Spain: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) is directly applicable, with national supervision by the CNMV (Comisión Nacional del Mercado de Valores) for CASPs/ARTs market conduct and the Banco de España for stablecoin (ART/EMT) prudential supervision. National rules complement MiCA: Ley 6/2023 de los Mercados de Valores y de los Servicios de Inversión; CNMV Circular 1/2022 on crypto-asset advertising; AML/CFT under Ley 10/2010 (as amended by Real Decreto-ley 7/2021); and tax obligations under Ley 11/2021 (Modelos 172, 173, 721). Crypto is legal as an investment/payment medium but is not legal tender.

Spain treats crypto-assets as a legal, fully regulated activity built on the EU MiCA Regulation, which has applied to stablecoins since 30 June 2024 and to CASPs since 30 December 2024. The CNMV is the lead competent authority for CASP authorisation, market conduct and advertising, while the Banco de España supervises ART/EMT issuers. A national transition (grandfathering) period for incumbent providers registered with the Banco de España before 30 December 2024 runs until 30 June 2026, after which a 'comply or quit' regime applies — only MiCA-authorised firms may operate.

Framework: EU AI Act (Regulation (EU) 2024/1689), directly applicable in Spain, with AESIA as national supervisory authority; national implementing bill (Anteproyecto de Ley para el buen uso y la gobernanza de la IA) still in the legislative pipeline.

As an EU member state, Spain is governed by the directly-applicable EU AI Act (Regulation (EU) 2024/1689), which is in force and phasing in (prohibited practices since 2 Feb 2025, GPAI obligations since 2 Aug 2025). Spain was the first EU country to create a dedicated AI supervisory agency, AESIA, operational since 2024, and the first to launch an AI regulatory sandbox. A national law to implement the Act's governance and sanctioning regime was approved as a draft bill by the Council of Ministers in March 2025 but, as of mid-2026, remains in process and not yet enacted.

Framework: EU GDPR (Regulation 2016/679) as implemented nationally by Organic Law 3/2018 (LOPDGDD) on the Protection of Personal Data and Guarantee of Digital Rights; supervised by the Spanish Data Protection Agency (AEPD).

As an EU member state, Spain applies the GDPR directly, supplemented by the national LOPDGDD (Organic Law 3/2018, in force since December 2018), which adapts the GDPR and adds a charter of digital rights. The Agencia Española de Protección de Datos (AEPD) is the lead national supervisory authority, complemented by three regional authorities for their public sectors. The AEPD is consistently among the EU's most active enforcers by volume of sanctions.

Framework: Royal Decree-Law 19/2018 (PSD2 transposition) and Royal Decree 736/2019 for payment institutions; Law 21/2011 + RD 778/2012 for electronic money institutions; supervised by Banco de España. EU MiCA (Reg. 2023/1114) for crypto-assets, with CNMV as lead competent authority and Banco de España for EMT/ART issuers.

Spain operates a mature, EU-aligned licensing regime for digital payments and fintech. Banco de España authorizes and supervises payment institutions and electronic money institutions under PSD2 (transposed by Royal Decree-Law 19/2018 and RD 736/2019) and EMD2 (Law 21/2011), while the CNMV licenses crypto-asset service providers under MiCA. Open banking, strong customer authentication, a statutory regulatory sandbox (Law 7/2020) and the directly-applicable EU Instant Payments Regulation are all in force; BNPL becomes formally regulated as the CCD2 national transposition takes effect (by 20 November 2026).

Framework: Ley 28/2022, de 21 de diciembre, de fomento del ecosistema de las empresas emergentes (Startup Law), amending Ley 14/2013; administered by Unidad de Grandes Empresas y Colectivos Estratégicos (UGE-CE), Ministry of Inclusion, Social Security and Migration

Spain introduced a dedicated Digital Nomad Visa ('Visado/Autorización de Residencia para Teletrabajo de Carácter Internacional') under Law 28/2022, in force since January 2023, allowing non-EU/EEA remote workers to live in Spain while employed by or freelancing for companies based primarily abroad. The visa offers a pathway to long-term residency and includes access to a preferential flat 24% income-tax rate under the Special Expatriate Tax Regime (Beckham Law). Spain's separate Golden Visa (residency-by-investment) was formally abolished in April 2025.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065, directly applicable since 17 Feb 2024) as the baseline online-safety/content-moderation regime, complemented nationally by the Audiovisual Communication Law (Ley 13/2022) and the LSSI-CE; the CNMC is the designated Digital Services Coordinator. National DSA implementing legislation and a dedicated minors-protection organic law remain pending.

As an EU member state, Spain is bound by the directly-applicable Digital Services Act, a comprehensive content-moderation and online-safety regime that already imposes notice-and-action, transparency, illegal-content and minor-protection duties on platforms operating in Spain. However, Spain has not completed its national implementation: the CNMC was designated Digital Services Coordinator in January 2024 but Congress has repeatedly failed to pass the law granting it the inspection and sanctioning powers the DSA requires, prompting a European Commission infringement procedure. A pioneering Organic Law for the Protection of Minors in Digital Environments (raising the social-media age and mandating age verification) has been approved as a government bill but is still being debated in Congress and is not yet in force.

Framework: Real Decreto-ley 12/2018 (transposing the NIS Directive) and its implementing Real Decreto 43/2021, plus the Esquema Nacional de Seguridad (Real Decreto 311/2022) for the public sector; partial NIS2 transposition via Real Decreto-ley 7/2025. Competent authorities: INCIBE-CERT (private sector), CCN-CERT (public sector/National Cryptologic Centre, CNI), and ESPDEF-CERT (defence). The full NIS2 law (Ley de Coordinación y Gobernanza de la Ciberseguridad) is still in the legislative process.

Spain already has a comprehensive, horizontal cybersecurity legal framework in force: RDL 12/2018 (transposing the 2016 NIS Directive) with RD 43/2021, the public-sector National Security Scheme (RD 311/2022), and a partial NIS2 transposition via RDL 7/2025. The full NIS2 transposition, the draft Ley de Coordinación y Gobernanza de la Ciberseguridad approved by the Council of Ministers on 14 January 2025, remains pending parliamentary approval as of 2026, and the European Commission issued a reasoned opinion against Spain in May 2025 for missing the 17 October 2024 deadline. Mandatory incident-reporting and breach-notification duties already apply under the in-force instruments.

Framework: Ley de Sociedades de Capital (RDL 1/2010); Ley 18/2022 'Crea y Crece' (minimum capital reform); Ley 28/2022 (Startup Law); Royal Decree 571/2023 (FDI screening); CIRCE/PAE digital registration system, supervised by Registro Mercantil, Agencia Tributaria, and ICEX/Invest in Spain

Spain permits 100% foreign ownership in most sectors with no local-partner requirement, and recent legislative reforms (Law 18/2022 and the 2022 Startup Law) have cut the minimum share capital for an SL to €1 and reduced core registration to as little as 72 hours via the online CIRCE/PAE system. The principal friction for non-EU founders is obtaining the NIE (foreigner identification number), which can take 1-4 weeks, and prior authorisation is required only for acquisitions in defined strategic sectors under Royal Decree 571/2023.