At the beginning of August 2025, a decisive chapter for artificial intelligence in Europe comes into force. This is Article 5 of the European Regulation on Artificial Intelligence (RIA), which establishes prohibited AI systems, such as those for remote biometric identification in real time in public spaces. This is not science fiction, it is legislation and it comes with a sanctioning regime under its arm.
Although Spain has not yet passed its own AI Law, the Spanish Data Protection Agency (AEPD) has already made its position clear: it will continue to be the competent authority to supervise the processing of personal data, even when it is used by AI systems. And although it does not yet formally have the title of “market surveillance authority” in this matter, the AEPD is already prepared to act in defense of the fundamental right to data protection.
What does this mean for businesses and organizations, whether large, small, or medium-sized? That AI is no longer just a technological opportunity. It is also a legal responsibility. If your company uses or plans to use AI-based tools—from automated customer service systems to data analytics or speech recognition solutions—you need to start taking action.
The AEPD recommends being ready. It's not just about complying when the law comes into full force, but also about being proactive and ensuring that the systems you use comply with current data protection regulations from now on. This involves reviewing suppliers, demanding transparency about how the algorithms you use work, and ensuring that there is no processing of personal data through systems that could be considered high-risk or, worse yet, prohibited.
It is also worth assuming that the demands will not stop there. The AEPD plans to strengthen its internal capacities, which will translate into greater surveillance and possible sanctions for those who ignore its warnings.
Small and medium-sized businesses, as always, are in a delicate position. They don't have the muscle of large corporations, but the law makes no distinction. The key is to act with (human) intelligence before artificial intelligence becomes a legal problem.
Because adapting in time is not an option. It's the difference between taking advantage of AI... or suffering from it.
