← Regulators
AI Act EU 2024/1689 Spain

Who is AESIA: Spain's AI supervisory authority

AESIA is the EU's first dedicated national AI agency — Spain's authority for supervising and, where needed, sanctioning AI systems under the AI Act. What it does, the key detail that it is not an independent authority (unlike a data-protection DPA), who runs it, and where it sits — every fact sourced.

Published May 17, 2026 · 5 min read · 7 sources cited

When the AI Act needed each Member State to name a national authority to police AI, Spain moved first — it did not bolt the job onto an existing regulator, it built a dedicated agency: AESIA. It is the EU’s first standalone national AI authority. This is a profile of what AESIA is, what it can (and cannot) do, and one structural detail that matters: it is not an independent authority the way a data-protection regulator is. Every fact is sourced.

Quick facts

  • Full name: Agencia Española de Supervisión de la Inteligencia Artificial (Spanish Agency for the Supervision of Artificial Intelligence) — AESIA
  • Established: by Royal Decree 729/2023 of 22 August 2023 (BOE, official text, published 2 September 2023)
  • Inaugurated: officially presented on 19 June 2024 in A Coruña — the EU’s first dedicated national AI agency (La Moncloa)
  • Seat: A Coruña, the “La Terraza” building ceded by the city (Royal Decree 729/2023, Art. 2)
  • Legal status: a state agency attached, via the Secretariat of State for Digitalisation and Artificial Intelligence (SEDIA), to the ministry responsible for digital transformation — not an independent authority (Royal Decree 729/2023)
  • Governance: a Presidency and a Governing Board (Consejo Rector); a Director-General runs day-to-day operations, appointed by the Governing Board on the Presidency’s proposal (Royal Decree 729/2023)
  • Director-General: Alberto Gago Fernández, appointed by the Governing Board in December 2025, succeeding Ignasi Belda (who launched the agency in 2024) (AESIA)
  • Website: aesia.digital.gob.es

What AESIA is — and what it is not

AESIA is Spain’s authority responsible for the supervision and, where applicable, sanction of AI systems (Royal Decree 729/2023). It is the national point of contact and market-surveillance authority for the AI Act in Spain, with particular focus on high-risk AI systems.

The detail most coverage skips: AESIA is not an independent authority. A data-protection regulator like Spain’s AEPD is, by EU law, structurally independent of government. AESIA is a state agency attached to the ministry (via SEDIA) (Royal Decree 729/2023). That is a deliberate design choice, and it is the structural distinction to keep in mind when comparing AESIA to a DPA.

What AESIA actually does

Spain designed AESIA to be the single national home for AI oversight rather than splitting it across sectoral regulators. Its core functions, per its founding decree:

  1. Supervision of AI systems placed on or used in the Spanish market, with the AI Act’s high-risk category as the priority.
  2. Sanctioning power — where an AI system breaches the rules, AESIA is the body that can act.
  3. Coordination with other national and international authorities — it is Spain’s reference point in the EU AI governance network.
  4. The regulatory sandbox — Spain ran an early AI regulatory sandbox; AESIA is the institutional owner of that work (España Digital, AESIA inaugural event).

AESIA’s role under the AI Act

The AI Act requires every Member State to designate national competent authorities — a notifying authority and a market-surveillance authority — to enforce it on the ground. Spain’s answer is AESIA: rather than handing AI supervision to an existing regulator (the route most countries took), it created a purpose-built agency and got it standing before most of the EU (La Moncloa).

That first-mover status is the reason AESIA is cited so often: it is the concrete reference example of what a national AI authority looks like in practice. For the wider AI Act picture — risk classes, timelines, who else enforces — see the AI Act pillar.

Leadership

AESIA is run by a Presidency and a Governing Board (Consejo Rector), with a Director-General for day-to-day management appointed by the Board on the Presidency’s proposal (Royal Decree 729/2023).

  • Director-General: Alberto Gago Fernández. Appointed by the Governing Board in December 2025. He had worked in the Secretariat of State for Digitalisation and AI since its creation in 2020 and was involved in setting up both the AI regulatory sandbox and AESIA itself (AESIA).
  • Predecessor: Ignasi Belda — AESIA’s first Director, selected from 106 candidates, who launched the agency and ran its June 2024 inauguration (Ministry of Economy, selection process).

What this means for you

  • If you build or deploy AI in Spain: AESIA is the authority that supervises you under the AI Act and can sanction non-compliance — especially if your system is high-risk. It is your national point of contact.
  • If you are comparing EU national AI regulators: AESIA is the benchmark example (first, dedicated, purpose-built) — but note it is a ministry-attached agency, not an independent authority, which is a real difference from how data-protection enforcement is structured.
  • If you want to test an AI system under supervision: Spain’s AI regulatory sandbox sits with AESIA.
  • If you are a journalist or researcher: “Spain’s AI regulator” = AESIA; the founding instrument is Royal Decree 729/2023; the seat is A Coruña; leadership changed in December 2025 (Belda → Gago).

TL;DR

AESIA is the EU’s first dedicated national AI agency — Spain’s authority to supervise and, where needed, sanction AI systems under the AI Act, with high-risk systems the priority. It was created by Royal Decree 729/2023 (22 August 2023), inaugurated in A Coruña on 19 June 2024, and is a state agency attached to the digital-transformation ministry via SEDIA — explicitly not an independent authority. Director-General since December 2025: Alberto Gago Fernández, who succeeded founding director Ignasi Belda.

Sources