First, a clarification that today's headlines are getting wrong: the law has NOT been voted on in Congress. What happened today is that the Council of Ministers approved the bill and the urgent parliamentary process begins. There can still be amendments. But the basic structure is already defined and, above all, the European AI Regulation (the AI Act) is already in force and from 2 August 2026 it will enter full application with its sanctions regime included.

What does this mean for you, running a small business in the Penedès, in Tarragona or anywhere else? That whether or not the Spanish law is published in the Official Gazette, the European AI Act already binds you. The Spanish law only adapts the AI Act into our legal framework and defines who inspects and who sanctions here: AESIA (the Spanish AI Supervision Agency), based in A Coruña.

AESIA has been operating since February 2025 and has full sanctioning authority since 2 August 2025. Today's news is that the Spanish bill sets specific sanctions in domestic law, defines additional prohibited practices (such as sexual deepfakes) and establishes how the different authorities will coordinate.

Why it affects you even if you "only" use ChatGPT

This is the most common confusion: "but I don't build AI, I only use it". The AI Act distinguishes two roles: provider (whoever develops the AI system and brings it to market) and deployer (whoever uses it inside their organisation). The second is you if:

If you do any of these things, you're an AI deployer in the eyes of the law. And you have obligations. Different ones depending on the risk, but they exist.

The four risk categories (and where you fall)

The AI Act classifies AI systems into four levels. Each level has different obligations.

1. Unacceptable risk (prohibited)

Systems that can never be used. If your small business does any of these things, you have to stop today:

2. High risk (strict obligations)

Permitted systems but with strong compliance. Includes:

If you fall here (for example, a consulting firm using an AI system to pre-filter candidate CVs), your compliance burden is serious: documented risk assessment, data governance, technical documentation, activity logs, real human oversight (not just "the approve button"), transparency towards the affected user and a declaration of conformity.

3. Limited risk (transparency)

Where most small businesses using generative AI fall:

The main obligation here is transparency: the user must clearly know they're interacting with an AI or that some content has been generated by AI. There are no draconian fines if you comply with this and, in general, the big AI providers (OpenAI, Anthropic, Google) already make it easy with visible watermarks and metadata.

4. Minimal risk (no specific obligations)

Spam filters, basic recommenders, image generators not aimed at the public. No specific obligations, but the rule requires you to have sufficient "AI literacy" in the team: that the people using these tools understand what they do and what their limits are.

The sanctions: the range that matters

This is where the headlines grab attention: up to €35 million or 7% of worldwide annual turnover, whichever is greater. But you need to understand the range:

For a small business with €500K annual turnover, a minor sanction would be €2,500 (0.5%). It's not catastrophic, but added to the reputational cost and the fact that AESIA can withdraw the AI system from the market provisionally, it's an unnecessary risk.

My message here is simple: small businesses shouldn't worry about the million-euro fines in the headlines. They need to understand which risk category they're in, comply with the corresponding obligations (which are straightforward at limited risk) and document it minimally. The real complication is for high-risk systems, which few small businesses deploy.

The real timeline

The dates that matter:

What you need to do this week (the 5 pragmatic steps)

If you run a small business and use AI in any way, do this before 2 August:

1. A real inventory of the AI in use.

Make a list of all the AI systems your team uses. Include ChatGPT (and at which tier — Free, Plus, Business?), Claude, Gemini, Copilot, lead-scoring tools, image generators, website recommenders, WhatsApp agents, etc. Everyone tends to forget about 30% of what's actually in use.

2. Classify each system into a risk category.

For each one, identify whether it's prohibited, high risk, limited risk or minimal risk. The free diagnostic tool I've built does this classification for you in five minutes.

3. Document the purpose and data of each system.

For each AI, note: what you use it for (specific use case), what data you feed it (especially if it's personal), who supervises its outputs, and how you inform affected users. You don't need a 50-page PDF; a 2-page document per system is enough for most small businesses.

4. Put transparency markers where they're needed.

If you have a chatbot, it has to clearly say it's an AI in the first message. If you publish AI-generated images on your site or social channels, label them. If you use automatic scoring for customers (for example, to decide who gets a proposal first), inform them that there's an automated component and offer human review on request.

5. Train the team (AI literacy).

The AI Act requires that the people using AI understand what these systems do. For a small business, this means a one or two-hour training session explaining how generative AI works, what it can do well and what it can't, what biases it can have and how to review its outputs. You don't need a master's degree — you need to understand the basics.

If you fall under high risk: the conversation is more serious

If your small business has high-risk systems (hiring, credit scoring, healthcare, infrastructure), don't do it on your own. You need a compliance officer or an external consultant to help you set up the risk management system, the technical documentation and the declaration of conformity process. The cost of this compliance is real (between €5K and €20K in consulting for a typical small business), but it's a fraction of what you could pay in fines or in having to withdraw the system.

Why I'm relatively optimistic (but watch out)

The AI Act is the first serious AI regulation in the world and, overall, it's well designed. The risk-tier distinction is sensible: it doesn't put the same burden on someone using ChatGPT to write emails as on someone deciding who gets a mortgage. For most Catalan small businesses using "normal" generative AI, real compliance is manageable: transparency, human oversight, minimal documentation.

But there are three warnings worth remembering:

Official resources

Practical tool: classify your AI in 5 minutes

I've built a free diagnostic tool. You answer six questions about how your company uses AI and it gives you: the risk category you fall into, a concrete list of specific obligations for your case, and a checklist of steps to take before 2 August.

No sign-up, no email, nothing sent to third parties. All processing happens in your browser. You use it, you walk away with the result.

If you fall under high risk or want help documenting your compliance

I don't want to be your permanent compliance officer — that's done better by specialised legal firms. But I can help you set up the initial inventory, classify your systems, put transparency markers where they're needed and run the AI literacy training for your team. Three or four sessions and you've got the foundation in place.

Let's talk for 15 minutes