AI Trends in Spain and Implications for Japan / Pioneering Cases of AI Governance and Legal Experimentation in Spain / Reflections on the Legal Scope of AESIA, Sandboxes, and Sovereign AI Infrastructure

0 Introduction

The landscape of Artificial Intelligence (AI) regulation in the European Union (EU) is at an unprecedented turning point. Following a preparatory period, the EU AI Act is finally transitioning into a phase of full application and enforcement across member states. Amidst this historic shift in legal systems, while many legal scholars and practitioners are closely watching the movements of major powers like Germany and France, it is Spain that is conducting the most ambitious and thought-provoking 'experiment' from the perspective of AI governance implementation.

The report 'EU AI Act Spain AI Ecosystem Brief (December 2025),' published by AI & Partners in December 2025, vividly documents this Spanish challenge. The country has established the first dedicated AI supervisory authority (AESIA) in Europe and is exploring the balance between law enforcement and innovation through a regulatory sandbox. In this article, taking the report as a starting point, I will examine how Spain is building 'institutional governance that utilizes the EU legal framework without relying on the method of enacting comprehensive domestic laws.' What emerges is the tension between discipline through hard law and the economic reality of the ecosystem, which serves as an extremely important case study for considering future AI legislation.

1 The Location of the Problem: The Strategic Choice of 'Regulation Without Law'

When discussing AI governance, the focus of the debate is often the presence or absence of 'unique national laws.' However, the most significant feature of Spain's approach lies in the strategic choice not to enact a unique, comprehensive 'National AI Act.' According to the report, rather than building an independent domestic legal system for AI, Spain has chosen to prioritize full alignment with the EU AI Act and to develop enforcement infrastructure for EU regulations in a way that complements existing legal systems (such as data protection, competition, and labor laws).

This may appear to be a standard phenomenon in the EU legal order, where supranational law (EU law) replaces domestic law. However, considering the speed of technological progress and the uncertainty of AI, Spain's method of launching a powerful supervisory agency and experimental environment ahead of the full application of substantive law can be evaluated as a highly conscious 'supervisory-first approach.'

The question is how such an institution- and supervision-first approach is actually affecting the local innovation ecosystem and the protection of fundamental rights. Is the predictability of legal regulation ensured? Is strict supervision stifling investment? Or, how is sovereign AI development positioned? Below, I will proceed with the verification while unraveling the data in the report.

2 Institutional Design of Supervisory-First Governance: AESIA and Sandboxes

The core of AI governance in Spain is the 'Spanish Agency for the Supervision of Artificial Intelligence (AESIA: Agencia Española de Supervisión de la Inteligencia Artificial),' the first dedicated AI supervisory agency in Europe. According to the report, AESIA was established in a way that anticipates its role as a Market Surveillance Authority under the EU AI Act.

From a legal-sociological perspective, the establishment of AESIA is an attempt to concentrate the enforcement costs of AI regulation in a specialized agency and to unify interpretations. The biggest concern in AI regulation is erroneous legal interpretation due to a lack of expertise in existing regulatory authorities (such as data protection or consumer protection authorities) or confusion due to overlapping jurisdictions. One can read into Spain's intention to form a de facto standard for regulatory enforcement within the EU by launching a dedicated agency early. Furthermore, AESIA's mandate includes not only law enforcement and sanctions but also awareness-raising, training, and the promotion of 'safe AI adoption' in both the public and private sectors. This means that the regulatory authority plays the role of an enabler of the ecosystem, not just a gatekeeper.

Furthermore, what attracts the most legal interest in this report is the 'Regulatory Sandbox' initiative established by Royal Decree 817/2023. As of April 2025, 12 high-risk AI systems are testing their compliance with European AI regulations in this sandbox.

From a legal perspective, the sandbox is the embodiment of 'agile governance.' Normally, laws are applied uniformly to all subjects the moment they are enacted, but within a sandbox, it is possible to temporarily suspend or relax the application of the law through dialogue with regulatory authorities and to revise the details of the rules (guidelines, etc.) by feeding back the results. According to the report, the purpose of this sandbox is not only to support corporate compliance but also to utilize the knowledge gained from it for the joint development of technical guidelines. This means that the process by which the regulated side (companies) and the regulator (AESIA) work together to create enforceable rules is institutionalized.

3 Digital Sovereignty and Infrastructure Legal Policy: ENIA and ALIA

What is often overlooked when discussing AI governance is the issue of compute and data sovereignty. The 2024 revision of Spain's National AI Strategy (ENIA: Estrategia Nacional de Inteligencia Artificial) focuses strongly on this point in response to the rise of generative AI.

As part of the 'HispanIA 2040' strategy (announced in January 2025), Spain is promoting a proprietary foundation model project called 'ALIA.' This is an open-source model under public management, trained on large datasets including Spanish and co-official languages within Spain (Catalan, Galician, and Basque).

In the current situation where the generative AI market is dominated by models from North American companies trained primarily on English-language data, possessing 'Sovereign AI' that accurately understands one's own language, culture, and legal system is extremely important from the perspective of security and rights protection. This is because continuing to rely on platforms from other countries is nothing more than externalizing the foundations of governance, such as the accuracy of information and the correction of bias.

Also, the construction of sector-specific data spaces is important from the perspective of data governance. Building a secure data-sharing framework in fields such as healthcare and tourism, while coordinating with the EU Data Strategy and GAIA-X, can be called infrastructure development to alleviate the tension between GDPR (General Data Protection Regulation) and AI development.

4 Ecosystem Fragmentation and Economic Reality: From the Perspective of Investment and Disparity

While institutional development is progressing, the economic data presented in the report highlights the structural challenges facing Spain's AI ecosystem.

First, what should be noted is the volatility of venture capital (VC) investment. According to an analysis based on OECD.AI data, while investment in generative AI in Spain saw a sharp spike in the first quarter of 2025 (17 deals), it is extremely unstable overall. The report describes this as "structurally fragile."

This instability in investment may reflect uncertainty during a transitional period in the legal system. The introduction of a powerful regulation like the EU AI Act will increase market reliability in the long term, but in the short term, it carries the risk of causing investors to adopt a wait-and-see approach due to concerns over compliance costs. The surge in 2025 can be interpreted as a sign of relief following the solidification of institutional frameworks such as AESIA and sandboxes, but whether this will become a sustainable trend remains unpredictable. In particular, the lack of deep-tech specialized funds to support scaling up from the seed stage to the growth stage is cited as a challenge.

More serious is the gap in AI adoption based on company size. According to the report, the AI adoption rate for Spanish companies as of 2024 was 11.31%, which is below the EU average (13.48%). Looking at the details, while the adoption rate for large enterprises is approximately 44%, it remains at only 10.3% for small and medium-sized enterprises (SMEs), a difference of more than 33 percentage points. This gap is larger than the EU average.

The sophistication and complexity of AI regulation can work to the advantage of large companies with resources as a "barrier to entry," while posing a risk of "exclusion" for SMEs due to increased compliance costs (the paradox of regulation). The Spanish government is supporting the digitalization of SMEs through regional networks such as "RETECH IA," but the extent to which it can correct this structural disparity will be the key to the success or failure of its governance.

5 The Divergence Between "Readiness" and "Capability" in the Government AI Readiness Index

The analysis of Oxford Insights' "Government AI Readiness Index" included in the report is also interesting. According to this, Spain records extremely high scores in the "Government" and "Data & Infrastructure" pillars (74.58 and 82.43, respectively), placing it among the top countries in Western Europe. This objectively confirms that the government's regulatory preparation and the development of telecommunications infrastructure are progressing.

On the other hand, the score for the "Technology Sector" is relatively low at 50.75, indicating challenges in innovation capacity and private sector maturity. This composition, where "the government is fully prepared but the private sector is not catching up," clearly illustrates the characteristics of the Spanish model, where strong top-down governance takes the lead.

No matter how well laws and systems are developed, it is private companies that actually drive innovation. Will strong government-led initiatives act as a catalyst to encourage autonomous growth in the private sector, or will they create a culture of dependency? This point is an important issue to consider when thinking about the role of the AI Act as industrial policy.

6 Reflections

I have provided an overview of the current state and challenges of AI governance in Spain. What emerges is the image of a nation attempting to adapt to the wave of the massive "hard law" that is the EU AI Act by mobilizing the "organization" of AESIA, the "process" of sandboxes, and the "infrastructure" of ALIA.

The case of Spain shows that there are both "first-mover advantages" and "first-mover burdens" in AI governance. While there is a possibility of establishing a position as a hub for Trustworthy AI by quickly developing a regulatory environment, it also means being the first to bear the pains of regulatory compliance costs and investment volatility.

Institutional designs like AESIA, where the regulatory authority functions not just as a monitor but also as a partner in innovation, offer many points of reference for Japan's AI governance. To the proposition that law should be a guardrail for social implementation rather than chains that bind technology, Spain's experiment is attempting to present a concrete solution. As we head toward the full application of the EU AI Act in 2026, there is a need to closely monitor the progress of this experiment and adopt an attitude of applying its lessons to our own legal system design.

7 Implications for Japan

From the case of Spain, implications to be considered for Japan's AI governance can be derived.

First is the issue of the organizational independence of supervisory functions. Japan established the AI Safety Institute (AISI) within the IPA in February 2024, but its nature differs from an independent, dedicated supervisory agency like Spain's AESIA. While the current approach of operating AI business guidelines as non-binding soft law is excellent in terms of respecting the autonomy of businesses, the need for an agency equipped with professional expertise and enforcement authority may increase in situations where compliance with hard law that has extraterritorial application, such as the EU AI Act, is required.

Second is the construction of sovereign AI infrastructure. The fact that Spain is promoting the development of foundation models in its own language through the ALIA project is suggestive for Japan, which has the linguistic specificity of the Japanese language. In particular, the development of AI infrastructure as a public good, including legal and judicial precedent data, is worth considering from the perspective of improving access to legal services.

Third is addressing the gap between company sizes. The low adoption rate of SMEs in Spain is a structural challenge shared by small and medium-sized enterprises in Japan. To ensure that the refinement of governance does not impair the inclusivity of innovation, an integrated design with support measures is required.

The above are the points that come to mind as implications for Japan. Since I have not been able to delve deeper, I would like to deepen my examination in the future.

(Magazine) "Reflections on AI and Law"

*Please refer to the table of contents below

note General Terms and Conditions Article 3, Paragraph 2, First Sentence
3.2 The copyright of digital content created by the creator belongs to the creator.