Andorra: technology regulation at a glance

Framework: Law 24/2022 of 30 June on the digital representation of assets through cryptography, distributed ledger technology and blockchain (in force since 20 October 2022), supervised by the Andorran Financial Authority (AFA); AML/CFT under Law 14/2017 as amended by Law 37/2021.

Crypto and digital assets are fully legal in Andorra and governed by a dedicated, comprehensive statute (Law 24/2022) in force since October 2022. The law sets out token categories, issuance, custody, trading platforms and DeFi, requiring authorization from the Andorran Financial Authority (AFA) with capital, insurance and a registered 'digital overseer' (veedor digital). As a non-EU microstate, Andorra is outside the EU's MiCA regime and operates its own national framework.

Framework: Andorran Code of Ethics for Artificial Intelligence (Government of Andorra, February 2024); Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy, and the Rule of Law (signed 5 September 2024); Digital Transformation Programme (PdTDA) 2024-2027

Andorra has no dedicated domestic AI law or sectoral AI regulation. Its primary operative instrument is a non-binding Code of Ethics for AI adopted by the government in February 2024, providing voluntary principles for the public sector, private sector, and citizens. Andorra also signed the Council of Europe Framework Convention on AI on 5 September 2024, the first international legally binding AI treaty, though ratification and domestic implementation have not yet been confirmed.

Framework: Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (LQPD), in force since 17 May 2022; supervised by the Agència Andorrana de Protecció de Dades (APDA)

Andorra enacted a comprehensive, GDPR-aligned personal data protection law (Law 29/2021, LQPD) in October 2021, which entered into force on 17 May 2022 and replaced the 2003 predecessor law. The law is enforced by the independent APDA (established 2005) and is underpinned by an EU adequacy decision dating from 2010, reconfirmed in a January 2024 European Commission review. Andorra has also ratified the modernised Council of Europe Convention 108+.

Framework: Law 8/2018 of 17 May on payment services and electronic money (the Andorran transposition of EU PSD2 and the E-Money Directive), supervised and licensed by the Andorran Financial Authority (Autoritat Financera Andorrana, AFA), under the EU-Andorra Monetary Agreement.

Andorra has an in-force, dedicated licensing regime for digital payments and e-money. Law 8/2018, modelled on the EU's PSD2 and E-Money Directive, requires payment institutions and electronic money institutions to be authorised by the AFA, and implementing regulations on the legal regime for these entities have been adopted by the Government. Andorra is a participant in the Single Euro Payments Area (SEPA), and open-banking/strong-customer-authentication obligations apply, though the fintech market remains small.

Framework: Llei 42/2022 del 1 de desembre, de l'economia digital, l'emprenedoria i la innovació (Law on Digital Economy, Entrepreneurship and Innovation), implemented by Decret 212/2023 (10 May 2023, in force 17 June 2023); annual quota governed by Decret 124/2025 (2 April 2025); immigration base law Llei 9/2012 as amended

Andorra introduced a dedicated Digital Nomad Residence Permit in 2023 under Law 42/2022, targeting foreign individuals who work entirely via telecommunications for non-Andorran clients without needing a fixed location. The permit requires a minimum monthly income of €3,858, only 90 days of presence per year, and exempts holders from the €50,000 AFA deposit and mandatory Andorran social security contributions. A combined annual quota of 100 authorisations is shared between digital nomads (50 slots) and programme entrepreneurs (50 slots), with cross-category flexibility when one sub-quota is exhausted.

Framework: Llei 29/2021 (LQPD, GDPR-aligned data protection); Llei 42/2022 (Digital Economy, Entrepreneurship and Innovation); 2026 bill amending the Qualified Law on Rights of Children and Adolescents (social media/minors); Agència Andorrana de Protecció de Dades (APDA)

Andorra, a non-EU/EEA microstate, has no comprehensive online safety law equivalent to the EU DSA or UK OSA. Its online regulatory framework is partial: a GDPR-aligned data-protection law (LQPD, 2021) covers personal data and cookie consent; a Digital Economy Law (2022) frames e-commerce activity; and a 2025-2026 legislative initiative specifically restricts social media access for under-16s with mandatory age verification and content filtering. The EU DSA does not apply directly, though a pending EU-Andorra Association Agreement may eventually extend single-market digital obligations.

Framework: Law 22/2022 on Measures for the Security of Networks and Information Systems; National Cybersecurity Agency (ANC-AD); CSIRT-AD

Andorra enacted Law 22/2022 on 9 June 2022, establishing a horizontal cybersecurity framework for networks and information systems aligned with EU NIS Directive 2016/1148. The National Cybersecurity Agency (ANC-AD) acts as the competent authority, overseeing CSIRT-AD for incident response and supervising compliance across critical operators. As a non-EU microstate, Andorra is not directly bound by NIS2 but has voluntarily aligned its 2022 regime with the earlier NIS1 framework.

Framework: Law 5/2025 (Llei Òmnibus, in force April 2025), which repealed and replaced Law 10/2012 on foreign investment; administered by the Department of Legal and Economic Registers, Ministry of Presidency, Economy and Enterprise (Govern d'Andorra)

Andorra permits up to 100% foreign ownership of companies in virtually all sectors, but non-resident investors must obtain prior government authorization whenever their stake exceeds 10% (or collective foreign ownership exceeds 25%). The full formation process, name reservation, foreign investment authorization, bank-account opening, notarial deed, commercial registry, and local comú license, typically takes 2-4 months. The 2025 Llei Òmnibus tightened beneficial-ownership transparency and source-of-funds controls while preserving the liberalized ownership ceiling.