Regulatory challenges in implementing artificial intelligence in the Spanish public administration: unequal treatment of the public and private sectors

By Antonio Tejeda Encinas, President

Euro-American Committee of Digital Law - CEA Digital Law

PCDD-Participación Ciudadana. Democracia. Derechos Digitales

In my previous article, ‘Artificial intelligence and the systemic crisis of the Spanish public administration’, I set out a worrying reality: the coexistence of ambitious legislation on artificial intelligence with a Spanish public administration that still faces significant challenges in its digitalisation. Problems of technological obsolescence, lack of interoperability, insufficient digital training among civil servants and poor coordination of competences raise serious doubts about the capacity of the Spanish public sector to implement and manage AI systems effectively and ethically. In this context, the recent proposal to exclude the public administrations (AAPP) from the penalty regime in the Anteproyecto de Ley para el Buen Uso y la Gobernanza de la IA adds a new layer of complexity and potential risk.

That draft bill, approved by the Council of Ministers on 11 March 2025, seeks to establish a regulatory framework for the development and use of artificial intelligence in Spain, adapting national legislation to Regulation (EU) 2024/1689 (Artificial Intelligence Act, or AI Act).

Alignment with the European AI Act Regulation (EU) 2024/1689 establishes a common legal framework for artificial intelligence in the European Union, applicable to both the private and the public sector. The exclusion of the AAPP from the penalty regime in the Spanish draft bill could create discrepancies with the EU framework, since the European regulation does not provide for such exemptions for public administrations. This divergence could lead to conflicts in the application of the rules and to questions about Spain’s compliance with its European obligations.

Specifically:

Impact on regulatory harmonisation within the EU:

The Regulation establishes uniform standards to ensure that all actors, public and private, are accountable for their use of AI. The Spanish exemption could be interpreted as a breach of the principle of equality before the law, weakening European efforts to establish a coherent digital single market. This could lead to infringement proceedings against Spain, brought by the European Commission, for failing to meet the harmonisation requirements laid down in the EU framework.

Penalties for non-compliance:

In similar cases, the European Commission has penalised Member States for failing to adapt their national legislation to European directives. Spain could face fines or budgetary restrictions on funds earmarked for technological innovation if this regulatory exclusion persists.

The lack of an effective penalty regime for the AAPP acts as a ‘carte blanche’ to act without due diligence in the field of AI, which has two main consequences:

Erosion of public trust: The perception that public administrations are exempt from penalties fuels distrust of government institutions and fosters a sense of inequality compared with the private sector, which is subject to strict fines.

Operational risks: Civil servants could prioritise speed over ethics in technological implementations, exacerbating problems such as discriminatory bias or erroneous automated decisions affecting fundamental rights.

If, as argued previously in the earlier article, government algorithms can already display discriminatory bias and the administration suffers from a ‘systemic crisis’ in its digital infrastructure, the absence of financial penalties for the misuse of AI could have even more serious consequences. The possibility that a ministry or a city council might deploy a ‘high-risk’ AI system without the required safeguards, or even a prohibited AI system, with a mere warning as the only consequence, not only represents unequal treatment to the detriment of the private sector but also undermines public trust in the fairness and accountability of the State.

The lack of an effective penalty regime for the AAPP could be interpreted as a ‘blank cheque’ to act without due diligence in the field of AI. If civil servants perceive that errors or bad practice in the use of artificial intelligence carry no financial consequences, the incentive to prioritise ethics, transparency and accountability could be significantly reduced. This situation is particularly worrying given the existing resistance to change and distrust of automated systems shown by some civil servants.

As analysed in the first part, the justifications for this exclusion, based on the ‘unity of the treasury’ or the nature of the ‘general interest’, are weak when set against the principles of equality and accountability. Allowing the State to exempt itself from the penalties that are indeed imposed on citizens and businesses breaks with the basic principle that the law must apply equally to all. Moreover, in a field as sensitive as AI, where errors can affect Fundamental Rights, this regulatory asymmetry could have a direct and harmful impact on people’s lives, exacerbating the social consequences of the ‘algorithmic exclusion’ already observed.

The experience with the exclusion of fines for public administrations in the Ley Orgánica de Protección de Datos (LOPD) and subsequently in the GDPR offers relevant lessons. As noted earlier, this practice has been criticised for creating ‘islands of impunity’ and has generated a perception of double standards. The absence of financial penalties may have reduced the deterrent force of the actions of the Spanish Data Protection Agency (AEPD). It is foreseeable that the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) will face a similar situation if the exclusion from penalties is maintained, limiting its capacity to ‘effectively scrutinise’ the administrations.

Against this backdrop, it is crucial to reconsider the exclusion of the AAPP from the penalty regime in the AI Law. As various associations and experts suggest, it is essential to remove, or at least significantly narrow, this exemption. Establishing equitable accountability mechanisms is essential to guarantee the responsible and ethical use of artificial intelligence in the public sector. This could include:

* Allowing financial penalties for the AAPP, perhaps with reduced caps and with the funds allocated to ethical AI projects or social purposes.

* Implementing effective non-pecuniary penalties, such as the temporary suspension of AI systems, the publication of infringement reports or the withholding of funds.

* Strengthening independent oversight of public-sector AI by AESIA, granting it full powers of control and audit.

* Promoting transparency and public participation in the development and use of AI by the AAPP.

In short, the successful and ethical implementation of artificial intelligence in the Spanish public administration requires a coherent and robust regulatory framework that obliges all actors, both public and private, to be accountable for their actions. Maintaining an exemption from penalties for public administrations, against the backdrop of the systemic weaknesses that already exist, could perpetuate public distrust and undermine the legitimacy of the law itself and of the rule of law. It is essential to establish equitable accountability mechanisms to ensure that the adoption of artificial intelligence in the public sector is carried out transparently, ethically and in accordance with the principles of equality before the law.