EU AI Act for your Spanish company: where are you really at in terms of compliance?
Regulation (EU) 2024/1689 has been phased in for two years, and since August 2, 2026, the obligations for high-risk AI systems have been fully in effect. If your company has generative or agentic AI in production on AWS, you need to know where you stand before a customer, a vendor, or a jury decides for you. This week at Apser, we're addressing the issue with figures, deadlines, and decisions you can make now.
We're not going to explain the entire law. We're going to answer the three questions our clients have been asking us every week since January 2026: Does it apply to me now? What do I need to do this quarter? What is Apser doing about it?
Why this moment matters for your company
The implementation timetable for Regulation (EU) 2024/1689 has three critical phases, all of which are already underway in August 2026:
- February 2th 2025: prohibitions on practices (biometric social scoring, subliminal manipulation, etc.) and AI literacy requirements for employees who operate it.
- August 2th, 2025transparency obligations for general-purpose AI models (Article 50) and obligations for suppliers and deployment of GPAI models.
- August 2th, 2026Full obligations for AI systems high risk (Annex III) — registration, conformity assessment, risk management, post-market surveillance and stakeholder rights.
This third step is the one that is most affecting Apser's customers: AI deployments that impact people in hiring, credit, education, health, or essential services.
Does this apply to you? Three typical cases in the Spanish midmarket
The high-risk criterion is described in Annex III of the Regulation , but we'll explain it in light of the cases we see most often at Apser with clients like you:
- recruitment and selectionIf you use AI to screen resumes, pre-select candidates, or score interviews, your system is already high-risk.
- Credit assessment or customer scoringIf the system decides on commercial conditions or denies financial services, you are in Annex III.
- Access to essential or public servicesIf AI determines access to healthcare, formal education, social benefits, or justice, you're in too.
If your company only uses internal generative AI (summaries, drafts, internal employee support) without affecting the rights of external parties, you probably are not at high risk , but you do have governance and transparency obligations that are already in place.
What you should already be doing since August 2026
For high-risk systems operating in the EU, the Regulation requires, among other things:
- Continuous risk management about the system's life cycle, not just at the time of deployment.
- Data governance: representative datasets, traceability, documented bias.
- Registration in the European database (carried out by the Commission) before its commissioning.
- Technical documentation and conformity assessment evidence ready for inspection.
- Post-market surveillance and the obligation to report serious incidents.
- Transparency for the end userClear information that you are interacting with an AI system.
For GPAI (general purpose) models , the obligations relate to transparency regarding training data, copyright, and acceptable use policies.
GDPR and EU AI Act: where they overlap and where they don't
A common misconception among clients is that "since I already comply with GDPR, I also comply with the EU AI Act." Not exactly. GDPR and the AI Act are complementary, not interchangeable.
| Your obligation | GDPR | EU AI Act |
|---|---|---|
| Legal basis for processing personal data | Yes | It doesn't replace her |
| Rights of the data subject (access, rectification, erasure) | Yes | Not directly, but it overlaps with some rights of the person affected by the automated decision. |
| Impact assessment (DPIA / FRIA) | DPIA required for certain treatments | Mandatory cold storage before deploying high-risk systems |
| Transparency in the use of AI | Partial, via the principle of transparency | Specific and reinforced in systems that interact with people (Article 50) |
| Record of treatment activities | Yes | No; the AI Act requires registration of the system, not of the processing. |
| Transfer to a supplier outside the EEA | Regulated international transfers | Specific rules for suppliers established outside the EU that place systems on the European market |
In practice, at Apser we usually address GDPR and AI Act in the same AWS Well-Architected Review , but with two separate deliverables: one for DPO and one for compliance committee.
Is it your company's turn? Four honest questions
Before reading on, mentally answer these four questions. If you answer "yes" to two or more, you need to take action this quarter:
- Does your AI system make decisions that affect people outside your organization? (hiring, credit, admission, scoring, service evaluation).
- Does it interact directly with end users without clear human oversight? (customer-facing chatbots, product recommendations, content generation with reputational impact).
- Does it systematically process sensitive data (health, financial, employee data)?
- Is it a third-party general-purpose model (GPAI) or one developed by your organization?
If yes to two or more, it falls within the scope of what is already being applied. If yes to only one or none, it is advisable to consolidate governance before scaling up.
What Apser does to help you
From our AWS Agentic AI Competency at Apser and our compliance practice on the AWS Well-Architected Framework , we have support that adapts to the case:
- AI compliance discovery in 30 minutes for your specific case.
- EU AI Act risk assessment, with separate deliverables for DPO and for the management committee.
- Technical implementation on Amazon Bedrock with guardrails, logging and traceability aligned with the Regulation.
- Operation maintained with MSP on AWS o Premium support, depending on your device's load.
As social proof: two cases already in production, the Habitium case (catalog automation with Amazon Bedrock) and the PFS Legal case (controlled modernization from private data center to AWS), are examples of systems that we have already accompanied from the initial decision to operation.
Frequently Asked Questions for Your Company (August 2026)
Is the EU AI Act in force in August 2026?
It is Regulation (EU) 2024/1689 and it entered into force on 1 August 2024, with phased implementation. By August 2026, the obligations for high-risk AI systems listed in Annex III and for general-purpose models will be fully in effect.
Is my Spanish company affected even if it is not "high risk"?
Yes, in many cases. Any company that uses general-purpose AI models (Claude, Nova, Titan) in products or services for the European market has transparency obligations under Article 50 and must comply with the supplier's acceptable use policies.
Does using a "European" model or an "ethical" hyperscaler automatically comply with the EU AI Act?
No. Responsibility is shared between the vendor and the deployer. You are the deployer if you integrate it into your product or service. Your obligation is independent of the vendor you choose.
What practical difference does it have with GDPR?
GDPR focuses on personal data. EU AI Act focuses on the system. GDPR requires a Data Protection Impact Assessment (DPIA) for certain processing activities; EU AI Act requires a Fundamental Rights Impact Assessment (FRIA) before deploying high-risk systems. GDPR regulates international data transfers; AI Act regulates specific obligations for non-EU providers placing systems on the European market.
How to proceed this week
If you want to apply all of this to your company with a specific case, there are two practical ways to do it:
- Download the checklist: "Does the EU AI Act apply to you this quarter?" — 6 binary questions and an exit traffic light.
- Book 30 minutes with Apser to review your case and decide together what's next this quarter.
Let's talk to an Apser specialist →
Apser Editorial Team · Published on apser.es
