artistic illustrations created with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-06\">Photorealistic invented people<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-07\">Videos with realistic people or places generated or manipulated with AI<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-08\">Cloned voice of a real person<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-10\">Landing page generated with AI (copy and design)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-11\">Campaign chat on the website<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-12\">Text posts on social media written with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-13\">Newsletters and commercial emails written with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-14\">Translations made with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-15\">Replies to reviews written with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-16\">Algorithmically personalized prices<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Customer service<span class=\"n\">18<\/span><\/summary><div class=\"indice-cuerpo\"><p>AI chat, WhatsApp assistants and AI phone systems must say they are AI from the first contact, and customers must be able to speak to a person. Analyzing the text of messages is minimal risk; inferring emotions from voice or face is high-risk where customers are concerned and prohibited where the company&#x27;s own agents are concerned.<\/p><ul><li><a href=\"#dep=02&amp;uso=02-01\">Chat on the website or app that answers customer questions<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-02\">AI assistant on WhatsApp or messaging apps<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-03\">Voice agent that answers calls (AI phone system)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-04\">Email replies drafted by AI and reviewed by a person<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-05\">Automatic replies sent without human review<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-06\">Classifying and routing inquiries or complaints with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-07\">Text sentiment analysis (emails, chats, reviews)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-08\">Analysis of customer emotions from voice or face<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-09\">Analysis of agents&#x27; emotions from their voice or face (quality control)<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-10\">Evaluating or scoring agents&#x27; performance with AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-11\">Summaries and transcription of calls or meetings with customers<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-12\">Machine translation of conversations with customers<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-13\">Knowledge base or FAQs generated with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-14\">Replies to public reviews with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-15\">Cloned voice of a real person in the phone system<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-16\">Automated decisions about the customer (refusing a refund, blocking an account, scoring creditworthiness)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-17\">Guest service chat or assistant (booking engine or third-party)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-18\">Chat or assistant that receives queries and documents from clients of the gestor\u00eda (tax, accounting and labor advisory firm)<\/a> <small>Transparency<\/small><\/li><\/ul><\/div><\/details><details><summary>Human resources<span class=\"n\">17<\/span><\/summary><div class=\"indice-cuerpo\"><p>This is the department on which the AI Act imposes the most obligations: using AI to select staff, allocate tasks based on behavior, evaluate workers or take decisions about them is high-risk from December 2, 2027, and inferring the emotions of employees or candidates has been prohibited since February 2, 2025. The GDPR, the Spanish Data Protection Act (LOPDGDD) and the works council&#x27;s right to be informed about algorithms already apply today.<\/p><ul><li><a href=\"#dep=03&amp;uso=03-01\">Writing job offers and job descriptions with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-02\">Targeting who is shown a job advertisement<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-03\">Screening or scoring CVs with AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-04\">Summarizing a CV at the recruiter&#x27;s request, without scoring or ranking<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-05\">Video interviews analyzed by AI (expressions, tone, \u201cattitude\u201d)<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-06\">Chat for candidates or employees (holidays, payslips, policies)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-07\">Allocating shifts or tasks based on behavior or personal traits<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-08\">Shift rotas based only on availability and objective rules (collective agreement, rest periods)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-09\">Evaluating workers&#x27; performance or behavior with AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-10\">Deciding promotions, dismissals or working conditions with the help of AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-11\">Emotion recognition of employees (cameras, voice, typing patterns)<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-12\">Time and attendance control with biometrics (fingerprint, face)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-13\">Monitoring of computer activity or geolocation analyzed with AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-15\">Staff training in the use of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-16\">Employees using free AI with data about colleagues or candidates<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-17\">Seasonal recruitment and rotas with AI in hotels, restaurants and retail<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-18\">Gestor\u00edas (tax, accounting and labor advisory firms) that handle their clients&#x27; payroll and HR with AI<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Management and finance<span class=\"n\">18<\/span><\/summary><div class=\"indice-cuerpo\"><p>The AI Act imposes few obligations here, except when AI is used to evaluate the creditworthiness of natural persons (consumers and self-employed individuals) or to price life and health insurance: high-risk from December 2, 2027, with a fundamental rights impact assessment (FRIA) before first use. What already applies is the GDPR, directors&#x27; duties of secrecy and diligence, trade secrets and, depending on the company, anti-money laundering rules, DORA or market abuse rules.<\/p><ul><li><a href=\"#dep=04&amp;uso=04-01\">Dashboards and reports with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-02\">Cash-flow forecasts, budgets and planning with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-03\">Support for strategic decisions (investments, pricing, company acquisitions) with an AI chat<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-04\">Using general-purpose AI assistants with confidential financial information<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-05\">Summaries and minutes of board and general meetings from the recording<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-06\">Management report, press releases or investor information written with AI and published<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-07\">Using AI to evaluate the creditworthiness of customers who are natural persons (consumers, self-employed individuals) in order to grant credit, financing or deferred payment<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-08\">Creditworthiness of customers that are companies (commercial risk, credit limits)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-11\">Financial fraud detection (anomalous payments, forged documents in applications)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-12\">Supplier evaluation with AI (risk, creditworthiness, ESG criteria)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-13\">Anti-money laundering with AI: customer identification, list screening and alerts (obliged entities only)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-14\">Insurance: pricing or underwriting life and health risks of individuals (insurers and intermediaries)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-15\">Financial entities using AI from external providers<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-16\">Listed company using AI with inside information<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-17\">Training management in the use of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-18\">Board decisions supported by AI (directors&#x27; liability)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-19\">Fraud detection in bookings and payments (hotels)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-20\">Anti-money laundering and clients&#x27; financial data in gestor\u00edas (tax, accounting and labor advisory firms)<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>Administration and accounting<span class=\"n\">18<\/span><\/summary><div class=\"indice-cuerpo\"><p>Reading invoices, bookkeeping, reconciling or preparing payments with AI is minimal risk. What governs here is commercial and tax law: the company is responsible for its accounts even if an AI keeps them, invoicing software must be adapted to VERI*FACTU, and B2B e-invoicing arrives on October 6, 2027, and October 6, 2028.<\/p><ul><li><a href=\"#dep=05&amp;uso=05-01\">Reading incoming invoices with AI and posting them automatically<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-02\">Digitizing paper invoices and destroying the original<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-03\">Automatic bank reconciliation with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-04\">Proposing and approving payments (direct debit batches, due dates) with AI or an agent<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-05\">Detecting errors, duplicates or fraud in supplier invoices and payments<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-06\">Issuing invoices with AI or an agent (from the chat, from orders)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-07\">B2B e-invoicing: issuing, receiving and reading structured invoices<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-08\">Keeping documents and records, including what the AI tool stores<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-09\">Personal data of self-employed suppliers and of employees in invoices, expenses and payments<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-11\">Drafting submissions to the Spanish Tax Agency (AEAT) or the Social Security with AI (information requests, pleadings, appeals)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-12\">Filing with a digital certificate or letting an AI agent fill in forms on the electronic office (sede electr\u00f3nica)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-13\">Using general-purpose AI assistants with accounting or tax data<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-14\">Internal assistant that answers administrative queries from employees or suppliers (status of an invoice or payment)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-15\">Year-end close and annual accounts prepared with AI (companies)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-16\">Personal data breach in the tool (leak of bank data, payroll, invoices)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-17\">Training administration staff in the use of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-18\">Simplified invoices at the front desk and in food &amp; beverage (hotels)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-19\">Gestor\u00edas (tax, accounting and labor advisory firms) that keep their clients&#x27; accounts and file their taxes with AI<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>IT and systems<span class=\"n\">19<\/span><\/summary><div class=\"indice-cuerpo\"><p>IT makes it possible for the rest of the company to comply: it chooses the tools, reviews the contracts, decides where data are processed and keeps the logs. The AI Act asks little of it directly; what is enforceable today comes mainly from the GDPR (processing agreement, security, breaches and transfers) and from cybersecurity and data legislation.<\/p><ul><li><a href=\"#dep=06&amp;uso=06-01\">Shadow AI: employees using personal AI accounts with company data<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-02\">Subscribing to business accounts for generative AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-03\">Microsoft 365 Copilot: permissions, data residency and web search<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-04\">Google Workspace with Gemini: data regions and sources it consults<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-05\">International transfers of data to US AI providers<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-06\">AI agents with access to systems (email, CRM, ERP, folders) that send emails or modify records<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-07\">Code generation with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-08\">Own internal assistant built on a model&#x27;s API, under the company&#x27;s name<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-09\">Security of AI tools (prompt injection, leaks through permissions, DLP)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-10\">AI-related personal data breach<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-11\">Inventory of AI systems and use policy<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-12\">Staff training in the use of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-13\">Detecting staff use of AI (usage reports, tools that log prompts)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-14\">Switching cloud provider or cloud AI provider<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-15\">Manufacturers: products with software that the company manufactures or places on the market (connected devices, applications, firmware)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-16\">Cybersecurity of essential and important entities (NIS2)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-17\">Public sector suppliers: systems that provide services or solutions to public administrations<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-18\">Hotels: property management system, booking engine and payment gateways with AI features<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-19\">Gestor\u00edas (tax, accounting and labor advisory firms): using an AI tool with their clients&#x27; data<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Sales and business development<span class=\"n\">19<\/span><\/summary><div class=\"indice-cuerpo\"><p>In sales, the AI Act only really bites when AI evaluates the company&#x27;s own salespeople or the creditworthiness of customers who are natural persons, and it prohibits analyzing salespeople&#x27;s emotions from their voice or face. Everything else (lead scoring, contact enrichment, writing emails, calling) is governed today by the GDPR, the Spanish Data Protection Act (LOPDGDD), the Spanish Information Society Services Act (LSSI), the Spanish General Telecommunications Act and, with consumers, by consumer protection and unfair competition law.<\/p><ul><li><a href=\"#dep=07&amp;uso=07-01\">Scoring leads or prioritizing opportunities in the CRM<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-02\">Enriching contacts with commercial databases<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-03\">Extracting data from websites or LinkedIn (scraping) with AI or browsing agents<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-04\">Prospecting emails written or sent in sequence by AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-05\">Sales calls made by people using a script or list prepared by AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-06\">Outbound AI voice agents that call customers or leads<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-07\">Sales chatbot on the website, WhatsApp or social media<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-08\">Proposals, quotes and offers written with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-09\">Algorithmically personalized prices based on the customer&#x27;s profile<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-10\">Recording, transcribing and analyzing sales calls or video calls<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-11\">Detecting salespeople&#x27;s emotions from their voice or face<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-12\">Detecting the customer&#x27;s emotions from their voice or face during the call<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-13\">Evaluating or scoring salespeople with AI (call grading, rankings, \u201ccoaching\u201d that reaches management)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-14\">Allocating leads, accounts or territories among salespeople based on their behavior or performance<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-15\">Evaluating the creditworthiness of customers who are natural persons (consumers, self-employed individuals) in order to grant credit, deferred payment or terms<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-16\">Sales forecasting and pipeline analysis with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-17\">Salespeople using free AI with customer data (pasting the CRM or an email into a personal chat)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-18\">Hotels: direct sales to guests, dynamic rates and campaigns to former guests<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-19\">Gestor\u00edas (tax, accounting and labor advisory firms): using their clients&#x27; data to sell other services<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Procurement, operations and logistics<span class=\"n\">22<\/span><\/summary><div class=\"indice-cuerpo\"><p>Most of the AI in this department works with data about things (stock, orders, routes, machines), and there the AI Act imposes hardly any obligations. Obligations arise when AI measures, allocates tasks to or monitors people, when cameras capture people, and when AI is built into the machinery or products the company manufactures or places on the market.<\/p><ul><li><a href=\"#dep=08&amp;uso=08-01\">Evaluating and selecting suppliers (price, lead times, quality, risk)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-02\">Demand and inventory forecasting, automatic replenishment<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-03\">Drafting purchase orders, comparing offers or negotiating with an AI assistant or agent<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-04\">Optimizing delivery or collection routes (traffic, time windows, load)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-05\">Allocating tasks, routes or orders to operatives or delivery drivers based on their performance, behavior or traits<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-06\">Measuring the productivity of operatives or delivery drivers (units per hour, picking times, stops)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-07\">Geolocating vehicles or delivery drivers (telematics)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-08\">AI cameras in the cab that detect driver distraction, mobile phone use or drowsiness<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-09\">Computer vision for product quality control (defects, labeling, packaging)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-10\">AI cameras that monitor people in the warehouse or plant (PPE, danger zones, falls)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-11\">Facial recognition to access the warehouse or plant, or to clock in<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-12\">Predictive maintenance (vibrations, temperatures, consumption of machines, installations or fleet)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-13\">AI built into machinery the company manufactures (robots, autonomous forklifts, vision cells)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-14\">AI built into other regulated products the company manufactures (lifts, pressure equipment, PPE, radio equipment, toys, medical devices)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-15\">Placing on the market under your own brand a product or tool with AI made by someone else, or substantially modifying it<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-16\">Liability if the product with AI causes damage<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-17\">Procuring AI tools: clauses with the provider<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-18\">Data generated by connected machines, vehicles or equipment that the company buys<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-19\">Chat or assistant for suppliers, carriers or customers (order status, dock appointments)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-20\">Training warehouse, fleet and procurement staff<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-21\">Hotels: allocating rooms to housekeeping room attendants based on their performance or their times<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-22\">Gestor\u00edas (tax, accounting and labor advisory firms): managing procurement or logistics for their clients<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Legal and compliance<span class=\"n\">20<\/span><\/summary><div class=\"indice-cuerpo\"><p>Legal uses AI in its own work (contracts, research, whistleblowing channel) and, above all, governs the use of AI across the whole company: which tools exist, what risk they carry, what role the company plays in each one and what must be done before using them. Spain does not yet have its own penalty regime for the AI Act, but GDPR and Spanish Data Protection Act (LOPDGDD) penalties already apply.<\/p><ul><li><a href=\"#dep=09&amp;uso=09-01\">Inventory of the company&#x27;s AI systems<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-02\">Classifying each system by risk level and by the company&#x27;s role (provider or deployer)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-03\">AI use policy for staff<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-04\">AI training (AI literacy)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-05\">Data protection impact assessment (DPIA) of AI uses<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-06\">Fundamental rights impact assessment (FRIA)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-07\">Reviewing or drafting contracts with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-08\">Legal research with AI (case law, legislation, legal scholarship)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-09\">Whistleblowing channel with AI (transcribing, translating, classifying or summarizing reports)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-10\">Record of processing activities including AI uses<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-11\">International transfers to AI providers outside the EEA<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-12\">AI transparency across the company (chats, generated content, deepfakes)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-13\">Relationship with the data protection officer (DPO)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-14\">Regulatory monitoring (guidelines, codes, Spanish rules)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-15\">AI audits (internal or external)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-16\">Governance and privacy platforms with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-17\">Employees using free AI with contracts, customer data or confidential information<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-18\">Own assistant developed by the company on a model&#x27;s API and made available under its brand<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-19\">Hotels: third-party tools with built-in AI (booking engine, property management system, chats) and whistleblowing channel<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-20\">Gestor\u00edas (tax, accounting and labor advisory firms): using AI with client data and advising their clients on AI compliance<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Hotels and accommodation \u00b7 Front desk and reservations<span class=\"n\">21<\/span><\/summary><div class=\"indice-cuerpo\"><p>What is penalized most at the front desk is not AI but copying guests&#x27; identity documents. Here the AI Act mainly requires transparency in chats and voice agents and caution with biometrics; guest registration (the traveler register required by Spanish law), the GDPR and consumer law weigh more.<\/p><ul><li><a href=\"#dep=H1&amp;uso=H1-01\">In-person check-in reading the identity document on a local device (NFC chip or MRZ zone) that extracts only the required fields and discards the image<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-02\">Scanning, photocopying or photographing the identity document and keeping the image (including so that an AI can \u201cread\u201d it later)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-03\">Online check-in with upload of a photo of the identity document<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-04\">Facial verification: selfie compared with the photo on the document<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-05\">Facial recognition on arrival (camera that identifies VIP or regular guests)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-06\">Automatic submission of guest registration forms from the PMS to the police platform<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-07\">Using the guest register for marketing, to enrich profiles or to train an AI<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-08\">Front desk chat on the website, app, WhatsApp or social media<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-09\">Voice agent answering the switchboard<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-10\">AI booking engine (assistant that quotes and books, room recommendations)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-11\">Dynamic pricing based on demand and occupancy<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-12\">Personalized pricing based on the guest&#x27;s profile (history, device, loyalty)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-13\">Upselling and personalized offers before or during the stay (room upgrade, late check-out, spa)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-14\">Guest profiles with preferences and requests (pillow, allergies, reduced mobility, cot)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-15\">Automated decisions about the guest: refusing a booking, requiring a deposit or \u201cblacklisting\u201d based on a risk or no-show score<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-16\">Machine translation at the desk (app or device) with guests<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-17\">Classifying and answering complaints with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-18\">AI-written replies to reviews<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-19\">Pre-arrival messages (confirmation, instructions, link to online check-in, access code)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-20\">Promotions and newsletters to former guests, written or segmented with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-21\">AI assistant as a permanent customer service or incident channel in Catalonia (hotels and tourist rental homes)<\/a> <small>Transparency<\/small><\/li><\/ul><\/div><\/details><details><summary>Hotels and accommodation \u00b7 Housekeeping and maintenance<span class=\"n\">15<\/span><\/summary><div class=\"indice-cuerpo\"><p>This is the hotel department where AI affects staff the most: room allocation, cleaning times, fault reports and cameras. Labor and data protection law, which already apply today, weigh heavily and, from December 2, 2027, so does the high-risk regime when AI allocates tasks by performance or measures productivity.<\/p><ul><li><a href=\"#dep=H2&amp;uso=H2-01\">Voice dictation of incidents, reports and room status<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-02\">Allocating rooms to housekeeping room attendants using objective rules (departures, arrivals, floors, room type, availability, quota under the collective agreement)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-03\">Allocating rooms according to each housekeeping room attendant&#x27;s performance or history (speed, incidents, guest ratings)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-04\">Measuring staff productivity: minutes per room, rankings, alerts to the supervisor<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-05\">Cleaning times forecast by AI to plan the day, without evaluating anyone<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-06\">Locating staff within the hotel (beacons, Wi-Fi, task app)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-07\">Detecting staff emotions or stress via camera, voice or wristband<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-08\">Sensors and predictive maintenance (boilers, air conditioning, leaks, water and energy consumption)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-09\">Sensors in rooms or apartments (presence, noise, smoke, door opening)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-10\">Cameras with analytics in common areas: abandoned objects, capacity, falls or intrusion<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-11\">Facial recognition with cameras to identify people<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-12\">Lost property: log with photos and search for the owner by cross-checking bookings<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-13\">Guest data in fault reports and tasks (\u201callergic guest,\u201d \u201creduced mobility,\u201d guest&#x27;s name)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-14\">Internal assistant that answers with the hotel&#x27;s procedures (cleaning, chemicals, occupational risk prevention)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-15\">Inventory forecasting for linen, products and spare parts<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>Hotels and accommodation \u00b7 Food &amp; beverage<span class=\"n\">16<\/span><\/summary><div class=\"indice-cuerpo\"><p>The greatest risk in food &amp; beverage is not the AI Act but food information: if the AI gets an allergen wrong, the establishment is liable. In addition, assistants must say they are an AI and generated photos of dishes must not mislead.<\/p><ul><li><a href=\"#dep=H3&amp;uso=H3-01\">Menu written, translated or designed with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-02\">Assistant (chat, QR code at the table, WhatsApp) that answers questions about dishes and allergens<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-03\">AI-generated photos of dishes that look real (digital menu, website, social media, delivery platforms)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-04\">Real photos of dishes retouched without changing what is shown (light, color, framing)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-05\">Table bookings via AI chat or WhatsApp<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-06\">Voice agent that answers the phone and takes bookings<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-07\">No-show prediction and deposit or guarantee card depending on the customer&#x27;s score<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-08\">Allergies or intolerances stored in the customer&#x27;s record for future visits<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-09\">AI-written replies to reviews<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-10\">Dynamic pricing in the restaurant (by time of day, demand or hotel occupancy)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-11\">Purchasing and production forecasting (covers, waste, orders to suppliers)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-12\">AI shift planning for kitchen and dining room<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-13\">AI cameras in the kitchen or dining room (hygiene, plating times, queues)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-14\">Marketing to restaurant customers using booking data (emails, WhatsApp, SMS)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-15\">Recommender of dishes, wines or extras on the digital menu<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-16\">Menus, signs and assistants translated or operated with AI in Catalonia<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Tax<span class=\"n\">23<\/span><\/summary><div class=\"indice-cuerpo\"><p>Preparing and filing taxes with AI is minimal risk under the AI Act. What really creates obligations is that the firm is liable for what it files, needs the client&#x27;s authorization to act as representative and its own digital certificate, personal income tax returns contain special categories of data, and tax advisers are obliged entities for anti-money laundering purposes. Its key points apply to the whole gestor\u00eda (tax, accounting and labor advisory firm).<\/p><ul><li><a href=\"#dep=G1&amp;uso=G1-01\">Preparing tax returns with AI (personal income tax, VAT, corporate income tax): reconciling data, proposing boxes and deductions<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-02\">Reading client documents with AI (withholding certificates, tax data from the Spanish Tax Agency (AEAT), notarial deeds, invoices, receipts)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-03\">Researching the law with AI (legal or general-purpose assistants)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-04\">Electronic filing of tax returns on behalf of clients<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-05\">Keeping clients&#x27; digital certificates at the firm or giving them to an AI tool<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-06\">AI agents that file returns, answer requests from the authorities or carry out procedures on the electronic office (sede electr\u00f3nica) without human intervention<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-07\">AI that monitors the Spanish Tax Agency (AEAT) notifications inbox, summarizes requests and flags deadlines<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-08\">VERI*FACTU: advising clients on their invoicing systems (including those that generate invoices with AI)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-09\">Mandatory B2B e-invoicing: getting clients ready<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-10\">Chat or assistant for clients (income tax queries, missing documents, file status)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-11\">Collecting documents by email, WhatsApp or portal with automatic classification by client and financial year<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-12\">Tax planning or simulations with AI for a client<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-13\">Report on an individual&#x27;s income or financial capacity for a bank or landlord, with an AI score<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-14\">Anti-money laundering customer due diligence with AI (identification, beneficial owner, sanctions lists)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-15\">Firm employees using free AI tools with clients&#x27; tax returns<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-16\">Retention of tax returns, supporting documents and conversations with the AI<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-17\">Using AI with client data without having established whether the firm is processor or controller for each service<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-18\">Cloud AI provider processing the firm&#x27;s client data<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-19\">Sending client data to AI providers outside the European Economic Area<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-20\">Confidentiality and professional secrecy when the firm uses AI<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-21\">The firm as an obliged entity for anti-money laundering purposes<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-22\">AI literacy of the firm&#x27;s staff<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-23\">Processing health or trade union data from personal income tax returns with AI on a large scale (large firm or office network)<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Accounting<span class=\"n\">16<\/span><\/summary><div class=\"indice-cuerpo\"><p>Almost everything AI does in accounting is minimal risk. What creates obligations is the usual: the accounts remain the business owner&#x27;s responsibility even if the firm keeps them, the annual accounts are prepared and signed by the directors and, as an external accountant, the firm is an obliged entity for anti-money laundering purposes.<\/p><ul><li><a href=\"#dep=G2&amp;uso=G2-01\">Automatic reading of invoices (AI-based OCR) and proposed journal entry<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-02\">Automatic bank reconciliation<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-03\">Accounting classification and assignment of Spanish General Accounting Plan (PGC) accounts by the AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-04\">Year-end closing and draft annual accounts prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-05\">Legalization of accounting books and filing of annual accounts with the help of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-06\">Management report or notes to the accounts drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-07\">Management information for clients (dashboards, forecasts, cash flow commentary) generated with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-08\">Detecting errors, anomalies or possible fraud in the client&#x27;s accounts<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-09\">Assistant answering accounting questions from the firm&#x27;s staff (PGC, ICAC resolutions, queries)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-10\">Chat or portal for clients that answers questions about their accounts (balances, outstanding invoices, deadlines)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-11\">Evaluating the creditworthiness of individual clients (natural persons) for financing, rentals or payment deferrals<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-12\">Data on suppliers who are self-employed individuals and on individual customers appearing in the accounts<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-13\">AI-assisted anti-money laundering due diligence on the firm&#x27;s clients<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-14\">Firm that, in addition to bookkeeping, audits accounts<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-15\">Firm employees using free AI tools with clients&#x27; accounts<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-16\">Retention of digitized accounting records and AI logs<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Commercial and corporate<span class=\"n\">16<\/span><\/summary><div class=\"indice-cuerpo\"><p>Drafting corporate documents with AI is minimal risk. What creates obligations: minutes state what was resolved and are signed by whoever holds the authority to do so; anyone who forms companies is an obliged entity for anti-money laundering purposes and may not rely solely on the beneficial ownership register; due diligence involves trade secrets; and electronic signatures have their own rules.<\/p><ul><li><a href=\"#dep=G3&amp;uso=G3-01\">Company formation with AI: draft articles of association, single electronic document (DUE), company name reservation, documentation for the notary<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-02\">Minutes of general meetings or board meetings drafted with AI (from notes, the notice of meeting or a recording)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-03\">Certificates of resolutions and notarization (elevaci\u00f3n a p\u00fablico) prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-04\">Corporate books (minute book, register of shareholders) kept or prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-05\">Commercial Registry: electronic filing, reading the registrar&#x27;s assessments and correcting defects with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-06\">AI-assisted identification of the beneficial owner and due diligence (Beneficial Ownership Register, sanctions lists, politically exposed persons)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-07\">Non-face-to-face identification of clients by video or with automatic biometric verification<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-08\">Indications of money laundering detected by the AI in a corporate transaction (opaque structures, ownership changes without business rationale, serial registered addresses)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-09\">Powers of attorney and deeds: drafts and instructions for the notary containing data on shareholders, directors and attorneys<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-10\">Due diligence with AI (bulk review of contracts, litigation, employment, industrial property) in an acquisition or the entry of new shareholders<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-11\">Family protocol (family business charter) drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-12\">Electronic signature of minutes, contracts or certificates and their automated management with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-13\">Assistant answering corporate law questions from staff (queries, DGSJFP resolutions, deadlines)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-14\">Chat for clients (status of a company formation, pending documents, notary appointments)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-15\">AI analysis of public data on companies and directors (Official Gazette of the Commercial Registry (BORME), Commercial Registry) to acquire clients or for profiling<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-16\">Firm employees using free AI tools with articles of association, shareholders&#x27; agreements or data rooms<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Labor and payroll<span class=\"n\">21<\/span><\/summary><div class=\"indice-cuerpo\"><p>The firm handles human resources for its clients and processes their employees&#x27; data: payroll, sick leave, dismissals and, sometimes, criminal records. Recruiting or making decisions about workers with AI is high risk from December 2, 2027, and already today the GDPR, the Workers&#x27; Statute (Estatuto de los Trabajadores) and, from October 5, 2026, the requirement to provide written information on algorithms apply.<\/p><ul><li><a href=\"#dep=G4&amp;uso=G4-02\">Interpreting the collective agreement or reviewing payroll issues with an AI assistant<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-03\">Employment contracts and onboarding information drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-04\">Social Security registrations and deregistrations of workers prepared or submitted automatically<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-05\">Calculating final settlements and severance pay for a dismissal already decided by the client<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-06\">AI that proposes whom to dismiss, whom to include in a temporary lay-off scheme (ERTE) or whom to promote<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-07\">Temporary lay-off scheme (ERTE): report, communications and documentation drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-08\">Sick leave and temporary incapacity: handling medical certificates and calculating benefits<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-09\">Recruitment for a client with AI: filtering, scoring or ranking CVs<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-10\">Summarizing CVs at the recruiter&#x27;s request, without scoring or ranking<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-11\">Job advertisements drafted with AI for clients<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-12\">Clients&#x27; working time records kept with software<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-13\">Biometric working time records (fingerprint or face)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-14\">Equality plans and the preliminary diagnosis prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-15\">Pay register and pay audit with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-16\">Submissions and replies to the Labor and Social Security Inspectorate drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-17\">Q&amp;A chat for clients&#x27; employees (payslips, holidays, leave)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-18\">Sexual offenses certificates for workers in contact with minors<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-19\">Evaluating the performance of a client&#x27;s employees (HR consultancy)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-20\">Emotion recognition of a client&#x27;s staff (voice, camera, typing patterns)<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-21\">Firm staff using free AI tools with clients&#x27; payroll or contracts<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-22\">Record of processing activities of the payroll firm, even if it has fewer than 250 staff<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Administrative procedures<span class=\"n\">15<\/span><\/summary><div class=\"indice-cuerpo\"><p>Here AI does not just draft: it fills in forms, monitors notifications and can file documents on behalf of a client and with credentials. The AI Act imposes hardly any obligations; what does is administrative law, representation, security and the firm&#x27;s professional liability.<\/p><ul><li><a href=\"#dep=G5&amp;uso=G5-01\">Vehicle transfers before the Directorate-General for Traffic (DGT): reading registration documents and contracts and preparing the file with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-02\">AI agent that fills in forms on an electronic office (sede electr\u00f3nica) and leaves submission to a person<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-03\">AI agent that files or signs documents without human review<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-04\">Keeping clients&#x27; digital certificates on the firm&#x27;s computers<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-05\">Client&#x27;s Cl@ve or passwords stored by the firm or used by an AI agent<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-06\">AI monitoring of electronic notifications (e-office inboxes, the single authorized electronic address, DEH\u00fa)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-07\">Calculating administrative deadlines with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-08\">Classifying and summarizing requests and notifications received<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-09\">Immigration: preparing files (residence permits, residence on grounds of settlement (arraigo), renewals) with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-10\">Criminal record certificates collected for a procedure<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-11\">Business activity or building permits: reports and documentation drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-12\">Grants and subsidies: applications prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-13\">Using AI to predict whether an application will succeed, in order to advise the client<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-14\">File tracking chat for clients<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-15\">Firm staff using free AI tools with client documents<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Reception and document intake<span class=\"n\">18<\/span><\/summary><div class=\"indice-cuerpo\"><p>This is the entry point for all the firm&#x27;s data: ID cards (DNI), payslips, deeds, sick notes and certificates arrive by email, WhatsApp or portal, and here AI classifies, reads and files them. Almost everything is minimal risk; what creates obligations is the GDPR: data minimization, channel security, retention periods and the firm&#x27;s role as processor.<\/p><ul><li><a href=\"#dep=G6&amp;uso=G6-01\">Automatic classification of incoming documents (by client, type and procedure)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-02\">Shared email inbox with AI that reads, summarizes and routes messages<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-03\">Receiving documents via WhatsApp<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-04\">Client portal with document upload and automatic reading<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-05\">OCR of ID cards (DNI) and identity documents<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-06\">Extracting data from invoices, payslips or deeds with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-07\">Sick notes, medical reports or criminal record certificates arriving at reception<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-08\">Automated retention and deletion by retention period<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-09\">Smart search of the archive (asking the AI about client documents)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-10\">Customer service chat on the website or portal<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-11\">Voice assistant on the firm&#x27;s switchboard<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-12\">Electronic signature of engagement letters, mandates and documents with clients<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-13\">Replies to clients drafted by AI and reviewed<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-14\">Sending documents to clients by email with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-15\">Record of processing activities including AI processing<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-16\">Staff forwarding client documents to their personal email or to a free AI tool<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-17\">Keeping a copy of the client&#x27;s ID card (DNI) when the firm is an obliged entity for anti-money laundering purposes (tax advice, external accounting, company formation, registered office services)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-18\">Keeping a copy of the ID card (DNI) for services not covered by Ley 10\/2010 (for example, only Directorate-General for Traffic (DGT) procedures or only payroll)<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Real penalty cases<span class=\"n\">65<\/span><\/summary><div class=\"indice-cuerpo\"><ul class=\"indice-casos\"><li><strong>Mercadona, S.A.<\/strong> (2021): Installed facial recognition in its shops to detect persons subject to restraining orders. <em>\u20ac2,520,000 (\u20ac3,150,000 initially; \u221220% for voluntary payment)<\/em> \u00b7 GDPR, Articles 6 and 9, 12 and 13, 5(1)(c), 25(1) and 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00120-2021.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>AENA, S.M.E., S.A.<\/strong> (2024): Used facial recognition for passenger access to airport areas without a valid impact assessment. <em>\u20ac10,043,002<\/em> \u00b7 GDPR, Article 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00431-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Yoti Ltd<\/strong> (2025): Facial age verification provider: by default it used biometric data, including those of minors, for \u201cresearch and development.\u201d <em>\u20ac950,000 (\u20ac500,000 + \u20ac200,000 + \u20ac250,000)<\/em> \u00b7 GDPR, Articles 9, 7 and 5(1)(e) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00164-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Universitat Internacional Valenciana \u2013 Valencian International University, S.L.<\/strong> (25-4-2025): Online exams proctored with facial recognition, artificial intelligence and automated decision-making, with no alternative for students. <em>\u20ac650,000 (\u20ac300,000 + \u20ac350,000)<\/em> \u00b7 GDPR, Articles 9 and 5(1)(c) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00067-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Universidad Europea de Valencia, S.L.<\/strong> (2025): Required the use, in online exams, of software with facial recognition and camera and microphone monitoring. <em>\u20ac160,000 (\u20ac200,000 initially; \u221220% for voluntary payment)<\/em> \u00b7 GDPR, Articles 9 and 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00447-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Fundaci\u00f3 per a la Universitat Oberta de Catalunya (UOC)<\/strong> (2022): Required students to register with a facial recognition tool in order to take remote assessments. <em>\u20ac20,000<\/em> \u00b7 GDPR, Articles 5(1)(a) and 9 \u00b7 <a href=\"https:\/\/seu.apdcat.cat\/ca\/documentPublic\/download\/3592\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Liga Nacional de F\u00fatbol Profesional<\/strong> (2023): Imposed biometric access to the supporters&#x27; stands at stadiums without a valid impact assessment. <em>\u20ac1,000,000<\/em> \u00b7 GDPR, Article 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00484-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>SIDECU, S.A. (gimnasios)<\/strong> (2024): Switched access to its gyms to facial recognition and refused entry to anyone who did not accept it. <em>\u20ac96,000 (\u20ac160,000 initially; \u221240% for early payment and acknowledgment of liability)<\/em> \u00b7 GDPR, Articles 9 and 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00289-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Loro Parque, S.A.<\/strong> (2023): Took the fingerprints of visitors holding a two-park ticket, to check that it was the same person. <em>\u20ac250,000<\/em> \u00b7 GDPR, Article 9 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00432-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>CTC Externalizaci\u00f3n, S.L.<\/strong> (2023 \u00b7 SAN of 30-6-2026): Staff clocking-in by fingerprint without adequate information, without sufficient security measures and without an impact assessment. <em>\u20ac50,000 after the National High Court ruling (\u20ac365,000 initially: \u20ac200,000 + \u20ac65,000 + \u20ac100,000)<\/em> \u00b7 AEPD: GDPR, Articles 13, 32 and 35. National High Court: the Article 13 infringement becomes a minor infringement (LOPDGDD, Article 74.a, \u20ac10,000), the Article 32 fine stays at \u20ac40,000 and the Article 35 fine is annulled \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00170-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>MAXAMCORP International, S.L.<\/strong> (1-3-2026): Replaced cards with fingerprints for clocking in, without a valid legal basis or an impact assessment. <em>\u20ac400,000 (\u20ac300,000 + \u20ac100,000)<\/em> \u00b7 GDPR, Articles 9 and 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00552-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Cartonajes Ba\u00f1eres, S.A.<\/strong> (2023): Clocking-in by facial recognition without an impact assessment; it also failed to reply to a former employee who requested their data. <em>\u20ac220,000 (\u20ac200,000 + \u20ac20,000)<\/em> \u00b7 GDPR, Articles 35 and 15 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00361-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Ares Capital, S.A. (ride-hailing)<\/strong> (2024): Required drivers to use work apps on their personal mobile phones, with geolocation, and collected more data than necessary. <em>\u20ac200,000<\/em> \u00b7 GDPR, Articles 13, 5(1)(c) and 6(1) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00454-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>GlovoApp23, S.A.<\/strong> (2022 \u00b7 decision of 7-3-2023): Misconfigured permissions: customer service staff in other countries could see couriers&#x27; data (location, ratings). <em>\u20ac550,000 + warning (apercibimiento)<\/em> \u00b7 GDPR, Articles 25 and 32 (fine) and 13 (warning) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00209-2022.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Posada del Le\u00f3n de Oro, C.B. (hotel, Madrid)<\/strong> (2025): Camera recording image and audio at the front desk, which any employee could watch live. <em>\u20ac240 (\u20ac400 initially; \u221240%)<\/em> \u00b7 GDPR, Articles 5(1)(c) and 13 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00598-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Universitat Aut\u00f2noma de Barcelona<\/strong> (7-10-2025): An AI meeting assistant (Read.ai) recorded and transcribed a Teams meeting without the participants knowing, and sent the summary by email. <em>No fine (public authority: declaration of infringement only)<\/em> \u00b7 GDPR, Articles 25 and 5(1)(a) \u00b7 <a href=\"https:\/\/seu.apdcat.cat\/ca\/documentPublic\/download\/8019\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Adverbis Spain, S.L.<\/strong> (2024): Made an automated call (recorded message) to a number registered on the Robinson List (Spanish advertising opt-out register). <em>\u20ac5,000<\/em> \u00b7 Spanish General Telecommunications Act (Ley 11\/2022, LGTel), Article 66.1.b, offense defined in Article 107.30 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00084-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>M\u00e1s Sol Energ\u00eda 15, S.L.<\/strong> (28-4-2026): Called a number on the Robinson List (Spanish advertising opt-out register) and could not say where it had obtained the telephone number. <em>\u20ac10,000 (\u20ac5,000 + \u20ac5,000)<\/em> \u00b7 Spanish General Telecommunications Act (LGTel), Article 66.1.b; GDPR, Article 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00249-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Napptive Solutions, S.L.<\/strong> (2024): Used an email address published on GitHub for prospecting without informing the person of the source of their data (web scraping). <em>No fine (warning)<\/em> \u00b7 GDPR, Article 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/pa-00015-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Informa D&amp;B, S.A.<\/strong> (2024 \u00b7 decision of 14-4-2025): Bought a file with data on self-employed individuals from a third party and marketed it without a legal basis or informing them. <em>\u20ac1,800,000 (\u20ac900,000 + \u20ac900,000)<\/em> \u00b7 GDPR, Articles 6(1) and 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00149-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Axesor Conocer para Decidir, S.A.U.<\/strong> (2025): Marketed data on self-employed individuals taken from the Chamber of Commerce census, without a legal basis or informing them. <em>\u20ac128,000 (\u20ac160,000 initially; \u221220%)<\/em> \u00b7 GDPR, Articles 6(1) and 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00464-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>CaixaBank, S.A.<\/strong> (Decision of 5-1-2021 \u00b7 SAN of 8-5-2025): Built commercial profiles of its customers on the basis of improperly obtained consent and informed them in a confusing way (the AEPD declared that it did not infringe Article 22 GDPR). <em>\u20ac2,000,000 after the National High Court ruling (\u20ac6,000,000 initially)<\/em> \u00b7 GDPR, Articles 6, 13 and 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00477-2019.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Banco Bilbao Vizcaya Argentaria, S.A.<\/strong> (Decision of 18-11-2020 \u00b7 STS of 11-11-2024): Processing of customer data for commercial purposes without a valid legal basis and with insufficient information. <em>\u20ac5,000,000 (\u20ac2,000,000 + \u20ac3,000,000)<\/em> \u00b7 GDPR, Articles 13, 14 and 6 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00070-2019.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Vodafone Espa\u00f1a, S.A.U.<\/strong> (Decision of 11-2-2021 \u00b7 SAN of 29-10-2024): Mass marketing campaigns (calls, SMS, emails) carried out by suppliers without control and without respecting objections. <em>\u20ac4,580,000 after the National High Court ruling (\u20ac8,150,000 initially)<\/em> \u00b7 GDPR, Articles 28 and 24, Article 44; Spanish Information Society Services Act (LSSI), Article 21; former Spanish General Telecommunications Act (Ley 9\/2014, LGTel), Article 48.1.b \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00059-2020.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Gestores Administrativos Reunidos, S.A. (GARSA)<\/strong> (2026): Gestor\u00eda administrativa (administrative services firm) working for the banking sector: suffered a breach of client data and the AEPD had to order it to notify those affected. <em>\u20ac75,000 (\u20ac125,000 initially: \u20ac100,000 + \u20ac25,000; \u221240%)<\/em> \u00b7 GDPR, Articles 5(1)(f) and 33 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00008-2026.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Administraciones Benipon, S.L.<\/strong> (2025): Property manager for a residents&#x27; association (acting as processor) that subcontracted without authorization and did not notify the controller of a breach. <em>\u20ac1,100 (\u20ac300 + \u20ac300 + \u20ac500)<\/em> \u00b7 GDPR, Articles 28(2), 28(4) and 33(2) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00251-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Konecta BTO, S.L.<\/strong> (2025): Call center working as a processor: unauthorized access to its systems exposed the data of its client&#x27;s customers. <em>\u20ac300,000 (\u20ac500,000 initially; \u221240%)<\/em> \u00b7 GDPR, Article 5(1)(f) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00613-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Coyare, S.L.U. (Bufete-RA)<\/strong> (2023): Law firm that sent advertising to 95 people with all the addresses visible in copy (CC). <em>\u20ac2,500 (\u20ac2,000 + \u20ac500)<\/em> \u00b7 GDPR, Articles 5(1)(f) and 32 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00395-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Marina Salud, S.A.<\/strong> (2024): As processor for the regional health department (Conselleria), it engaged sub-processors without first informing the controller of the changes. <em>\u20ac500,000<\/em> \u00b7 GDPR, Article 28(2) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00127-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Endesa Energ\u00eda, S.A.U.<\/strong> (Decision of 25-10-2023): Unauthorized access to its commercial systems containing customer data; it failed to notify the breach and to inform those affected, and made international transfers without safeguards. <em>\u20ac6,100,000 (\u20ac2,500,000 + \u20ac1,500,000 + \u20ac800,000 + \u20ac800,000 + \u20ac500,000)<\/em> \u00b7 GDPR, Articles 5(1)(f), 32, 33, 34 and 44 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00002-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Fundaci\u00f3 Universitat Oberta de Catalunya (UOC)<\/strong> (27-8-2026): After running assignments through a plagiarism detection tool, a lecturer sent three students, in a single email, the names and assignments of all three accused. <em>\u20ac1,800 (\u20ac2,250 initially; \u221220%)<\/em> \u00b7 GDPR, Article 5(1)(f) \u00b7 <a href=\"https:\/\/seu.apdcat.cat\/ca\/documentPublic\/download\/8402\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Suneris, S.A. (hotel)<\/strong> (2024 \u00b7 payment on 28-6-2025): Scanned guests&#x27; identity documents at check-in. <em>\u20ac5,400 (\u20ac9,000 initially; \u221240%)<\/em> \u00b7 GDPR, Article 5(1)(c) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00421-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Unique Hotel Apartment, S.L.<\/strong> (2023): Kept scanned copies of guests&#x27; ID cards (DNI). <em>\u20ac2,000<\/em> \u00b7 GDPR, Article 5(1)(c) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00331-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>A private individual<\/strong> (Decision of 12-9-2025 \u00b7 later revoked): Distributed fake nude images of minors created with AI (the case known in the press as Almendralejo). <em>\u20ac1,200 paid (\u20ac2,000 initially; \u221240%)<\/em> \u00b7 GDPR, Article 6(1) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00132-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Fifteen minors (not identified)<\/strong> (20-6-2024): Used AI apps to create fake nude images of female classmates from their social media photos and distributed them. <em>One year of supervised probation for each<\/em> \u00b7 Spanish Criminal Code (C\u00f3digo Penal): child pornography and offenses against moral integrity (20 counts of each) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/AN\/openDocument\/62d3314f056ba825a0a8778d75e36f0d\/20250225\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>GlovoApp23, S.L.<\/strong> (25-9-2020): The Supreme Court held that a courier&#x27;s relationship with Glovo was an employment relationship: the algorithm allocated orders and time slots according to the courier&#x27;s rating. <em>\u2014<\/em> \u00b7 Workers&#x27; Statute (Estatuto de los Trabajadores), Articles 1.1 and 8.1 \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/TS\/openDocument\/05986cd385feff03\/20201001\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Foundever Spain, S.A.<\/strong> (4-7-2025): Failed to inform trade union representatives of the parameters of the algorithm that allocated staff days off. <em>\u20ac6,250 in damages to the trade union<\/em> \u00b7 Workers&#x27; Statute (Estatuto de los Trabajadores), Article 64.4.d; freedom of association (Spanish Constitution, Article 28.1) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/AN\/openDocument\/53f7e6ad5a39dd3fa0a8778d75e36f0d\/20250715\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Spanish State Administration (BOSCO, electricity social discount)<\/strong> (11-9-2025): The Supreme Court recognized a foundation&#x27;s right to access the source code of the program that decides who receives the social electricity tariff (bono social). <em>\u2014<\/em> \u00b7 Spanish Transparency Act (Ley 19\/2013) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/TS\/openDocument\/27d0d44d33b0dd21a0a8778d75e36f0d\/20250919\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Make Packing, S.L. y Art &amp; Graphic Packaging, S.L.<\/strong> (15-1-2026): Introduced clocking-in by facial recognition without consulting or involving staff (2023-2025). <em>\u20ac7,501 in damages to one worker<\/em> \u00b7 Right to one&#x27;s own image in connection with data protection (Spanish Constitution, Articles 18.1 and 18.4) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/AN\/openDocument\/355af934701652f8a0a8778d75e36f0d\/20260226\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Tiendas Conexi\u00f3n, S.L.U.<\/strong> (15-9-2020): Upheld a dismissal based on the GPS of the company car: the worker knew the vehicle was fitted with it. <em>\u2014<\/em> \u00b7 Spanish Constitution, Articles 18.1 and 18.4 (privacy and data protection); disciplinary dismissal (Workers&#x27; Statute (Estatuto de los Trabajadores), Article 54) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/TS\/openDocument\/8adba1406c95ebc3\/20201006\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>OpenAI (ChatGPT)<\/strong> (02-11-2024 (press release 20-12-2024)): Trained ChatGPT with personal data without a legal basis, provided poor information, did not verify age and did not notify a personal data breach. <em>\u20ac15,000,000<\/em> \u00b7 GDPR: legal basis, transparency, age verification and breach notification. The exact articles cannot be verified: the decision has been removed from the website \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10085432\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Luka Inc. (Replika chatbot)<\/strong> (10-04-2025 (press release 19-05-2025)): Offered a \u201ccompanion\u201d chatbot without a legal basis for processing data, with a deficient privacy policy and without verifying age. <em>\u20ac5,000,000<\/em> \u00b7 GDPR, Articles 5(1)(a), 5(1)(c), 6, 12, 13, 24 and 25(1) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10132048\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Character Technologies Inc. (Character.AI)<\/strong> (03-07-2026 (press release 09-07-2026)): Its character chatbots provided deficient information, it carried out the impact assessment and appointed its EU representative late, and it gave minors little protection. <em>\u20ac158,000<\/em> \u00b7 GDPR, Articles 5(2), 12, 13, 14, 24(1), 25(2), 27 and 35(1) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10269594\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Hangzhou DeepSeek Artificial Intelligence y Beijing DeepSeek Artificial Intelligence<\/strong> (30-01-2025): Processed data of users in Italy with insufficient information, without an EU representative and storing them in China, and was banned from continuing to do so with immediate effect. <em>No fine<\/em> \u00b7 GDPR, Articles 6, 12, 13, 14, 27, 31 and 32 and Chapter III; measure under Article 58(2)(f) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10097450\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Company based in the British Virgin Islands that runs the Clothoff app (the Garante does not publish its name)<\/strong> (01-10-2025 (press release 03-10-2025)): App that uses AI to \u201cundress\u201d real people, including minors, without checking consent or age. <em>No fine<\/em> \u00b7 GDPR (urgent measure; see the provvedimento) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10174320\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>R.T.I. \u2013 Reti Televisive Italiane S.p.A.<\/strong> (23-07-2026 (press release 07-08-2026)): Broadcast deepfake videos of a journalist, with his voice imitated by AI, and the \u201cmade with AI\u201d notice was not clear enough. <em>No fine<\/em> \u00b7 GDPR, Articles 5 and 25; measures under Article 58(2)(b) and 58(2)(f) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10281135\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Myndoor S.r.l.<\/strong> (14-05-2026 (press release 28-05-2026)): Offered a Slack and Teams add-on that uses AI to measure employees&#x27; stress from what they write, and the Garante issued a warning citing the prohibition on emotion recognition in the workplace. <em>No fine<\/em> \u00b7 GDPR, Article 58(2)(a) and Italian Privacy Code, Article 154(1)(f); Article 5(1)(f) of Regulation (EU) 2024\/1689 is cited \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10255522\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Foodinho s.r.l. (Glovo group)<\/strong> (13-11-2024 (press release 22-11-2024)): Algorithmic management of more than 35,000 couriers: facial recognition, location tracking outside working hours and deactivation of accounts without explaining how to challenge it or offering human intervention. <em>\u20ac5,000,000<\/em> \u00b7 GDPR, Articles 5(1)(a), (c), (d) and (e), 6, 9(2)(b), 12, 13, 22(3), 25, 28, 32, 35 and 88; Italian Privacy Code, Articles 2-septies and 114; D. Lgs. 81\/2015, Article 47-quinquies \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10074840\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Deliveroo Italy s.r.l.<\/strong> (22-07-2021 (newsletter 02-08-2021)): Opaque algorithm for allocating orders among some 8,000 couriers, with continuous geolocation and a risk of discrimination. <em>\u20ac2,500,000<\/em> \u00b7 GDPR, Articles 5(1)(a), (c) and (e), 13, 22(3), 25, 30(1), 32, 35, 37(7) and 88 \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/web\/guest\/home\/docweb\/-\/docweb-display\/docweb\/9687860\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Comune di Trento<\/strong> (11-01-2024 (press release 25-01-2024)): Research projects that used AI to analyze street cameras and microphones and social media messages, without a legal basis or an impact assessment. <em>\u20ac50,000<\/em> \u00b7 GDPR, Articles 5(1)(a), 6, 9, 10, 13 and 14 and 35; Italian Privacy Code, Articles 2-ter, 2-sexies and 2-octies \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/9977299\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Clearview AI<\/strong> (10-02-2022 (press release 09-03-2022)): Created a facial recognition database with photos scraped from the internet, and was banned from processing data of people in Italy. <em>\u20ac20,000,000<\/em> \u00b7 GDPR, Articles 5(1)(a), (b) and (e), 6, 9, 12, 13, 14, 15 and 27 \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/9751323\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Clearview AI (name per the EDPB; L\u00e9gifrance now anonymizes it, as the CNIL stops naming the company after two years)<\/strong> (17-10-2022 and 17-04-2023): Used facial recognition without a legal basis, did not comply with requests for access and erasure, and did not comply with the CNIL&#x27;s order either. <em>\u20ac20,000,000 + \u20ac5,200,000 (periodic penalty payment)<\/em> \u00b7 GDPR, Articles 6, 12, 15 and 17 \u00b7 <a href=\"https:\/\/www.legifrance.gouv.fr\/cnil\/id\/CNILTEXT000046444859\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Clearview AI Inc.<\/strong> (16-05-2024 (published 03-09-2024)): Unlawful biometric database with photos of people in the Netherlands, poor transparency and access requests left unanswered. <em>\u20ac30,500,000 (plus four orders subject to periodic penalty payments)<\/em> \u00b7 GDPR, Articles 5(1)(a) with 6(1), 9(1), 12(1) with 14(1) and 14(2), 12(2) and 12(3) with 15, and 27(1) \u00b7 <a href=\"https:\/\/www.edpb.europa.eu\/news\/national-news\/2024\/dutch-supervisory-authority-imposes-fine-clearview-because-illegal-data_en\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Clearview AI Inc.<\/strong> (Fine of May 2022; Upper Tribunal 06-10-2025): The same Clearview facial database; in 2025 the Upper Tribunal restored the ICO&#x27;s jurisdiction, which a tribunal had denied in 2023. <em>\u2248 \u00a37,500,000 (\u201c\u00a37.5m\u201d, ICO)<\/em> \u00b7 UK GDPR (territorial and material scope, Articles 2 and 3) \u00b7 <a href=\"https:\/\/ico.org.uk\/about-the-ico\/media-centre\/news-and-blogs\/2025\/10\/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc\/\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Uber<\/strong> (22-07-2024 (published 26-08-2024)): Sent data of European drivers (documents, location, photos and, in some cases, criminal and medical data) to the US without transfer safeguards. <em>\u20ac290,000,000<\/em> \u00b7 GDPR, Articles 44, 46 and 49 \u00b7 <a href=\"https:\/\/www.edpb.europa.eu\/news\/dutch-sa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to_en\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Uber B.V.<\/strong> (Published by the EDPB on 08-10-2026): Deactivated drivers&#x27; accounts fully automatically on suspicion of fraud or because of poor ratings, without informing them properly. <em>\u20ac824,990,000<\/em> \u00b7 GDPR, Articles 22 and 13 \u00b7 <a href=\"https:\/\/www.edpb.europa.eu\/news\/dutch-dpa-fines-uber-eur-824-990-000-for-unlawful-automated-decision-making-and-insufficient_en\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Amazon France Logistique<\/strong> (CNIL 27-12-2023; Conseil d&#x27;\u00c9tat 23-12-2025): Its warehouse scanners measured each worker to the second and kept all indicators for 31 days, an excess of data confirmed by the Conseil d&#x27;\u00c9tat. <em>\u20ac32,000,000 \u2192 \u20ac15,000,000<\/em> \u00b7 GDPR, Articles 5(1)(c), 12, 13 and 32 (the Article 6(1)(f) infringement is annulled) \u00b7 <a href=\"https:\/\/www.legifrance.gouv.fr\/ceta\/id\/CETATEXT000053163189\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>LinkedIn Ireland Unlimited Company<\/strong> (22-10-2024 (press release 24-10-2024)): Analyzed its users&#x27; behavior for targeted advertising without a valid legal basis or sufficient transparency. <em>\u20ac310,000,000<\/em> \u00b7 GDPR, Articles 5(1)(a), 6, 13(1)(c) and 14(1)(c) \u00b7 <a href=\"https:\/\/www.dataprotection.ie\/en\/news-media\/press-releases\/irish-data-protection-commission-fines-linkedin-ireland-eu310-million\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>TikTok Technology Limited<\/strong> (30-04-2025 (press release 02-05-2025)): Allowed access from China to European users&#x27; data without guaranteeing equivalent protection and without explaining it. <em>\u20ac530,000,000 (\u20ac485 million + \u20ac45 million)<\/em> \u00b7 GDPR, Articles 46(1) and 13(1)(f) \u00b7 <a href=\"https:\/\/www.dataprotection.ie\/en\/news-media\/latest-news\/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>X (Grok)<\/strong> (08-08-2024; closed on 04-09-2024): Used public posts by European users to train Grok and gave an undertaking before the court to stop processing those data permanently. <em>No fine<\/em> \u00b7 GDPR (lawfulness of processing) \u00b7 <a href=\"https:\/\/www.dataprotection.ie\/en\/news-media\/press-releases\/dpc-welcomes-xs-agreement-suspend-its-processing-personal-data-purpose-training-ai-tool-grok\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Hangzhou DeepSeek Artificial Intelligence Co., Ltd. y Beijing DeepSeek Artificial Intelligence Co., Ltd.<\/strong> (16-12-2025 (press release 30-04-2026)): Its chatbot did not warn that it may \u201challucinate\u201d (make up information), and it undertook to display permanent warnings and improve its information. <em>No fine<\/em> \u00b7 Italian Consumer Code, Articles 20, 21 and 22 (closed under Article 27(7), without a finding of infringement) \u00b7 <a href=\"https:\/\/www.agcm.it\/media\/comunicati-stampa\/2026\/4\/PS12942-PS12968-PS12973\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>SCHUFA Holding (credit reference agency)<\/strong> (07-12-2023): Automatically calculating the probability that a person will default is an \u201cautomated decision\u201d if a third party (a bank, for example) relies on it to grant or refuse a contract. <em>Not applicable<\/em> \u00b7 GDPR, Article 22(1) (interpretation) \u00b7 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/ES\/TXT\/?uri=CELEX:62021CJ0634\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Dun &amp; Bradstreet Austria GmbH<\/strong> (27-02-2025): A person refused a contract on the basis of an automated credit profile must be given an understandable explanation of how the result was reached, and trade secrecy does not allow a straightforward refusal. <em>Not applicable<\/em> \u00b7 GDPR, Articles 15(1)(h) and 22(1) (interpretation) \u00b7 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/ES\/TXT\/?uri=CELEX:62022CJ0203\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Uber B.V.<\/strong> (04-04-2023): Deactivated drivers without genuine human intervention, and the court ordered it to explain the logic of the decision to them. <em>\u20ac4,000\/day periodic penalty payment<\/em> \u00b7 GDPR, Articles 15(1)(h) and 22 \u00b7 <a href=\"https:\/\/uitspraken.rechtspraak.nl\/details?id=ECLI:NL:GHAMS:2023:793\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>(European Commission; affects any company sending data to the US)<\/strong> (03-09-2025; appeal of 31-10-2025): The General Court upheld the EU-US data transfer framework (Data Privacy Framework), and the judgment is under appeal before the Court of Justice. <em>Not applicable<\/em> \u00b7 Adequacy decision (EU) 2023\/1795; GDPR, Article 45 \u00b7 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/ES\/ALL\/?uri=CELEX:62025CN0703\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><\/ul><\/div><\/details><\/div><\/div><\/div><\/section>\r\n\r\n  <section class=\"bloque bloque-cta\" aria-labelledby=\"cta-t\">\r\n    <div class=\"envoltorio\">\r\n      <div class=\"cta\">\r\n        <p class=\"cta-ante\">Diagn\u00f3stico<\/p>\r\n        <h2 id=\"cta-t\">Cu\u00e9ntanos c\u00f3mo funciona tu empresa<\/h2>\r\n        <p>Antes de implantar IA, estudiamos c\u00f3mo trabaja tu empresa: procesos, programas y pruebas con tus datos reales. Y te llevas tambi\u00e9n un informe normativo: protecci\u00f3n de datos y Reglamento europeo de IA.<\/p>\r\n        <p class=\"cta-cumple\">Cada proyecto pasa por una revisi\u00f3n de cumplimiento normativo \u2014protecci\u00f3n de datos y Reglamento europeo de IA\u2014 con nuestro partner Forrellat Consultors, Delegado de Protecci\u00f3n de Datos inscrito en la AEPD.<\/p>\r\n        <div class=\"cta-botones\">\r\n          <a class=\"btn tap\" href=\"https:\/\/robustdatasolutions.com\/contacto\/\" id=\"cta-boton\">Cu\u00e9ntanos sobre tu empresa<\/a>\r\n          <a class=\"cta-sec tap\" href=\"https:\/\/robustdatasolutions.com\/diagnostico\/\">C\u00f3mo es el diagn\u00f3stico \u2192<\/a>\r\n        <\/div>\r\n      <\/div>\r\n      <div class=\"aviso-legal\" role=\"note\" data-no-translation data-no-dynamic-translation>\r\n        <p><strong>Information only, not legal advice.<\/strong> <span id=\"aviso-texto\">Checked against official sources on October 22, 2026.<\/span><\/p>\r\n      <\/div>\r\n    <\/div>\r\n  <\/section>\r\n<\/div>\r\n<dialog class=\"video-capa\" id=\"video-capa\" aria-label=\"Video: AI Act by department\" data-no-translation data-no-dynamic-translation><button class=\"cerrar tap\" type=\"button\" aria-label=\"Close the video\">\u00d7<\/button><div class=\"marco-916\" id=\"video-marco\"><\/div><\/dialog>\r\n<div class=\"toast\" id=\"toast\" role=\"status\" aria-live=\"polite\" data-no-translation data-no-dynamic-translation><\/div>\r\n<\/div>\r\n[\/et_pb_fullwidth_code][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<div id=\"ley-ia\" class=\"ley-ia\" data-ley-ia-lang=\"en\">\r\n<script type=\"application\/json\" id=\"ley-ia-arranque\" data-no-translation data-no-dynamic-translation>{\"lang\":\"en\",\"textos\":{\"locale\":\"en-US\",\"saltar\":\"Skip to the search\",\"buscar_label\":\"Search for a use of AI in your company\",\"placeholder\":\"What does AI require of me?\",\"borrar_busqueda\":\"Clear the search\",\"sugerencias_aria\":\"Example searches\",\"sugerencias\":[\"chatbot\",\"CV\",\"images\",\"video\",\"voice\",\"reviews\",\"invoices\",\"ID\"],\"cifras\":[\"AI uses analyzed\",\"departments\",\"real cases\"],\"nav_aria\":\"Report sections\",\"nav_usos\":\"AI uses\",\"nav_casos\":\"Real cases\",\"nav_fechas\":\"Key dates\",\"ante_usos\":\"AI uses\",\"ante_casos\":\"Spain and Europe\",\"ante_fechas\":\"Calendar\",\"ante_indice\":\"Report index\",\"tu_sector\":\"Your sector\",\"departamento\":\"Department\",\"nivel\":\"Level\",\"donde\":\"Where\",\"sector\":\"Sector\",\"generales_toggle\":\"Also include what applies to any company\",\"leyenda_titulo\":\"What does each level and notice mean?\",\"quitar_filtros\":\"Clear filters\",\"todos\":\"All\",\"generales\":\"General\",\"corto\":{\"todos\":\"Any company\",\"hoteles\":\"Hotels\",\"gestorias\":\"Advisory firms\"},\"uso\":\"use\",\"usos\":\"uses\",\"ningun_uso\":\"No uses match these filters\",\"tambien_en\":\"Also appears in:\",\"sin_resultados_t\":\"No results\",\"sin_resultados_p\":\"Try another word or level, or clear the filters.\",\"ver_mas\":\"Show {n} more ({q} left)\",\"ya_exigible\":\"Already applicable\",\"desde_futuro\":\"From {f}\",\"desde_pasado\":\"Applicable since {f}\",\"ej\":\"E.g.: \",\"icono_ue\":\"Official EU icon (optional)\",\"ver_ficha\":\"See details\",\"cerrar_ficha\":\"Close details\",\"que_exige\":\"What the law requires\",\"normas\":\"Rules\",\"que_recomienda\":\"What Robust recommends\",\"casos_rel\":\"Related real cases\",\"copiar\":\"Copy link to this entry\",\"copiado\":\"Link copied\",\"ambito_es\":\"Spain\",\"ambito_eu\":\"Europe\",\"todos_sectores\":\"All sectors\",\"todos_deps\":\"All departments\",\"c_norma\":\"Rule\",\"c_referencia\":\"Reference\",\"c_sector\":\"Sector\",\"c_departamentos\":\"Departments\",\"c_fuente\":\"See the official source \u2197\",\"caso\":\"case\",\"casos\":\"cases\",\"ningun_caso\":\"No cases match these filters\",\"sin_casos_t\":\"No cases\",\"sin_casos_p\":\"Try another sector or department.\",\"aviso_casos\":\"There are no fines under the AI Act yet; the existing ones come from data protection, e-commerce (LSSI) or employment law\",\"hoy\":\"Today\",\"ya_aplica\":\"In force\",\"faltan_dias\":\"{n} days to go\",\"faltan_meses\":\"{n} months to go\",\"mas_adelante\":\"Later\",\"ver_todas_fechas\":\"Show all dates ({n})\",\"ver_cercanas\":\"Show only the nearest dates\",\"leyenda_niveles\":\"Levels\",\"leyenda_avisos\":\"Public notices\",\"leyenda_nota\":\"The EU icons are optional; the obligation to disclose, where it exists, is not (European Commission Code of Practice on transparency, June 10, 2026).\",\"niveles\":{\"minimo\":[\"Minimal\",\"The AI Act adds no specific obligations for this use. Other rules, such as data protection, still apply.\"],\"transparencia\":[\"Transparency\",\"Disclosure is required: people must know they are talking to an AI, or that the content was generated or manipulated with AI (AI Act, Art. 50).\"],\"alto\":[\"High risk\",\"High-risk use under the AI Act: stricter obligations for the company that uses it.\"],\"prohibido\":[\"Prohibited\",\"Practice prohibited by the AI Act.\"],\"fuera\":[\"Outside the AI Act\",\"Not regulated by the AI Act, but another rule applies: data protection, LSSI (e-commerce), employment law or others.\"]},\"avisos\":{\"UE-generado\":[\"EU icon: AI-generated content\",\"Official EU icon \u201cFully AI-Generated\u201d: content entirely generated with AI.\"],\"UE-modificado\":[\"EU icon: AI-modified content\",\"Official EU icon \u201cPartially AI-Modified\u201d: human content partly modified with AI.\"],\"UE-basico\":[\"Basic EU AI icon\",\"Basic EU icon: AI was used in a deepfake or in a published text.\"],\"interaccion\":[\"\",\"Disclose that people are talking to an AI (indicative icon, not an official EU icon).\"],\"ninguno\":[\"\",\"No mandatory public notice.\"]},\"video_titulo\":\"Watch it in 1 minute\",\"video_subtitulo\":\"In Spanish, with subtitles \u00b7 AI-generated voice and images\",\"video_trans\":\"Video transcript (in Spanish)\",\"video_cerrar\":\"Close the video\",\"video_error\":\"The video could not be loaded.\",\"video_aria\":\"Video: AI Act by department\",\"aviso_legal_fuerte\":\"Information only, not legal advice.\",\"aviso_legal_fecha\":\"Checked against official sources on {f}.\",\"indice_intro\":\"{u} verified uses across {d} departments and {c} real cases. Tap a use to open its entry with what the law requires and what Robust recommends.\",\"indice_casos\":\"Real penalty cases\",\"indice_fuente\":\"official source\",\"fecha_linea\":\"{mes} edition \u00b7 Updated {fecha}\",\"cargando\":\"Loading the search\u2026\",\"error_datos\":\"The search data could not be loaded. Please reload the page.\",\"nombre_corto\":\"AI Act by department\"},\"datos_url\":\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/datos_en.json?v=8cd45dda02\",\"config\":{\"edicion\":\"2026-10-22\",\"fecha_larga\":\"October 22, 2026\"}}<\/script>\r\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"VideoObject\",\"@id\":\"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/#video\",\"name\":\"Ley de IA por departamentos: \u00bfse puede usar ChatGPT con datos de clientes?\",\"description\":\"Qu\u00e9 exige la ley cuando marketing crea im\u00e1genes con IA, recursos humanos filtra curr\u00edculums o recepci\u00f3n escanea el DNI. Presentaci\u00f3n del buscador gratuito Ley de IA por departamentos, de Robust Data Solutions.\",\"thumbnailUrl\":[\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_portada_16x9.jpg\",\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_portada.jpg\"],\"uploadDate\":\"2026-10-22T12:00:00+02:00\",\"duration\":\"PT55S\",\"contentUrl\":\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_16x9.mp4\",\"inLanguage\":\"es-ES\",\"publisher\":{\"@id\":\"https:\/\/robustdatasolutions.com\/#organization\"}}<\/script>\r\n<a class=\"saltar\" href=\"#buscar\" data-no-translation data-no-dynamic-translation>Skip to the search<\/a>\r\n<section class=\"hero\" aria-labelledby=\"titulo\">\r\n  <div class=\"envoltorio hero-in\">\r\n    <div class=\"hero-txt con-video\">\r\n    <p class=\"antetitulo\">Buscador por departamento y sector<\/p>\r\n    <h1 id=\"titulo\">Ley de IA y RGPD: qu\u00e9 exige a cada departamento de tu empresa<\/h1>\r\n    <p class=\"hero-informe\">Informe Robust de cumplimiento de IA y RGPD en la empresa espa\u00f1ola<\/p>\r\n    <p class=\"hero-fecha\" data-no-translation data-no-dynamic-translation><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><rect x=\"3.5\" y=\"5\" width=\"17\" height=\"15\" rx=\"2.5\"\/><path d=\"M3.5 10h17M8 3v4M16 3v4\"\/><\/svg><time datetime=\"2026-10-22\">October 2026 edition \u00b7 Updated October 22, 2026<\/time><\/p>\r\n    <p class=\"hero-valor\">Lo que tu equipo ya hace con IA, departamento a departamento: qu\u00e9 exige la ley, qu\u00e9 te recomendamos y qu\u00e9 multas reales ha habido.<\/p>\r\n    <div class=\"video-w\" data-no-translation data-no-dynamic-translation><button class=\"video-fachada tap\" type=\"button\" aria-haspopup=\"dialog\" data-src=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_9x16.mp4\" data-src-ancho=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_16x9.mp4\" data-poster-ancho=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_portada_16x9.jpg\" data-consulta-ancho=\"(min-width: 900px) and (orientation: landscape)\"><span class=\"video-mini\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/ley-de-ia\/video_ley_ia_portada.jpg\" alt=\"\" width=\"72\" height=\"128\"><span class=\"play\" aria-hidden=\"true\"><\/span><\/span><span class=\"video-txt\"><strong>Watch it in 1 minute<\/strong><small>In Spanish, with subtitles \u00b7 AI-generated voice and images<\/small><\/span><\/button><details class=\"video-trans\"><summary class=\"tap\">Video transcript (in Spanish)<\/summary><p lang=\"es\">\u00bfSe puede usar ChatGPT con datos de clientes? Y no es la \u00fanica duda: marketing crea im\u00e1genes, recursos humanos filtra curr\u00edculums, recepci\u00f3n escanea el DNI. Cada uso tiene sus normas. Y siguen cambiando. Equivocarse sale caro: m\u00e1s de diez millones de multa a Aena, por usar reconocimiento facial sin una evaluaci\u00f3n de impacto v\u00e1lida. Por eso hemos publicado Ley de IA por departamentos, un buscador gratuito. Escribes ChatGPT y te lo dice: con una cuenta personal, meter datos de clientes puede ser una brecha. M\u00e1s de trescientos usos, con lo que exige la ley, lo que te recomendamos y casos reales. Y cada mes, al d\u00eda. No sustituye a tu asesor legal: te da el mapa. Y si quieres que la IA trabaje en tu empresa, la implantamos con la ley por delante. Empezamos por un diagn\u00f3stico. Robust Data Solutions. [Personas y escenas generadas con IA. Voz de Albert Lens generada con IA, con su consentimiento.]<\/p><\/details><\/div>\r\n    <div class=\"busca-w\" data-no-translation data-no-dynamic-translation>\r\n      <form class=\"busca\" id=\"buscar\" role=\"search\" onsubmit=\"return false\">\r\n        <label class=\"sr\" for=\"q\">Search for a use of AI in your company<\/label>\r\n        <svg class=\"busca-ic\" viewBox=\"0 0 24 24\" aria-hidden=\"true\"><circle cx=\"11\" cy=\"11\" r=\"7\"\/><path d=\"m20 20-3.6-3.6\"\/><\/svg>\r\n        <input id=\"q\" type=\"search\" autocomplete=\"off\" enterkeyhint=\"search\" placeholder=\"What does AI require of me?\">\r\n        <button type=\"button\" class=\"busca-x\" id=\"q-borrar\" aria-label=\"Clear the search\" hidden>\u00d7<\/button>\r\n      <\/form>\r\n      <div class=\"sugerencias\" id=\"sugerencias\" aria-label=\"Example searches\"><\/div>\r\n      <ul class=\"cifras\" id=\"cifras\"><\/ul>\r\n    <\/div>\r\n    <\/div>\r\n  <\/div>\r\n  <svg class=\"ola\" viewBox=\"0 0 1440 90\" preserveAspectRatio=\"none\" aria-hidden=\"true\"><path d=\"M0 60 C 240 10 480 10 720 45 S 1200 95 1440 35 V90 H0Z\" fill=\"#f4f7fe\"\/><path d=\"M0 75 C 300 35 560 40 800 62 S 1240 92 1440 58 V90 H0Z\" fill=\"#f4f7fe\" opacity=\".55\" transform=\"translate(0,-14)\"\/><\/svg>\r\n<\/section>\r\n\r\n<nav class=\"secciones\" aria-label=\"Report sections\" data-no-translation data-no-dynamic-translation>\r\n  <div class=\"envoltorio secciones-in\">\r\n    <a href=\"#usos\" class=\"sec tap\" data-sec=\"usos\">AI uses<\/a>\r\n    <a href=\"#casos\" class=\"sec tap\" data-sec=\"casos\">Real cases<\/a>\r\n    <a href=\"#fechas\" class=\"sec tap\" data-sec=\"fechas\">Key dates<\/a>\r\n  <\/div>\r\n<\/nav>\r\n\r\n<div class=\"ley-ia-cuerpo\">\r\n  <section id=\"usos\" class=\"bloque\" aria-labelledby=\"usos-t\">\r\n    <div class=\"envoltorio\">\r\n      <p class=\"antetitulo naranja\" data-no-translation data-no-dynamic-translation>AI uses<\/p>\r\n      <h2 id=\"usos-t\">Normativa de IA para empresas, por departamento y sector<\/h2>\r\n      <div data-no-translation data-no-dynamic-translation>\r\n      <div class=\"filtros\">\r\n        <div class=\"filtro\">\r\n          <span class=\"filtro-t\" id=\"ft-sector\">Your sector<\/span>\r\n          <div class=\"segmento\" id=\"f-sector\" role=\"group\" aria-labelledby=\"ft-sector\"><\/div>\r\n        <\/div>\r\n        <div class=\"filtro\">\r\n          <span class=\"filtro-t\" id=\"ft-dep\">Department<\/span>\r\n          <div class=\"fila-chips\" id=\"f-dep\" role=\"group\" aria-labelledby=\"ft-dep\"><\/div>\r\n        <\/div>\r\n        <label class=\"interruptor\" id=\"f-generales-w\" hidden>\r\n          <input type=\"checkbox\" id=\"f-generales\" checked>\r\n          <span class=\"interruptor-t\">Also include what applies to any company<\/span>\r\n        <\/label>\r\n        <div class=\"filtro\">\r\n          <span class=\"filtro-t\" id=\"ft-nivel\">Level<\/span>\r\n          <div class=\"fila-chips\" id=\"f-nivel\" role=\"group\" aria-labelledby=\"ft-nivel\"><\/div>\r\n        <\/div>\r\n      <\/div>\r\n      <div id=\"dep-resumen\"><\/div>\r\n      <div class=\"resultados-cab\">\r\n        <p class=\"resultados-n\" id=\"n-usos\" aria-live=\"polite\">Loading the search\u2026<\/p>\r\n        <button type=\"button\" class=\"enlace-btn tap\" id=\"limpiar\" hidden>Clear filters<\/button>\r\n      <\/div>\r\n      <div id=\"otros-sectores\"><\/div>\r\n      <details class=\"leyenda\">\r\n        <summary class=\"tap\">What does each level and notice mean?<\/summary>\r\n        <div class=\"leyenda-in\" id=\"leyenda\"><\/div>\r\n      <\/details>\r\n      <div class=\"lista-usos\" id=\"lista-usos\"><\/div>\r\n      <div class=\"mas-w\"><button type=\"button\" class=\"btn-sec tap\" id=\"mas-usos\" hidden><\/button><\/div>\r\n      <\/div>\r\n    <\/div>\r\n  <\/section>\r\n\r\n  <section id=\"casos\" class=\"bloque bloque-blanco\" aria-labelledby=\"casos-t\">\r\n    <div class=\"envoltorio\">\r\n      <p class=\"antetitulo naranja\" data-no-translation data-no-dynamic-translation>Spain and Europe<\/p>\r\n      <h2 id=\"casos-t\">Casos reales sancionados<\/h2>\r\n      <div data-no-translation data-no-dynamic-translation>\r\n      <div class=\"aviso-casos\" role=\"note\">\r\n        <svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M12 3 2 21h20L12 3Z\"\/><path d=\"M12 10v5M12 18v.01\"\/><\/svg>\r\n        <p id=\"aviso-casos-t\">There are no fines under the AI Act yet; the existing ones come from data protection, e-commerce (LSSI) or employment law<\/p>\r\n      <\/div>\r\n      <div class=\"filtros filtros-casos\">\r\n        <div class=\"filtro\">\r\n          <span class=\"filtro-t\" id=\"ft-ambito\">Where<\/span>\r\n          <div class=\"segmento\" id=\"c-ambito\" role=\"group\" aria-labelledby=\"ft-ambito\"><\/div>\r\n        <\/div>\r\n        <div class=\"selects\">\r\n          <label class=\"sel\"><span class=\"filtro-t\">Sector<\/span><select id=\"c-sector\"><\/select><\/label>\r\n          <label class=\"sel\"><span class=\"filtro-t\">Department<\/span><select id=\"c-dep\"><\/select><\/label>\r\n        <\/div>\r\n      <\/div>\r\n      <div class=\"resultados-cab\"><p class=\"resultados-n\" id=\"n-casos\" aria-live=\"polite\"><\/p><\/div>\r\n      <div class=\"lista-casos\" id=\"lista-casos\"><\/div>\r\n      <div class=\"mas-w\"><button type=\"button\" class=\"btn-sec tap\" id=\"mas-casos\" hidden><\/button><\/div>\r\n      <\/div>\r\n    <\/div>\r\n  <\/section>\r\n\r\n  <section id=\"fechas\" class=\"bloque\" aria-labelledby=\"fechas-t\">\r\n    <div class=\"envoltorio\">\r\n      <p class=\"antetitulo naranja\" data-no-translation data-no-dynamic-translation>Calendar<\/p>\r\n      <h2 id=\"fechas-t\">Fechas clave<\/h2>\r\n      <div data-no-translation data-no-dynamic-translation>\r\n      <ol class=\"linea\" id=\"linea\"><\/ol>\r\n      <div class=\"mas-w\"><button type=\"button\" class=\"btn-sec tap\" id=\"mas-fechas\" hidden><\/button><\/div>\r\n      <\/div>\r\n    <\/div>\r\n  <\/section>\r\n\r\n<section id=\"indice\" class=\"bloque\" aria-labelledby=\"indice-t\"><div class=\"envoltorio\"><p class=\"antetitulo naranja\" data-no-translation data-no-dynamic-translation>Report index<\/p><h2 id=\"indice-t\">Todos los usos de la IA analizados, departamento a departamento<\/h2><div data-no-translation data-no-dynamic-translation><p class=\"indice-intro\">327 verified uses across 18 departments and 65 real cases. Tap a use to open its entry with what the law requires and what Robust recommends.<\/p><div class=\"indice\"><details><summary>Marketing and communications<span class=\"n\">15<\/span><\/summary><div class=\"indice-cuerpo\"><p>Almost everything marketing generates with AI is minimal risk and needs no notice, but anything that looks real and is not (altered photos, or realistic people, places, videos or voices) must be clearly disclosed from August 2, 2026. Rules on misleading advertising, consumer protection, the Spanish Information Society Services Act (LSSI) and image rights also continue to apply.<\/p><ul><li><a href=\"#dep=01&amp;uso=01-01\">Menu written or designed with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-02\">Real photos enhanced without changing what is shown (cropping, color, lighting, sharpness)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-03\">Real photos with elements changed or added with AI<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-04\">Photorealistic generated images of the premises, the product or the surroundings<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-05\">Clearly artistic illustrations created with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-06\">Photorealistic invented people<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-07\">Videos with realistic people or places generated or manipulated with AI<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-08\">Cloned voice of a real person<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-10\">Landing page generated with AI (copy and design)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-11\">Campaign chat on the website<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-12\">Text posts on social media written with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-13\">Newsletters and commercial emails written with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-14\">Translations made with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-15\">Replies to reviews written with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=01&amp;uso=01-16\">Algorithmically personalized prices<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Customer service<span class=\"n\">18<\/span><\/summary><div class=\"indice-cuerpo\"><p>AI chat, WhatsApp assistants and AI phone systems must say they are AI from the first contact, and customers must be able to speak to a person. Analyzing the text of messages is minimal risk; inferring emotions from voice or face is high-risk where customers are concerned and prohibited where the company&#x27;s own agents are concerned.<\/p><ul><li><a href=\"#dep=02&amp;uso=02-01\">Chat on the website or app that answers customer questions<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-02\">AI assistant on WhatsApp or messaging apps<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-03\">Voice agent that answers calls (AI phone system)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-04\">Email replies drafted by AI and reviewed by a person<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-05\">Automatic replies sent without human review<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-06\">Classifying and routing inquiries or complaints with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-07\">Text sentiment analysis (emails, chats, reviews)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-08\">Analysis of customer emotions from voice or face<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-09\">Analysis of agents&#x27; emotions from their voice or face (quality control)<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-10\">Evaluating or scoring agents&#x27; performance with AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-11\">Summaries and transcription of calls or meetings with customers<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-12\">Machine translation of conversations with customers<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-13\">Knowledge base or FAQs generated with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-14\">Replies to public reviews with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-15\">Cloned voice of a real person in the phone system<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-16\">Automated decisions about the customer (refusing a refund, blocking an account, scoring creditworthiness)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-17\">Guest service chat or assistant (booking engine or third-party)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=02&amp;uso=02-18\">Chat or assistant that receives queries and documents from clients of the gestor\u00eda (tax, accounting and labor advisory firm)<\/a> <small>Transparency<\/small><\/li><\/ul><\/div><\/details><details><summary>Human resources<span class=\"n\">17<\/span><\/summary><div class=\"indice-cuerpo\"><p>This is the department on which the AI Act imposes the most obligations: using AI to select staff, allocate tasks based on behavior, evaluate workers or take decisions about them is high-risk from December 2, 2027, and inferring the emotions of employees or candidates has been prohibited since February 2, 2025. The GDPR, the Spanish Data Protection Act (LOPDGDD) and the works council&#x27;s right to be informed about algorithms already apply today.<\/p><ul><li><a href=\"#dep=03&amp;uso=03-01\">Writing job offers and job descriptions with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-02\">Targeting who is shown a job advertisement<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-03\">Screening or scoring CVs with AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-04\">Summarizing a CV at the recruiter&#x27;s request, without scoring or ranking<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-05\">Video interviews analyzed by AI (expressions, tone, \u201cattitude\u201d)<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-06\">Chat for candidates or employees (holidays, payslips, policies)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-07\">Allocating shifts or tasks based on behavior or personal traits<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-08\">Shift rotas based only on availability and objective rules (collective agreement, rest periods)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-09\">Evaluating workers&#x27; performance or behavior with AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-10\">Deciding promotions, dismissals or working conditions with the help of AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-11\">Emotion recognition of employees (cameras, voice, typing patterns)<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-12\">Time and attendance control with biometrics (fingerprint, face)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-13\">Monitoring of computer activity or geolocation analyzed with AI<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-15\">Staff training in the use of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-16\">Employees using free AI with data about colleagues or candidates<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-17\">Seasonal recruitment and rotas with AI in hotels, restaurants and retail<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=03&amp;uso=03-18\">Gestor\u00edas (tax, accounting and labor advisory firms) that handle their clients&#x27; payroll and HR with AI<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Management and finance<span class=\"n\">18<\/span><\/summary><div class=\"indice-cuerpo\"><p>The AI Act imposes few obligations here, except when AI is used to evaluate the creditworthiness of natural persons (consumers and self-employed individuals) or to price life and health insurance: high-risk from December 2, 2027, with a fundamental rights impact assessment (FRIA) before first use. What already applies is the GDPR, directors&#x27; duties of secrecy and diligence, trade secrets and, depending on the company, anti-money laundering rules, DORA or market abuse rules.<\/p><ul><li><a href=\"#dep=04&amp;uso=04-01\">Dashboards and reports with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-02\">Cash-flow forecasts, budgets and planning with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-03\">Support for strategic decisions (investments, pricing, company acquisitions) with an AI chat<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-04\">Using general-purpose AI assistants with confidential financial information<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-05\">Summaries and minutes of board and general meetings from the recording<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-06\">Management report, press releases or investor information written with AI and published<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-07\">Using AI to evaluate the creditworthiness of customers who are natural persons (consumers, self-employed individuals) in order to grant credit, financing or deferred payment<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-08\">Creditworthiness of customers that are companies (commercial risk, credit limits)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-11\">Financial fraud detection (anomalous payments, forged documents in applications)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-12\">Supplier evaluation with AI (risk, creditworthiness, ESG criteria)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-13\">Anti-money laundering with AI: customer identification, list screening and alerts (obliged entities only)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-14\">Insurance: pricing or underwriting life and health risks of individuals (insurers and intermediaries)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-15\">Financial entities using AI from external providers<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-16\">Listed company using AI with inside information<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-17\">Training management in the use of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-18\">Board decisions supported by AI (directors&#x27; liability)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-19\">Fraud detection in bookings and payments (hotels)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=04&amp;uso=04-20\">Anti-money laundering and clients&#x27; financial data in gestor\u00edas (tax, accounting and labor advisory firms)<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>Administration and accounting<span class=\"n\">18<\/span><\/summary><div class=\"indice-cuerpo\"><p>Reading invoices, bookkeeping, reconciling or preparing payments with AI is minimal risk. What governs here is commercial and tax law: the company is responsible for its accounts even if an AI keeps them, invoicing software must be adapted to VERI*FACTU, and B2B e-invoicing arrives on October 6, 2027, and October 6, 2028.<\/p><ul><li><a href=\"#dep=05&amp;uso=05-01\">Reading incoming invoices with AI and posting them automatically<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-02\">Digitizing paper invoices and destroying the original<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-03\">Automatic bank reconciliation with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-04\">Proposing and approving payments (direct debit batches, due dates) with AI or an agent<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-05\">Detecting errors, duplicates or fraud in supplier invoices and payments<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-06\">Issuing invoices with AI or an agent (from the chat, from orders)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-07\">B2B e-invoicing: issuing, receiving and reading structured invoices<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-08\">Keeping documents and records, including what the AI tool stores<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-09\">Personal data of self-employed suppliers and of employees in invoices, expenses and payments<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-11\">Drafting submissions to the Spanish Tax Agency (AEAT) or the Social Security with AI (information requests, pleadings, appeals)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-12\">Filing with a digital certificate or letting an AI agent fill in forms on the electronic office (sede electr\u00f3nica)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-13\">Using general-purpose AI assistants with accounting or tax data<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-14\">Internal assistant that answers administrative queries from employees or suppliers (status of an invoice or payment)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-15\">Year-end close and annual accounts prepared with AI (companies)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-16\">Personal data breach in the tool (leak of bank data, payroll, invoices)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-17\">Training administration staff in the use of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-18\">Simplified invoices at the front desk and in food &amp; beverage (hotels)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=05&amp;uso=05-19\">Gestor\u00edas (tax, accounting and labor advisory firms) that keep their clients&#x27; accounts and file their taxes with AI<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>IT and systems<span class=\"n\">19<\/span><\/summary><div class=\"indice-cuerpo\"><p>IT makes it possible for the rest of the company to comply: it chooses the tools, reviews the contracts, decides where data are processed and keeps the logs. The AI Act asks little of it directly; what is enforceable today comes mainly from the GDPR (processing agreement, security, breaches and transfers) and from cybersecurity and data legislation.<\/p><ul><li><a href=\"#dep=06&amp;uso=06-01\">Shadow AI: employees using personal AI accounts with company data<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-02\">Subscribing to business accounts for generative AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-03\">Microsoft 365 Copilot: permissions, data residency and web search<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-04\">Google Workspace with Gemini: data regions and sources it consults<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-05\">International transfers of data to US AI providers<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-06\">AI agents with access to systems (email, CRM, ERP, folders) that send emails or modify records<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-07\">Code generation with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-08\">Own internal assistant built on a model&#x27;s API, under the company&#x27;s name<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-09\">Security of AI tools (prompt injection, leaks through permissions, DLP)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-10\">AI-related personal data breach<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-11\">Inventory of AI systems and use policy<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-12\">Staff training in the use of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-13\">Detecting staff use of AI (usage reports, tools that log prompts)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-14\">Switching cloud provider or cloud AI provider<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-15\">Manufacturers: products with software that the company manufactures or places on the market (connected devices, applications, firmware)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-16\">Cybersecurity of essential and important entities (NIS2)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-17\">Public sector suppliers: systems that provide services or solutions to public administrations<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-18\">Hotels: property management system, booking engine and payment gateways with AI features<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=06&amp;uso=06-19\">Gestor\u00edas (tax, accounting and labor advisory firms): using an AI tool with their clients&#x27; data<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Sales and business development<span class=\"n\">19<\/span><\/summary><div class=\"indice-cuerpo\"><p>In sales, the AI Act only really bites when AI evaluates the company&#x27;s own salespeople or the creditworthiness of customers who are natural persons, and it prohibits analyzing salespeople&#x27;s emotions from their voice or face. Everything else (lead scoring, contact enrichment, writing emails, calling) is governed today by the GDPR, the Spanish Data Protection Act (LOPDGDD), the Spanish Information Society Services Act (LSSI), the Spanish General Telecommunications Act and, with consumers, by consumer protection and unfair competition law.<\/p><ul><li><a href=\"#dep=07&amp;uso=07-01\">Scoring leads or prioritizing opportunities in the CRM<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-02\">Enriching contacts with commercial databases<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-03\">Extracting data from websites or LinkedIn (scraping) with AI or browsing agents<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-04\">Prospecting emails written or sent in sequence by AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-05\">Sales calls made by people using a script or list prepared by AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-06\">Outbound AI voice agents that call customers or leads<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-07\">Sales chatbot on the website, WhatsApp or social media<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-08\">Proposals, quotes and offers written with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-09\">Algorithmically personalized prices based on the customer&#x27;s profile<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-10\">Recording, transcribing and analyzing sales calls or video calls<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-11\">Detecting salespeople&#x27;s emotions from their voice or face<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-12\">Detecting the customer&#x27;s emotions from their voice or face during the call<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-13\">Evaluating or scoring salespeople with AI (call grading, rankings, \u201ccoaching\u201d that reaches management)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-14\">Allocating leads, accounts or territories among salespeople based on their behavior or performance<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-15\">Evaluating the creditworthiness of customers who are natural persons (consumers, self-employed individuals) in order to grant credit, deferred payment or terms<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-16\">Sales forecasting and pipeline analysis with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-17\">Salespeople using free AI with customer data (pasting the CRM or an email into a personal chat)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-18\">Hotels: direct sales to guests, dynamic rates and campaigns to former guests<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=07&amp;uso=07-19\">Gestor\u00edas (tax, accounting and labor advisory firms): using their clients&#x27; data to sell other services<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Procurement, operations and logistics<span class=\"n\">22<\/span><\/summary><div class=\"indice-cuerpo\"><p>Most of the AI in this department works with data about things (stock, orders, routes, machines), and there the AI Act imposes hardly any obligations. Obligations arise when AI measures, allocates tasks to or monitors people, when cameras capture people, and when AI is built into the machinery or products the company manufactures or places on the market.<\/p><ul><li><a href=\"#dep=08&amp;uso=08-01\">Evaluating and selecting suppliers (price, lead times, quality, risk)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-02\">Demand and inventory forecasting, automatic replenishment<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-03\">Drafting purchase orders, comparing offers or negotiating with an AI assistant or agent<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-04\">Optimizing delivery or collection routes (traffic, time windows, load)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-05\">Allocating tasks, routes or orders to operatives or delivery drivers based on their performance, behavior or traits<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-06\">Measuring the productivity of operatives or delivery drivers (units per hour, picking times, stops)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-07\">Geolocating vehicles or delivery drivers (telematics)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-08\">AI cameras in the cab that detect driver distraction, mobile phone use or drowsiness<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-09\">Computer vision for product quality control (defects, labeling, packaging)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-10\">AI cameras that monitor people in the warehouse or plant (PPE, danger zones, falls)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-11\">Facial recognition to access the warehouse or plant, or to clock in<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-12\">Predictive maintenance (vibrations, temperatures, consumption of machines, installations or fleet)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-13\">AI built into machinery the company manufactures (robots, autonomous forklifts, vision cells)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-14\">AI built into other regulated products the company manufactures (lifts, pressure equipment, PPE, radio equipment, toys, medical devices)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-15\">Placing on the market under your own brand a product or tool with AI made by someone else, or substantially modifying it<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-16\">Liability if the product with AI causes damage<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-17\">Procuring AI tools: clauses with the provider<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-18\">Data generated by connected machines, vehicles or equipment that the company buys<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-19\">Chat or assistant for suppliers, carriers or customers (order status, dock appointments)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-20\">Training warehouse, fleet and procurement staff<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-21\">Hotels: allocating rooms to housekeeping room attendants based on their performance or their times<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=08&amp;uso=08-22\">Gestor\u00edas (tax, accounting and labor advisory firms): managing procurement or logistics for their clients<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Legal and compliance<span class=\"n\">20<\/span><\/summary><div class=\"indice-cuerpo\"><p>Legal uses AI in its own work (contracts, research, whistleblowing channel) and, above all, governs the use of AI across the whole company: which tools exist, what risk they carry, what role the company plays in each one and what must be done before using them. Spain does not yet have its own penalty regime for the AI Act, but GDPR and Spanish Data Protection Act (LOPDGDD) penalties already apply.<\/p><ul><li><a href=\"#dep=09&amp;uso=09-01\">Inventory of the company&#x27;s AI systems<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-02\">Classifying each system by risk level and by the company&#x27;s role (provider or deployer)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-03\">AI use policy for staff<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-04\">AI training (AI literacy)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-05\">Data protection impact assessment (DPIA) of AI uses<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-06\">Fundamental rights impact assessment (FRIA)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-07\">Reviewing or drafting contracts with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-08\">Legal research with AI (case law, legislation, legal scholarship)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-09\">Whistleblowing channel with AI (transcribing, translating, classifying or summarizing reports)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-10\">Record of processing activities including AI uses<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-11\">International transfers to AI providers outside the EEA<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-12\">AI transparency across the company (chats, generated content, deepfakes)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-13\">Relationship with the data protection officer (DPO)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-14\">Regulatory monitoring (guidelines, codes, Spanish rules)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-15\">AI audits (internal or external)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-16\">Governance and privacy platforms with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-17\">Employees using free AI with contracts, customer data or confidential information<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-18\">Own assistant developed by the company on a model&#x27;s API and made available under its brand<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-19\">Hotels: third-party tools with built-in AI (booking engine, property management system, chats) and whistleblowing channel<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=09&amp;uso=09-20\">Gestor\u00edas (tax, accounting and labor advisory firms): using AI with client data and advising their clients on AI compliance<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Hotels and accommodation \u00b7 Front desk and reservations<span class=\"n\">21<\/span><\/summary><div class=\"indice-cuerpo\"><p>What is penalized most at the front desk is not AI but copying guests&#x27; identity documents. Here the AI Act mainly requires transparency in chats and voice agents and caution with biometrics; guest registration (the traveler register required by Spanish law), the GDPR and consumer law weigh more.<\/p><ul><li><a href=\"#dep=H1&amp;uso=H1-01\">In-person check-in reading the identity document on a local device (NFC chip or MRZ zone) that extracts only the required fields and discards the image<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-02\">Scanning, photocopying or photographing the identity document and keeping the image (including so that an AI can \u201cread\u201d it later)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-03\">Online check-in with upload of a photo of the identity document<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-04\">Facial verification: selfie compared with the photo on the document<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-05\">Facial recognition on arrival (camera that identifies VIP or regular guests)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-06\">Automatic submission of guest registration forms from the PMS to the police platform<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-07\">Using the guest register for marketing, to enrich profiles or to train an AI<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-08\">Front desk chat on the website, app, WhatsApp or social media<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-09\">Voice agent answering the switchboard<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-10\">AI booking engine (assistant that quotes and books, room recommendations)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-11\">Dynamic pricing based on demand and occupancy<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-12\">Personalized pricing based on the guest&#x27;s profile (history, device, loyalty)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-13\">Upselling and personalized offers before or during the stay (room upgrade, late check-out, spa)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-14\">Guest profiles with preferences and requests (pillow, allergies, reduced mobility, cot)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-15\">Automated decisions about the guest: refusing a booking, requiring a deposit or \u201cblacklisting\u201d based on a risk or no-show score<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-16\">Machine translation at the desk (app or device) with guests<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-17\">Classifying and answering complaints with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-18\">AI-written replies to reviews<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-19\">Pre-arrival messages (confirmation, instructions, link to online check-in, access code)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-20\">Promotions and newsletters to former guests, written or segmented with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H1&amp;uso=H1-21\">AI assistant as a permanent customer service or incident channel in Catalonia (hotels and tourist rental homes)<\/a> <small>Transparency<\/small><\/li><\/ul><\/div><\/details><details><summary>Hotels and accommodation \u00b7 Housekeeping and maintenance<span class=\"n\">15<\/span><\/summary><div class=\"indice-cuerpo\"><p>This is the hotel department where AI affects staff the most: room allocation, cleaning times, fault reports and cameras. Labor and data protection law, which already apply today, weigh heavily and, from December 2, 2027, so does the high-risk regime when AI allocates tasks by performance or measures productivity.<\/p><ul><li><a href=\"#dep=H2&amp;uso=H2-01\">Voice dictation of incidents, reports and room status<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-02\">Allocating rooms to housekeeping room attendants using objective rules (departures, arrivals, floors, room type, availability, quota under the collective agreement)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-03\">Allocating rooms according to each housekeeping room attendant&#x27;s performance or history (speed, incidents, guest ratings)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-04\">Measuring staff productivity: minutes per room, rankings, alerts to the supervisor<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-05\">Cleaning times forecast by AI to plan the day, without evaluating anyone<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-06\">Locating staff within the hotel (beacons, Wi-Fi, task app)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-07\">Detecting staff emotions or stress via camera, voice or wristband<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-08\">Sensors and predictive maintenance (boilers, air conditioning, leaks, water and energy consumption)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-09\">Sensors in rooms or apartments (presence, noise, smoke, door opening)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-10\">Cameras with analytics in common areas: abandoned objects, capacity, falls or intrusion<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-11\">Facial recognition with cameras to identify people<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-12\">Lost property: log with photos and search for the owner by cross-checking bookings<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-13\">Guest data in fault reports and tasks (\u201callergic guest,\u201d \u201creduced mobility,\u201d guest&#x27;s name)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-14\">Internal assistant that answers with the hotel&#x27;s procedures (cleaning, chemicals, occupational risk prevention)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H2&amp;uso=H2-15\">Inventory forecasting for linen, products and spare parts<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>Hotels and accommodation \u00b7 Food &amp; beverage<span class=\"n\">16<\/span><\/summary><div class=\"indice-cuerpo\"><p>The greatest risk in food &amp; beverage is not the AI Act but food information: if the AI gets an allergen wrong, the establishment is liable. In addition, assistants must say they are an AI and generated photos of dishes must not mislead.<\/p><ul><li><a href=\"#dep=H3&amp;uso=H3-01\">Menu written, translated or designed with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-02\">Assistant (chat, QR code at the table, WhatsApp) that answers questions about dishes and allergens<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-03\">AI-generated photos of dishes that look real (digital menu, website, social media, delivery platforms)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-04\">Real photos of dishes retouched without changing what is shown (light, color, framing)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-05\">Table bookings via AI chat or WhatsApp<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-06\">Voice agent that answers the phone and takes bookings<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-07\">No-show prediction and deposit or guarantee card depending on the customer&#x27;s score<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-08\">Allergies or intolerances stored in the customer&#x27;s record for future visits<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-09\">AI-written replies to reviews<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-10\">Dynamic pricing in the restaurant (by time of day, demand or hotel occupancy)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-11\">Purchasing and production forecasting (covers, waste, orders to suppliers)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-12\">AI shift planning for kitchen and dining room<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-13\">AI cameras in the kitchen or dining room (hygiene, plating times, queues)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-14\">Marketing to restaurant customers using booking data (emails, WhatsApp, SMS)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-15\">Recommender of dishes, wines or extras on the digital menu<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=H3&amp;uso=H3-16\">Menus, signs and assistants translated or operated with AI in Catalonia<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Tax<span class=\"n\">23<\/span><\/summary><div class=\"indice-cuerpo\"><p>Preparing and filing taxes with AI is minimal risk under the AI Act. What really creates obligations is that the firm is liable for what it files, needs the client&#x27;s authorization to act as representative and its own digital certificate, personal income tax returns contain special categories of data, and tax advisers are obliged entities for anti-money laundering purposes. Its key points apply to the whole gestor\u00eda (tax, accounting and labor advisory firm).<\/p><ul><li><a href=\"#dep=G1&amp;uso=G1-01\">Preparing tax returns with AI (personal income tax, VAT, corporate income tax): reconciling data, proposing boxes and deductions<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-02\">Reading client documents with AI (withholding certificates, tax data from the Spanish Tax Agency (AEAT), notarial deeds, invoices, receipts)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-03\">Researching the law with AI (legal or general-purpose assistants)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-04\">Electronic filing of tax returns on behalf of clients<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-05\">Keeping clients&#x27; digital certificates at the firm or giving them to an AI tool<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-06\">AI agents that file returns, answer requests from the authorities or carry out procedures on the electronic office (sede electr\u00f3nica) without human intervention<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-07\">AI that monitors the Spanish Tax Agency (AEAT) notifications inbox, summarizes requests and flags deadlines<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-08\">VERI*FACTU: advising clients on their invoicing systems (including those that generate invoices with AI)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-09\">Mandatory B2B e-invoicing: getting clients ready<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-10\">Chat or assistant for clients (income tax queries, missing documents, file status)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-11\">Collecting documents by email, WhatsApp or portal with automatic classification by client and financial year<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-12\">Tax planning or simulations with AI for a client<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-13\">Report on an individual&#x27;s income or financial capacity for a bank or landlord, with an AI score<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-14\">Anti-money laundering customer due diligence with AI (identification, beneficial owner, sanctions lists)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-15\">Firm employees using free AI tools with clients&#x27; tax returns<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-16\">Retention of tax returns, supporting documents and conversations with the AI<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-17\">Using AI with client data without having established whether the firm is processor or controller for each service<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-18\">Cloud AI provider processing the firm&#x27;s client data<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-19\">Sending client data to AI providers outside the European Economic Area<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-20\">Confidentiality and professional secrecy when the firm uses AI<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-21\">The firm as an obliged entity for anti-money laundering purposes<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-22\">AI literacy of the firm&#x27;s staff<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G1&amp;uso=G1-23\">Processing health or trade union data from personal income tax returns with AI on a large scale (large firm or office network)<\/a> <small>Minimal<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Accounting<span class=\"n\">16<\/span><\/summary><div class=\"indice-cuerpo\"><p>Almost everything AI does in accounting is minimal risk. What creates obligations is the usual: the accounts remain the business owner&#x27;s responsibility even if the firm keeps them, the annual accounts are prepared and signed by the directors and, as an external accountant, the firm is an obliged entity for anti-money laundering purposes.<\/p><ul><li><a href=\"#dep=G2&amp;uso=G2-01\">Automatic reading of invoices (AI-based OCR) and proposed journal entry<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-02\">Automatic bank reconciliation<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-03\">Accounting classification and assignment of Spanish General Accounting Plan (PGC) accounts by the AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-04\">Year-end closing and draft annual accounts prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-05\">Legalization of accounting books and filing of annual accounts with the help of AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-06\">Management report or notes to the accounts drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-07\">Management information for clients (dashboards, forecasts, cash flow commentary) generated with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-08\">Detecting errors, anomalies or possible fraud in the client&#x27;s accounts<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-09\">Assistant answering accounting questions from the firm&#x27;s staff (PGC, ICAC resolutions, queries)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-10\">Chat or portal for clients that answers questions about their accounts (balances, outstanding invoices, deadlines)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-11\">Evaluating the creditworthiness of individual clients (natural persons) for financing, rentals or payment deferrals<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-12\">Data on suppliers who are self-employed individuals and on individual customers appearing in the accounts<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-13\">AI-assisted anti-money laundering due diligence on the firm&#x27;s clients<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-14\">Firm that, in addition to bookkeeping, audits accounts<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-15\">Firm employees using free AI tools with clients&#x27; accounts<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G2&amp;uso=G2-16\">Retention of digitized accounting records and AI logs<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Commercial and corporate<span class=\"n\">16<\/span><\/summary><div class=\"indice-cuerpo\"><p>Drafting corporate documents with AI is minimal risk. What creates obligations: minutes state what was resolved and are signed by whoever holds the authority to do so; anyone who forms companies is an obliged entity for anti-money laundering purposes and may not rely solely on the beneficial ownership register; due diligence involves trade secrets; and electronic signatures have their own rules.<\/p><ul><li><a href=\"#dep=G3&amp;uso=G3-01\">Company formation with AI: draft articles of association, single electronic document (DUE), company name reservation, documentation for the notary<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-02\">Minutes of general meetings or board meetings drafted with AI (from notes, the notice of meeting or a recording)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-03\">Certificates of resolutions and notarization (elevaci\u00f3n a p\u00fablico) prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-04\">Corporate books (minute book, register of shareholders) kept or prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-05\">Commercial Registry: electronic filing, reading the registrar&#x27;s assessments and correcting defects with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-06\">AI-assisted identification of the beneficial owner and due diligence (Beneficial Ownership Register, sanctions lists, politically exposed persons)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-07\">Non-face-to-face identification of clients by video or with automatic biometric verification<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-08\">Indications of money laundering detected by the AI in a corporate transaction (opaque structures, ownership changes without business rationale, serial registered addresses)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-09\">Powers of attorney and deeds: drafts and instructions for the notary containing data on shareholders, directors and attorneys<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-10\">Due diligence with AI (bulk review of contracts, litigation, employment, industrial property) in an acquisition or the entry of new shareholders<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-11\">Family protocol (family business charter) drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-12\">Electronic signature of minutes, contracts or certificates and their automated management with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-13\">Assistant answering corporate law questions from staff (queries, DGSJFP resolutions, deadlines)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-14\">Chat for clients (status of a company formation, pending documents, notary appointments)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-15\">AI analysis of public data on companies and directors (Official Gazette of the Commercial Registry (BORME), Commercial Registry) to acquire clients or for profiling<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G3&amp;uso=G3-16\">Firm employees using free AI tools with articles of association, shareholders&#x27; agreements or data rooms<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Labor and payroll<span class=\"n\">21<\/span><\/summary><div class=\"indice-cuerpo\"><p>The firm handles human resources for its clients and processes their employees&#x27; data: payroll, sick leave, dismissals and, sometimes, criminal records. Recruiting or making decisions about workers with AI is high risk from December 2, 2027, and already today the GDPR, the Workers&#x27; Statute (Estatuto de los Trabajadores) and, from October 5, 2026, the requirement to provide written information on algorithms apply.<\/p><ul><li><a href=\"#dep=G4&amp;uso=G4-02\">Interpreting the collective agreement or reviewing payroll issues with an AI assistant<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-03\">Employment contracts and onboarding information drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-04\">Social Security registrations and deregistrations of workers prepared or submitted automatically<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-05\">Calculating final settlements and severance pay for a dismissal already decided by the client<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-06\">AI that proposes whom to dismiss, whom to include in a temporary lay-off scheme (ERTE) or whom to promote<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-07\">Temporary lay-off scheme (ERTE): report, communications and documentation drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-08\">Sick leave and temporary incapacity: handling medical certificates and calculating benefits<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-09\">Recruitment for a client with AI: filtering, scoring or ranking CVs<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-10\">Summarizing CVs at the recruiter&#x27;s request, without scoring or ranking<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-11\">Job advertisements drafted with AI for clients<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-12\">Clients&#x27; working time records kept with software<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-13\">Biometric working time records (fingerprint or face)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-14\">Equality plans and the preliminary diagnosis prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-15\">Pay register and pay audit with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-16\">Submissions and replies to the Labor and Social Security Inspectorate drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-17\">Q&amp;A chat for clients&#x27; employees (payslips, holidays, leave)<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-18\">Sexual offenses certificates for workers in contact with minors<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-19\">Evaluating the performance of a client&#x27;s employees (HR consultancy)<\/a> <small>High risk<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-20\">Emotion recognition of a client&#x27;s staff (voice, camera, typing patterns)<\/a> <small>Prohibited<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-21\">Firm staff using free AI tools with clients&#x27; payroll or contracts<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G4&amp;uso=G4-22\">Record of processing activities of the payroll firm, even if it has fewer than 250 staff<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Administrative procedures<span class=\"n\">15<\/span><\/summary><div class=\"indice-cuerpo\"><p>Here AI does not just draft: it fills in forms, monitors notifications and can file documents on behalf of a client and with credentials. The AI Act imposes hardly any obligations; what does is administrative law, representation, security and the firm&#x27;s professional liability.<\/p><ul><li><a href=\"#dep=G5&amp;uso=G5-01\">Vehicle transfers before the Directorate-General for Traffic (DGT): reading registration documents and contracts and preparing the file with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-02\">AI agent that fills in forms on an electronic office (sede electr\u00f3nica) and leaves submission to a person<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-03\">AI agent that files or signs documents without human review<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-04\">Keeping clients&#x27; digital certificates on the firm&#x27;s computers<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-05\">Client&#x27;s Cl@ve or passwords stored by the firm or used by an AI agent<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-06\">AI monitoring of electronic notifications (e-office inboxes, the single authorized electronic address, DEH\u00fa)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-07\">Calculating administrative deadlines with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-08\">Classifying and summarizing requests and notifications received<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-09\">Immigration: preparing files (residence permits, residence on grounds of settlement (arraigo), renewals) with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-10\">Criminal record certificates collected for a procedure<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-11\">Business activity or building permits: reports and documentation drafted with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-12\">Grants and subsidies: applications prepared with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-13\">Using AI to predict whether an application will succeed, in order to advise the client<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-14\">File tracking chat for clients<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G5&amp;uso=G5-15\">Firm staff using free AI tools with client documents<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Gestor\u00edas and advisory firms (tax, accounting and labor) \u00b7 Reception and document intake<span class=\"n\">18<\/span><\/summary><div class=\"indice-cuerpo\"><p>This is the entry point for all the firm&#x27;s data: ID cards (DNI), payslips, deeds, sick notes and certificates arrive by email, WhatsApp or portal, and here AI classifies, reads and files them. Almost everything is minimal risk; what creates obligations is the GDPR: data minimization, channel security, retention periods and the firm&#x27;s role as processor.<\/p><ul><li><a href=\"#dep=G6&amp;uso=G6-01\">Automatic classification of incoming documents (by client, type and procedure)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-02\">Shared email inbox with AI that reads, summarizes and routes messages<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-03\">Receiving documents via WhatsApp<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-04\">Client portal with document upload and automatic reading<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-05\">OCR of ID cards (DNI) and identity documents<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-06\">Extracting data from invoices, payslips or deeds with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-07\">Sick notes, medical reports or criminal record certificates arriving at reception<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-08\">Automated retention and deletion by retention period<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-09\">Smart search of the archive (asking the AI about client documents)<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-10\">Customer service chat on the website or portal<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-11\">Voice assistant on the firm&#x27;s switchboard<\/a> <small>Transparency<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-12\">Electronic signature of engagement letters, mandates and documents with clients<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-13\">Replies to clients drafted by AI and reviewed<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-14\">Sending documents to clients by email with AI<\/a> <small>Minimal<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-15\">Record of processing activities including AI processing<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-16\">Staff forwarding client documents to their personal email or to a free AI tool<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-17\">Keeping a copy of the client&#x27;s ID card (DNI) when the firm is an obliged entity for anti-money laundering purposes (tax advice, external accounting, company formation, registered office services)<\/a> <small>Outside the AI Act<\/small><\/li><li><a href=\"#dep=G6&amp;uso=G6-18\">Keeping a copy of the ID card (DNI) for services not covered by Ley 10\/2010 (for example, only Directorate-General for Traffic (DGT) procedures or only payroll)<\/a> <small>Outside the AI Act<\/small><\/li><\/ul><\/div><\/details><details><summary>Real penalty cases<span class=\"n\">65<\/span><\/summary><div class=\"indice-cuerpo\"><ul class=\"indice-casos\"><li><strong>Mercadona, S.A.<\/strong> (2021): Installed facial recognition in its shops to detect persons subject to restraining orders. <em>\u20ac2,520,000 (\u20ac3,150,000 initially; \u221220% for voluntary payment)<\/em> \u00b7 GDPR, Articles 6 and 9, 12 and 13, 5(1)(c), 25(1) and 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00120-2021.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>AENA, S.M.E., S.A.<\/strong> (2024): Used facial recognition for passenger access to airport areas without a valid impact assessment. <em>\u20ac10,043,002<\/em> \u00b7 GDPR, Article 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00431-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Yoti Ltd<\/strong> (2025): Facial age verification provider: by default it used biometric data, including those of minors, for \u201cresearch and development.\u201d <em>\u20ac950,000 (\u20ac500,000 + \u20ac200,000 + \u20ac250,000)<\/em> \u00b7 GDPR, Articles 9, 7 and 5(1)(e) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00164-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Universitat Internacional Valenciana \u2013 Valencian International University, S.L.<\/strong> (25-4-2025): Online exams proctored with facial recognition, artificial intelligence and automated decision-making, with no alternative for students. <em>\u20ac650,000 (\u20ac300,000 + \u20ac350,000)<\/em> \u00b7 GDPR, Articles 9 and 5(1)(c) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00067-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Universidad Europea de Valencia, S.L.<\/strong> (2025): Required the use, in online exams, of software with facial recognition and camera and microphone monitoring. <em>\u20ac160,000 (\u20ac200,000 initially; \u221220% for voluntary payment)<\/em> \u00b7 GDPR, Articles 9 and 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00447-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Fundaci\u00f3 per a la Universitat Oberta de Catalunya (UOC)<\/strong> (2022): Required students to register with a facial recognition tool in order to take remote assessments. <em>\u20ac20,000<\/em> \u00b7 GDPR, Articles 5(1)(a) and 9 \u00b7 <a href=\"https:\/\/seu.apdcat.cat\/ca\/documentPublic\/download\/3592\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Liga Nacional de F\u00fatbol Profesional<\/strong> (2023): Imposed biometric access to the supporters&#x27; stands at stadiums without a valid impact assessment. <em>\u20ac1,000,000<\/em> \u00b7 GDPR, Article 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00484-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>SIDECU, S.A. (gimnasios)<\/strong> (2024): Switched access to its gyms to facial recognition and refused entry to anyone who did not accept it. <em>\u20ac96,000 (\u20ac160,000 initially; \u221240% for early payment and acknowledgment of liability)<\/em> \u00b7 GDPR, Articles 9 and 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00289-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Loro Parque, S.A.<\/strong> (2023): Took the fingerprints of visitors holding a two-park ticket, to check that it was the same person. <em>\u20ac250,000<\/em> \u00b7 GDPR, Article 9 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00432-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>CTC Externalizaci\u00f3n, S.L.<\/strong> (2023 \u00b7 SAN of 30-6-2026): Staff clocking-in by fingerprint without adequate information, without sufficient security measures and without an impact assessment. <em>\u20ac50,000 after the National High Court ruling (\u20ac365,000 initially: \u20ac200,000 + \u20ac65,000 + \u20ac100,000)<\/em> \u00b7 AEPD: GDPR, Articles 13, 32 and 35. National High Court: the Article 13 infringement becomes a minor infringement (LOPDGDD, Article 74.a, \u20ac10,000), the Article 32 fine stays at \u20ac40,000 and the Article 35 fine is annulled \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00170-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>MAXAMCORP International, S.L.<\/strong> (1-3-2026): Replaced cards with fingerprints for clocking in, without a valid legal basis or an impact assessment. <em>\u20ac400,000 (\u20ac300,000 + \u20ac100,000)<\/em> \u00b7 GDPR, Articles 9 and 35 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00552-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Cartonajes Ba\u00f1eres, S.A.<\/strong> (2023): Clocking-in by facial recognition without an impact assessment; it also failed to reply to a former employee who requested their data. <em>\u20ac220,000 (\u20ac200,000 + \u20ac20,000)<\/em> \u00b7 GDPR, Articles 35 and 15 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00361-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Ares Capital, S.A. (ride-hailing)<\/strong> (2024): Required drivers to use work apps on their personal mobile phones, with geolocation, and collected more data than necessary. <em>\u20ac200,000<\/em> \u00b7 GDPR, Articles 13, 5(1)(c) and 6(1) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00454-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>GlovoApp23, S.A.<\/strong> (2022 \u00b7 decision of 7-3-2023): Misconfigured permissions: customer service staff in other countries could see couriers&#x27; data (location, ratings). <em>\u20ac550,000 + warning (apercibimiento)<\/em> \u00b7 GDPR, Articles 25 and 32 (fine) and 13 (warning) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00209-2022.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Posada del Le\u00f3n de Oro, C.B. (hotel, Madrid)<\/strong> (2025): Camera recording image and audio at the front desk, which any employee could watch live. <em>\u20ac240 (\u20ac400 initially; \u221240%)<\/em> \u00b7 GDPR, Articles 5(1)(c) and 13 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00598-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Universitat Aut\u00f2noma de Barcelona<\/strong> (7-10-2025): An AI meeting assistant (Read.ai) recorded and transcribed a Teams meeting without the participants knowing, and sent the summary by email. <em>No fine (public authority: declaration of infringement only)<\/em> \u00b7 GDPR, Articles 25 and 5(1)(a) \u00b7 <a href=\"https:\/\/seu.apdcat.cat\/ca\/documentPublic\/download\/8019\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Adverbis Spain, S.L.<\/strong> (2024): Made an automated call (recorded message) to a number registered on the Robinson List (Spanish advertising opt-out register). <em>\u20ac5,000<\/em> \u00b7 Spanish General Telecommunications Act (Ley 11\/2022, LGTel), Article 66.1.b, offense defined in Article 107.30 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00084-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>M\u00e1s Sol Energ\u00eda 15, S.L.<\/strong> (28-4-2026): Called a number on the Robinson List (Spanish advertising opt-out register) and could not say where it had obtained the telephone number. <em>\u20ac10,000 (\u20ac5,000 + \u20ac5,000)<\/em> \u00b7 Spanish General Telecommunications Act (LGTel), Article 66.1.b; GDPR, Article 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00249-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Napptive Solutions, S.L.<\/strong> (2024): Used an email address published on GitHub for prospecting without informing the person of the source of their data (web scraping). <em>No fine (warning)<\/em> \u00b7 GDPR, Article 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/pa-00015-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Informa D&amp;B, S.A.<\/strong> (2024 \u00b7 decision of 14-4-2025): Bought a file with data on self-employed individuals from a third party and marketed it without a legal basis or informing them. <em>\u20ac1,800,000 (\u20ac900,000 + \u20ac900,000)<\/em> \u00b7 GDPR, Articles 6(1) and 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00149-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Axesor Conocer para Decidir, S.A.U.<\/strong> (2025): Marketed data on self-employed individuals taken from the Chamber of Commerce census, without a legal basis or informing them. <em>\u20ac128,000 (\u20ac160,000 initially; \u221220%)<\/em> \u00b7 GDPR, Articles 6(1) and 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00464-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>CaixaBank, S.A.<\/strong> (Decision of 5-1-2021 \u00b7 SAN of 8-5-2025): Built commercial profiles of its customers on the basis of improperly obtained consent and informed them in a confusing way (the AEPD declared that it did not infringe Article 22 GDPR). <em>\u20ac2,000,000 after the National High Court ruling (\u20ac6,000,000 initially)<\/em> \u00b7 GDPR, Articles 6, 13 and 14 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00477-2019.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Banco Bilbao Vizcaya Argentaria, S.A.<\/strong> (Decision of 18-11-2020 \u00b7 STS of 11-11-2024): Processing of customer data for commercial purposes without a valid legal basis and with insufficient information. <em>\u20ac5,000,000 (\u20ac2,000,000 + \u20ac3,000,000)<\/em> \u00b7 GDPR, Articles 13, 14 and 6 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00070-2019.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Vodafone Espa\u00f1a, S.A.U.<\/strong> (Decision of 11-2-2021 \u00b7 SAN of 29-10-2024): Mass marketing campaigns (calls, SMS, emails) carried out by suppliers without control and without respecting objections. <em>\u20ac4,580,000 after the National High Court ruling (\u20ac8,150,000 initially)<\/em> \u00b7 GDPR, Articles 28 and 24, Article 44; Spanish Information Society Services Act (LSSI), Article 21; former Spanish General Telecommunications Act (Ley 9\/2014, LGTel), Article 48.1.b \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00059-2020.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Gestores Administrativos Reunidos, S.A. (GARSA)<\/strong> (2026): Gestor\u00eda administrativa (administrative services firm) working for the banking sector: suffered a breach of client data and the AEPD had to order it to notify those affected. <em>\u20ac75,000 (\u20ac125,000 initially: \u20ac100,000 + \u20ac25,000; \u221240%)<\/em> \u00b7 GDPR, Articles 5(1)(f) and 33 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00008-2026.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Administraciones Benipon, S.L.<\/strong> (2025): Property manager for a residents&#x27; association (acting as processor) that subcontracted without authorization and did not notify the controller of a breach. <em>\u20ac1,100 (\u20ac300 + \u20ac300 + \u20ac500)<\/em> \u00b7 GDPR, Articles 28(2), 28(4) and 33(2) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00251-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Konecta BTO, S.L.<\/strong> (2025): Call center working as a processor: unauthorized access to its systems exposed the data of its client&#x27;s customers. <em>\u20ac300,000 (\u20ac500,000 initially; \u221240%)<\/em> \u00b7 GDPR, Article 5(1)(f) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00613-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Coyare, S.L.U. (Bufete-RA)<\/strong> (2023): Law firm that sent advertising to 95 people with all the addresses visible in copy (CC). <em>\u20ac2,500 (\u20ac2,000 + \u20ac500)<\/em> \u00b7 GDPR, Articles 5(1)(f) and 32 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00395-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Marina Salud, S.A.<\/strong> (2024): As processor for the regional health department (Conselleria), it engaged sub-processors without first informing the controller of the changes. <em>\u20ac500,000<\/em> \u00b7 GDPR, Article 28(2) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00127-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Endesa Energ\u00eda, S.A.U.<\/strong> (Decision of 25-10-2023): Unauthorized access to its commercial systems containing customer data; it failed to notify the breach and to inform those affected, and made international transfers without safeguards. <em>\u20ac6,100,000 (\u20ac2,500,000 + \u20ac1,500,000 + \u20ac800,000 + \u20ac800,000 + \u20ac500,000)<\/em> \u00b7 GDPR, Articles 5(1)(f), 32, 33, 34 and 44 \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00002-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Fundaci\u00f3 Universitat Oberta de Catalunya (UOC)<\/strong> (27-8-2026): After running assignments through a plagiarism detection tool, a lecturer sent three students, in a single email, the names and assignments of all three accused. <em>\u20ac1,800 (\u20ac2,250 initially; \u221220%)<\/em> \u00b7 GDPR, Article 5(1)(f) \u00b7 <a href=\"https:\/\/seu.apdcat.cat\/ca\/documentPublic\/download\/8402\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Suneris, S.A. (hotel)<\/strong> (2024 \u00b7 payment on 28-6-2025): Scanned guests&#x27; identity documents at check-in. <em>\u20ac5,400 (\u20ac9,000 initially; \u221240%)<\/em> \u00b7 GDPR, Article 5(1)(c) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00421-2024.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Unique Hotel Apartment, S.L.<\/strong> (2023): Kept scanned copies of guests&#x27; ID cards (DNI). <em>\u20ac2,000<\/em> \u00b7 GDPR, Article 5(1)(c) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00331-2023.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>A private individual<\/strong> (Decision of 12-9-2025 \u00b7 later revoked): Distributed fake nude images of minors created with AI (the case known in the press as Almendralejo). <em>\u20ac1,200 paid (\u20ac2,000 initially; \u221240%)<\/em> \u00b7 GDPR, Article 6(1) \u00b7 <a href=\"https:\/\/www.aepd.es\/documento\/ps-00132-2025.pdf\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Fifteen minors (not identified)<\/strong> (20-6-2024): Used AI apps to create fake nude images of female classmates from their social media photos and distributed them. <em>One year of supervised probation for each<\/em> \u00b7 Spanish Criminal Code (C\u00f3digo Penal): child pornography and offenses against moral integrity (20 counts of each) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/AN\/openDocument\/62d3314f056ba825a0a8778d75e36f0d\/20250225\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>GlovoApp23, S.L.<\/strong> (25-9-2020): The Supreme Court held that a courier&#x27;s relationship with Glovo was an employment relationship: the algorithm allocated orders and time slots according to the courier&#x27;s rating. <em>\u2014<\/em> \u00b7 Workers&#x27; Statute (Estatuto de los Trabajadores), Articles 1.1 and 8.1 \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/TS\/openDocument\/05986cd385feff03\/20201001\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Foundever Spain, S.A.<\/strong> (4-7-2025): Failed to inform trade union representatives of the parameters of the algorithm that allocated staff days off. <em>\u20ac6,250 in damages to the trade union<\/em> \u00b7 Workers&#x27; Statute (Estatuto de los Trabajadores), Article 64.4.d; freedom of association (Spanish Constitution, Article 28.1) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/AN\/openDocument\/53f7e6ad5a39dd3fa0a8778d75e36f0d\/20250715\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Spanish State Administration (BOSCO, electricity social discount)<\/strong> (11-9-2025): The Supreme Court recognized a foundation&#x27;s right to access the source code of the program that decides who receives the social electricity tariff (bono social). <em>\u2014<\/em> \u00b7 Spanish Transparency Act (Ley 19\/2013) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/TS\/openDocument\/27d0d44d33b0dd21a0a8778d75e36f0d\/20250919\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Make Packing, S.L. y Art &amp; Graphic Packaging, S.L.<\/strong> (15-1-2026): Introduced clocking-in by facial recognition without consulting or involving staff (2023-2025). <em>\u20ac7,501 in damages to one worker<\/em> \u00b7 Right to one&#x27;s own image in connection with data protection (Spanish Constitution, Articles 18.1 and 18.4) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/AN\/openDocument\/355af934701652f8a0a8778d75e36f0d\/20260226\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Tiendas Conexi\u00f3n, S.L.U.<\/strong> (15-9-2020): Upheld a dismissal based on the GPS of the company car: the worker knew the vehicle was fitted with it. <em>\u2014<\/em> \u00b7 Spanish Constitution, Articles 18.1 and 18.4 (privacy and data protection); disciplinary dismissal (Workers&#x27; Statute (Estatuto de los Trabajadores), Article 54) \u00b7 <a href=\"https:\/\/www.poderjudicial.es\/search\/TS\/openDocument\/8adba1406c95ebc3\/20201006\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>OpenAI (ChatGPT)<\/strong> (02-11-2024 (press release 20-12-2024)): Trained ChatGPT with personal data without a legal basis, provided poor information, did not verify age and did not notify a personal data breach. <em>\u20ac15,000,000<\/em> \u00b7 GDPR: legal basis, transparency, age verification and breach notification. The exact articles cannot be verified: the decision has been removed from the website \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10085432\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Luka Inc. (Replika chatbot)<\/strong> (10-04-2025 (press release 19-05-2025)): Offered a \u201ccompanion\u201d chatbot without a legal basis for processing data, with a deficient privacy policy and without verifying age. <em>\u20ac5,000,000<\/em> \u00b7 GDPR, Articles 5(1)(a), 5(1)(c), 6, 12, 13, 24 and 25(1) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10132048\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Character Technologies Inc. (Character.AI)<\/strong> (03-07-2026 (press release 09-07-2026)): Its character chatbots provided deficient information, it carried out the impact assessment and appointed its EU representative late, and it gave minors little protection. <em>\u20ac158,000<\/em> \u00b7 GDPR, Articles 5(2), 12, 13, 14, 24(1), 25(2), 27 and 35(1) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10269594\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Hangzhou DeepSeek Artificial Intelligence y Beijing DeepSeek Artificial Intelligence<\/strong> (30-01-2025): Processed data of users in Italy with insufficient information, without an EU representative and storing them in China, and was banned from continuing to do so with immediate effect. <em>No fine<\/em> \u00b7 GDPR, Articles 6, 12, 13, 14, 27, 31 and 32 and Chapter III; measure under Article 58(2)(f) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10097450\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Company based in the British Virgin Islands that runs the Clothoff app (the Garante does not publish its name)<\/strong> (01-10-2025 (press release 03-10-2025)): App that uses AI to \u201cundress\u201d real people, including minors, without checking consent or age. <em>No fine<\/em> \u00b7 GDPR (urgent measure; see the provvedimento) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10174320\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>R.T.I. \u2013 Reti Televisive Italiane S.p.A.<\/strong> (23-07-2026 (press release 07-08-2026)): Broadcast deepfake videos of a journalist, with his voice imitated by AI, and the \u201cmade with AI\u201d notice was not clear enough. <em>No fine<\/em> \u00b7 GDPR, Articles 5 and 25; measures under Article 58(2)(b) and 58(2)(f) \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10281135\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Myndoor S.r.l.<\/strong> (14-05-2026 (press release 28-05-2026)): Offered a Slack and Teams add-on that uses AI to measure employees&#x27; stress from what they write, and the Garante issued a warning citing the prohibition on emotion recognition in the workplace. <em>No fine<\/em> \u00b7 GDPR, Article 58(2)(a) and Italian Privacy Code, Article 154(1)(f); Article 5(1)(f) of Regulation (EU) 2024\/1689 is cited \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10255522\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Foodinho s.r.l. (Glovo group)<\/strong> (13-11-2024 (press release 22-11-2024)): Algorithmic management of more than 35,000 couriers: facial recognition, location tracking outside working hours and deactivation of accounts without explaining how to challenge it or offering human intervention. <em>\u20ac5,000,000<\/em> \u00b7 GDPR, Articles 5(1)(a), (c), (d) and (e), 6, 9(2)(b), 12, 13, 22(3), 25, 28, 32, 35 and 88; Italian Privacy Code, Articles 2-septies and 114; D. Lgs. 81\/2015, Article 47-quinquies \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/10074840\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Deliveroo Italy s.r.l.<\/strong> (22-07-2021 (newsletter 02-08-2021)): Opaque algorithm for allocating orders among some 8,000 couriers, with continuous geolocation and a risk of discrimination. <em>\u20ac2,500,000<\/em> \u00b7 GDPR, Articles 5(1)(a), (c) and (e), 13, 22(3), 25, 30(1), 32, 35, 37(7) and 88 \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/web\/guest\/home\/docweb\/-\/docweb-display\/docweb\/9687860\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Comune di Trento<\/strong> (11-01-2024 (press release 25-01-2024)): Research projects that used AI to analyze street cameras and microphones and social media messages, without a legal basis or an impact assessment. <em>\u20ac50,000<\/em> \u00b7 GDPR, Articles 5(1)(a), 6, 9, 10, 13 and 14 and 35; Italian Privacy Code, Articles 2-ter, 2-sexies and 2-octies \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/9977299\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Clearview AI<\/strong> (10-02-2022 (press release 09-03-2022)): Created a facial recognition database with photos scraped from the internet, and was banned from processing data of people in Italy. <em>\u20ac20,000,000<\/em> \u00b7 GDPR, Articles 5(1)(a), (b) and (e), 6, 9, 12, 13, 14, 15 and 27 \u00b7 <a href=\"https:\/\/www.garanteprivacy.it\/home\/docweb\/-\/docweb-display\/docweb\/9751323\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Clearview AI (name per the EDPB; L\u00e9gifrance now anonymizes it, as the CNIL stops naming the company after two years)<\/strong> (17-10-2022 and 17-04-2023): Used facial recognition without a legal basis, did not comply with requests for access and erasure, and did not comply with the CNIL&#x27;s order either. <em>\u20ac20,000,000 + \u20ac5,200,000 (periodic penalty payment)<\/em> \u00b7 GDPR, Articles 6, 12, 15 and 17 \u00b7 <a href=\"https:\/\/www.legifrance.gouv.fr\/cnil\/id\/CNILTEXT000046444859\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Clearview AI Inc.<\/strong> (16-05-2024 (published 03-09-2024)): Unlawful biometric database with photos of people in the Netherlands, poor transparency and access requests left unanswered. <em>\u20ac30,500,000 (plus four orders subject to periodic penalty payments)<\/em> \u00b7 GDPR, Articles 5(1)(a) with 6(1), 9(1), 12(1) with 14(1) and 14(2), 12(2) and 12(3) with 15, and 27(1) \u00b7 <a href=\"https:\/\/www.edpb.europa.eu\/news\/national-news\/2024\/dutch-supervisory-authority-imposes-fine-clearview-because-illegal-data_en\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Clearview AI Inc.<\/strong> (Fine of May 2022; Upper Tribunal 06-10-2025): The same Clearview facial database; in 2025 the Upper Tribunal restored the ICO&#x27;s jurisdiction, which a tribunal had denied in 2023. <em>\u2248 \u00a37,500,000 (\u201c\u00a37.5m\u201d, ICO)<\/em> \u00b7 UK GDPR (territorial and material scope, Articles 2 and 3) \u00b7 <a href=\"https:\/\/ico.org.uk\/about-the-ico\/media-centre\/news-and-blogs\/2025\/10\/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc\/\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Uber<\/strong> (22-07-2024 (published 26-08-2024)): Sent data of European drivers (documents, location, photos and, in some cases, criminal and medical data) to the US without transfer safeguards. <em>\u20ac290,000,000<\/em> \u00b7 GDPR, Articles 44, 46 and 49 \u00b7 <a href=\"https:\/\/www.edpb.europa.eu\/news\/dutch-sa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to_en\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Uber B.V.<\/strong> (Published by the EDPB on 08-10-2026): Deactivated drivers&#x27; accounts fully automatically on suspicion of fraud or because of poor ratings, without informing them properly. <em>\u20ac824,990,000<\/em> \u00b7 GDPR, Articles 22 and 13 \u00b7 <a href=\"https:\/\/www.edpb.europa.eu\/news\/dutch-dpa-fines-uber-eur-824-990-000-for-unlawful-automated-decision-making-and-insufficient_en\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Amazon France Logistique<\/strong> (CNIL 27-12-2023; Conseil d&#x27;\u00c9tat 23-12-2025): Its warehouse scanners measured each worker to the second and kept all indicators for 31 days, an excess of data confirmed by the Conseil d&#x27;\u00c9tat. <em>\u20ac32,000,000 \u2192 \u20ac15,000,000<\/em> \u00b7 GDPR, Articles 5(1)(c), 12, 13 and 32 (the Article 6(1)(f) infringement is annulled) \u00b7 <a href=\"https:\/\/www.legifrance.gouv.fr\/ceta\/id\/CETATEXT000053163189\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>LinkedIn Ireland Unlimited Company<\/strong> (22-10-2024 (press release 24-10-2024)): Analyzed its users&#x27; behavior for targeted advertising without a valid legal basis or sufficient transparency. <em>\u20ac310,000,000<\/em> \u00b7 GDPR, Articles 5(1)(a), 6, 13(1)(c) and 14(1)(c) \u00b7 <a href=\"https:\/\/www.dataprotection.ie\/en\/news-media\/press-releases\/irish-data-protection-commission-fines-linkedin-ireland-eu310-million\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>TikTok Technology Limited<\/strong> (30-04-2025 (press release 02-05-2025)): Allowed access from China to European users&#x27; data without guaranteeing equivalent protection and without explaining it. <em>\u20ac530,000,000 (\u20ac485 million + \u20ac45 million)<\/em> \u00b7 GDPR, Articles 46(1) and 13(1)(f) \u00b7 <a href=\"https:\/\/www.dataprotection.ie\/en\/news-media\/latest-news\/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>X (Grok)<\/strong> (08-08-2024; closed on 04-09-2024): Used public posts by European users to train Grok and gave an undertaking before the court to stop processing those data permanently. <em>No fine<\/em> \u00b7 GDPR (lawfulness of processing) \u00b7 <a href=\"https:\/\/www.dataprotection.ie\/en\/news-media\/press-releases\/dpc-welcomes-xs-agreement-suspend-its-processing-personal-data-purpose-training-ai-tool-grok\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Hangzhou DeepSeek Artificial Intelligence Co., Ltd. y Beijing DeepSeek Artificial Intelligence Co., Ltd.<\/strong> (16-12-2025 (press release 30-04-2026)): Its chatbot did not warn that it may \u201challucinate\u201d (make up information), and it undertook to display permanent warnings and improve its information. <em>No fine<\/em> \u00b7 Italian Consumer Code, Articles 20, 21 and 22 (closed under Article 27(7), without a finding of infringement) \u00b7 <a href=\"https:\/\/www.agcm.it\/media\/comunicati-stampa\/2026\/4\/PS12942-PS12968-PS12973\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>SCHUFA Holding (credit reference agency)<\/strong> (07-12-2023): Automatically calculating the probability that a person will default is an \u201cautomated decision\u201d if a third party (a bank, for example) relies on it to grant or refuse a contract. <em>Not applicable<\/em> \u00b7 GDPR, Article 22(1) (interpretation) \u00b7 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/ES\/TXT\/?uri=CELEX:62021CJ0634\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Dun &amp; Bradstreet Austria GmbH<\/strong> (27-02-2025): A person refused a contract on the basis of an automated credit profile must be given an understandable explanation of how the result was reached, and trade secrecy does not allow a straightforward refusal. <em>Not applicable<\/em> \u00b7 GDPR, Articles 15(1)(h) and 22(1) (interpretation) \u00b7 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/ES\/TXT\/?uri=CELEX:62022CJ0203\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>Uber B.V.<\/strong> (04-04-2023): Deactivated drivers without genuine human intervention, and the court ordered it to explain the logic of the decision to them. <em>\u20ac4,000\/day periodic penalty payment<\/em> \u00b7 GDPR, Articles 15(1)(h) and 22 \u00b7 <a href=\"https:\/\/uitspraken.rechtspraak.nl\/details?id=ECLI:NL:GHAMS:2023:793\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><li><strong>(European Commission; affects any company sending data to the US)<\/strong> (03-09-2025; appeal of 31-10-2025): The General Court upheld the EU-US data transfer framework (Data Privacy Framework), and the judgment is under appeal before the Court of Justice. <em>Not applicable<\/em> \u00b7 Adequacy decision (EU) 2023\/1795; GDPR, Article 45 \u00b7 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/ES\/ALL\/?uri=CELEX:62025CN0703\" rel=\"noopener\" target=\"_blank\">official source<\/a><\/li><\/ul><\/div><\/details><\/div><\/div><\/div><\/section>\r\n\r\n  <section class=\"bloque bloque-cta\" aria-labelledby=\"cta-t\">\r\n    <div class=\"envoltorio\">\r\n      <div class=\"cta\">\r\n        <p class=\"cta-ante\">Diagn\u00f3stico<\/p>\r\n        <h2 id=\"cta-t\">Cu\u00e9ntanos c\u00f3mo funciona tu empresa<\/h2>\r\n        <p>Antes de implantar IA, estudiamos c\u00f3mo trabaja tu empresa: procesos, programas y pruebas con tus datos reales. Y te llevas tambi\u00e9n un informe normativo: protecci\u00f3n de datos y Reglamento europeo de IA.<\/p>\r\n        <p class=\"cta-cumple\">Cada proyecto pasa por una revisi\u00f3n de cumplimiento normativo \u2014protecci\u00f3n de datos y Reglamento europeo de IA\u2014 con nuestro partner Forrellat Consultors, Delegado de Protecci\u00f3n de Datos inscrito en la AEPD.<\/p>\r\n        <div class=\"cta-botones\">\r\n          <a class=\"btn tap\" href=\"https:\/\/robustdatasolutions.com\/contacto\/\" id=\"cta-boton\">Cu\u00e9ntanos sobre tu empresa<\/a>\r\n          <a class=\"cta-sec tap\" href=\"https:\/\/robustdatasolutions.com\/diagnostico\/\">C\u00f3mo es el diagn\u00f3stico \u2192<\/a>\r\n        <\/div>\r\n      <\/div>\r\n      <div class=\"aviso-legal\" role=\"note\" data-no-translation data-no-dynamic-translation>\r\n        <p><strong>Information only, not legal advice.<\/strong> <span id=\"aviso-texto\">Checked against official sources on October 22, 2026.<\/span><\/p>\r\n      <\/div>\r\n    <\/div>\r\n  <\/section>\r\n<\/div>\r\n<dialog class=\"video-capa\" id=\"video-capa\" aria-label=\"Video: AI Act by department\" data-no-translation data-no-dynamic-translation><button class=\"cerrar tap\" type=\"button\" aria-label=\"Close the video\">\u00d7<\/button><div class=\"marco-916\" id=\"video-marco\"><\/div><\/dialog>\r\n<div class=\"toast\" id=\"toast\" role=\"status\" aria-live=\"polite\" data-no-translation data-no-dynamic-translation><\/div>\r\n<\/div>\r\n\n","protected":false},"author":2,"featured_media":3619,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_yoast_wpseo_focuskw":"","_yoast_wpseo_title":"Ley de IA en la empresa: qu\u00e9 exige a cada departamento","_yoast_wpseo_metadesc":"Normativa de IA para empresas: elige tu departamento o sector y mira qu\u00e9 exigen el Reglamento de IA y el RGPD, con la norma exacta y casos sancionados.","_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","rank_math_title":"","rank_math_description":"","rank_math_focus_keyword":"","footnotes":""},"class_list":["post-3620","page","type-page","status-publish","has-post-thumbnail","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ley de IA en la empresa: qu\u00e9 exige a cada departamento<\/title>\n<meta name=\"description\" content=\"Normativa de IA para empresas: elige tu departamento o sector y mira qu\u00e9 exigen el Reglamento de IA y el RGPD, con la norma exacta y casos sancionados.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/robustdatasolutions.com\/en\/eu-ai-act-for-businesses\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ley de IA en la empresa: qu\u00e9 exige a cada departamento\" \/>\n<meta property=\"og:description\" content=\"Normativa de IA para empresas: elige tu departamento o sector y mira qu\u00e9 exigen el Reglamento de IA y el RGPD, con la norma exacta y casos sancionados.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/robustdatasolutions.com\/en\/eu-ai-act-for-businesses\/\" \/>\n<meta property=\"og:site_name\" content=\"Robust Data Solutions\" \/>\n<meta property=\"og:image\" content=\"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2026\/10\/ley-de-ia-por-departamentos-og.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/ley-de-ia-empresas\\\/\",\"url\":\"https:\\\/\\\/robustdatasolutions.com\\\/ley-de-ia-empresas\\\/\",\"name\":\"Ley de IA en la empresa: qu\u00e9 exige a cada departamento\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/ley-de-ia-empresas\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/ley-de-ia-empresas\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/robustdatasolutions.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ley-de-ia-por-departamentos-og.jpg\",\"datePublished\":\"2026-10-23T10:09:25+00:00\",\"description\":\"Normativa de IA para empresas: elige tu departamento o sector y mira qu\u00e9 exigen el Reglamento de IA y el RGPD, con la norma exacta y casos sancionados.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/ley-de-ia-empresas\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/robustdatasolutions.com\\\/ley-de-ia-empresas\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/ley-de-ia-empresas\\\/#primaryimage\",\"url\":\"https:\\\/\\\/robustdatasolutions.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ley-de-ia-por-departamentos-og.jpg\",\"contentUrl\":\"https:\\\/\\\/robustdatasolutions.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ley-de-ia-por-departamentos-og.jpg\",\"width\":1200,\"height\":630,\"caption\":\"Ley de IA por departamentos: qu\u00e9 exige la ley a cada uso de la IA en tu empresa. Informe Robust.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/ley-de-ia-empresas\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/robustdatasolutions.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ley de IA por departamentos\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#website\",\"url\":\"https:\\\/\\\/robustdatasolutions.com\\\/\",\"name\":\"Robust Data Solutions\",\"description\":\"Dirige toda tu empresa hablando, por texto o por voz, desde una sola pantalla\",\"publisher\":{\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/robustdatasolutions.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#organization\",\"name\":\"Robust Data Solutions\",\"url\":\"https:\\\/\\\/robustdatasolutions.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/robustdatasolutions.com\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Logos-Robust-2.png\",\"contentUrl\":\"https:\\\/\\\/robustdatasolutions.com\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Logos-Robust-2.png\",\"width\":1371,\"height\":1371,\"caption\":\"Robust Data Solutions\"},\"image\":{\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/robust-data-solutions\\\/\",\"https:\\\/\\\/www.youtube.com\\\/@robust-data-solutions\",\"https:\\\/\\\/www.google.com\\\/search?kgmid=\\\/g\\\/11zz3s_j4r\"],\"legalName\":\"ROBUST DATA SOLUTIONS, S.L.\",\"description\":\"Consultora de inteligencia artificial para empresas. Robust Data Solutions conecta todos los programas que ya usa una empresa (ERP, CRM, correo, WhatsApp, documentos y contabilidad) a una inteligencia artificial, y la empresa se dirige entera hablando, por texto o por voz, desde una sola pantalla. La IA propone y una persona decide siempre (Human in the Loop). Protecci\u00f3n de datos y Reglamento europeo de IA desde el primer d\u00eda.\",\"founder\":{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#\\\/schema\\\/person\\\/18c797d96f515e9cddddeb69f0aaa824\",\"name\":\"Albert Lens\",\"jobTitle\":\"Founder and CEO\",\"url\":\"https:\\\/\\\/robustdatasolutions.com\\\/en\\\/sobre-nosotros\\\/\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#\\\/schema\\\/person\\\/image\\\/albert-lens\",\"url\":\"https:\\\/\\\/robustdatasolutions.com\\\/wp-content\\\/uploads\\\/2025\\\/12\\\/team-albert-lens.jpg\",\"contentUrl\":\"https:\\\/\\\/robustdatasolutions.com\\\/wp-content\\\/uploads\\\/2025\\\/12\\\/team-albert-lens.jpg\",\"width\":640,\"height\":640,\"caption\":\"Albert Lens\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/albert-lens-ai\\\/\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/robustdatasolutions.com\\\/#organization\"},\"description\":\"Fundador y CEO de Robust Data Solutions. Lleva m\u00e1s de 40 a\u00f1os en tecnolog\u00eda para empresas \u2014software de gesti\u00f3n, sistemas, redes y seguridad\u2014 y hoy dirige proyectos de inteligencia artificial conectada a los programas de cada empresa.\"},\"address\":{\"@type\":\"PostalAddress\",\"addressLocality\":\"Jorba\",\"postalCode\":\"08719\",\"addressRegion\":\"Barcelona\",\"addressCountry\":\"ES\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The AI Act at work: what it requires of each department","description":"AI regulations for businesses: choose your department or sector and see what the AI Act and the GDPR require, with the exact rule and real penalty cases.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/robustdatasolutions.com\/en\/eu-ai-act-for-businesses\/","og_locale":"en_US","og_type":"article","og_title":"Ley de IA en la empresa: qu\u00e9 exige a cada departamento","og_description":"Normativa de IA para empresas: elige tu departamento o sector y mira qu\u00e9 exigen el Reglamento de IA y el RGPD, con la norma exacta y casos sancionados.","og_url":"https:\/\/robustdatasolutions.com\/en\/eu-ai-act-for-businesses\/","og_site_name":"Robust Data Solutions","og_image":[{"width":1200,"height":630,"url":"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2026\/10\/ley-de-ia-por-departamentos-og.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/","url":"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/","name":"The AI Act at work: what it requires of each department","isPartOf":{"@id":"https:\/\/robustdatasolutions.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/#primaryimage"},"image":{"@id":"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/#primaryimage"},"thumbnailUrl":"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2026\/10\/ley-de-ia-por-departamentos-og.jpg","datePublished":"2026-10-23T10:09:25+00:00","description":"AI regulations for businesses: choose your department or sector and see what the AI Act and the GDPR require, with the exact rule and real penalty cases.","breadcrumb":{"@id":"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/#primaryimage","url":"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2026\/10\/ley-de-ia-por-departamentos-og.jpg","contentUrl":"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2026\/10\/ley-de-ia-por-departamentos-og.jpg","width":1200,"height":630,"caption":"Ley de IA por departamentos: qu\u00e9 exige la ley a cada uso de la IA en tu empresa. Informe Robust."},{"@type":"BreadcrumbList","@id":"https:\/\/robustdatasolutions.com\/ley-de-ia-empresas\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/robustdatasolutions.com\/"},{"@type":"ListItem","position":2,"name":"Ley de IA por departamentos"}]},{"@type":"WebSite","@id":"https:\/\/robustdatasolutions.com\/#website","url":"https:\/\/robustdatasolutions.com\/","name":"Robust Data Solutions","description":"Run your whole company by talking, by text or by voice, from a single screen","publisher":{"@id":"https:\/\/robustdatasolutions.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/robustdatasolutions.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/robustdatasolutions.com\/#organization","name":"Robust Data Solutions","url":"https:\/\/robustdatasolutions.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/robustdatasolutions.com\/#\/schema\/logo\/image\/","url":"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2025\/11\/Logos-Robust-2.png","contentUrl":"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2025\/11\/Logos-Robust-2.png","width":1371,"height":1371,"caption":"Robust Data Solutions"},"image":{"@id":"https:\/\/robustdatasolutions.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/robust-data-solutions\/","https:\/\/www.youtube.com\/@robust-data-solutions","https:\/\/www.google.com\/search?kgmid=\/g\/11zz3s_j4r"],"legalName":"ROBUST DATA SOLUTIONS, S.L.","description":"Artificial intelligence consultancy for businesses. Robust Data Solutions connects all the software a company already uses (ERP, CRM, email, WhatsApp, documents and accounting) to an artificial intelligence, so the whole company can be run by talking, by text or by voice, from a single screen. The AI proposes and a person always makes the final decision (Human in the Loop). Data protection and the EU AI Act from day one.","founder":{"@type":"Person","@id":"https:\/\/robustdatasolutions.com\/#\/schema\/person\/18c797d96f515e9cddddeb69f0aaa824","name":"Albert Lens","jobTitle":"Founder and CEO","url":"https:\/\/robustdatasolutions.com\/en\/sobre-nosotros\/","image":{"@type":"ImageObject","@id":"https:\/\/robustdatasolutions.com\/#\/schema\/person\/image\/albert-lens","url":"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2025\/12\/team-albert-lens.jpg","contentUrl":"https:\/\/robustdatasolutions.com\/wp-content\/uploads\/2025\/12\/team-albert-lens.jpg","width":640,"height":640,"caption":"Albert Lens"},"sameAs":["https:\/\/www.linkedin.com\/in\/albert-lens-ai\/"],"worksFor":{"@id":"https:\/\/robustdatasolutions.com\/#organization"},"description":"Fundador y CEO de Robust Data Solutions. Lleva m\u00e1s de 40 a\u00f1os en tecnolog\u00eda para empresas \u2014software de gesti\u00f3n, sistemas, redes y seguridad\u2014 y hoy dirige proyectos de inteligencia artificial conectada a los programas de cada empresa."},"address":{"@type":"PostalAddress","addressLocality":"Jorba","postalCode":"08719","addressRegion":"Barcelona","addressCountry":"ES"}}]}},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/robustdatasolutions.com\/en\/wp-json\/wp\/v2\/pages\/3620","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/robustdatasolutions.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/robustdatasolutions.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/robustdatasolutions.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/robustdatasolutions.com\/en\/wp-json\/wp\/v2\/comments?post=3620"}],"version-history":[{"count":0,"href":"https:\/\/robustdatasolutions.com\/en\/wp-json\/wp\/v2\/pages\/3620\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/robustdatasolutions.com\/en\/wp-json\/wp\/v2\/media\/3619"}],"wp:attachment":[{"href":"https:\/\/robustdatasolutions.com\/en\/wp-json\/wp\/v2\/media?parent=3620"}],"curies":[{"name":"Wordpress","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}