By Design and by Default: The AEPD’s Approach to AI

In recent weeks, the Spanish Data Protection Agency has issued three warnings to a private company and two municipal governments regarding the implementation of AI systems. None of these are penalties. The warnings were issued before the systems went live.

Taken together, they make clear what the AEPD expects from any organization—public or private—that plans to use artificial intelligence with data from customers, employees, or job candidates. In this newsletter, we analyze each case individually.