Living guide
Which rules apply in Spain today (and which are coming)
The AI Act, GDPR procedure, NIS2, accessibility and invoicing deadlines: what each rule requires, of whom, from when, and where it actually stands. Every row links to the official source and carries the date we checked it.
| Rule | What it requires | Who | Dates | Status | Source |
|---|---|---|---|---|---|
| VERI*FACTU — Spain's invoicing-software regulation (Real Decreto 1007/2023) | The software used to issue invoices must guarantee the integrity, retention, accessibility, legibility and traceability of invoicing records, and once generated they cannot be changed without the system itself detecting it and flagging it (Art. 8, Real Decreto 1007/2023). | Businesses and professionals who invoice with software: corporate-income-tax payers first, then everyone else in scope. Producers and sellers of that software must offer compliant versions since 2025-07-29. | Legal date: 2027-01-01 (corporate income tax) and 2027-07-01 (others) · software producers: since 2025-07-29 | Postponement announced, not yet in the BOE The 2027 dates are set by Real Decreto-ley 15/2025 and remain the legal dates. On 2026-10-05 the Ministry of Finance announced it will postpone the pending obligations to October 2028; as of 2026-10-26 no norm doing so has been published in the BOE. The software producers' obligation (Orden HAC/1177/2024) already applies. |
Verified 2026-10-26 |
| Mandatory B2B e-invoicing (Ley 18/2022 "Crea y Crece", Real Decreto 238/2026 and Orden HAC/1028/2026) | Issue, send and receive electronic invoices between businesses and professionals. The recipient must report full payment or rejection of each invoice to the public e-invoicing solution (Art. 12, Real Decreto 238/2026). | Businesses and professionals, in bands: first those whose turnover exceeded 8 million euros in the previous year. | 2027-10-06 (over 8M€) · 2028-10-06 (others) · 2029-10-06 (status and payment reporting by individuals) | Legal date set Orden HAC/1028/2026 was published in the BOE on 2026-10-05 and entered into force on 2026-10-06, which started the 12-, 24- and 36-month clocks. | Verified 2026-10-26 |
| EU AI Act (Regulation (EU) 2024/1689) — Article 50 transparency obligations | Tell people they are interacting with an AI system and mark synthetic content as artificially generated, among other duties that depend on each party's role. | Providers and deployers of certain AI systems. Which duty falls on whom depends on whether you built the system or use it. | 2026-08-02 · 2026-12-02 (Art. 50(2) marking for generative systems placed on the market before 2026-08-02) | Applies The Digital Omnibus on AI (Regulation (EU) 2026/1744, OJ of 2026-07-24) did not postpone Article 50; it only gave systems already placed on the market until 2026-12-02 for marking. Spain has no law yet setting penalties for breaching it: the draft organic law that would have done so (121/000096) lapsed on 2026-10-06 when parliament was dissolved. |
Verified 2026-10-24 |
| EU AI Act (Regulation (EU) 2024/1689) — high-risk systems | The obligations in Chapter III, Sections 1 to 3, for AI systems classified as high-risk. | Providers and deployers of high-risk systems: Annex III systems and systems built into Annex I products. | 2027-12-02 (Annex III) · 2028-08-02 (Annex I) | Legal date set Dates set by the Digital Omnibus on AI, which pushed back the regulation's original dates. | Verified 2026-10-24 |
| Regulation (EU) 2025/2518 — GDPR procedural rules for cross-border cases | Common rules for data protection authorities handling complaints and investigations about cross-border processing. It governs procedure; it adds no new substantive GDPR obligations. | Supervisory authorities and the parties to those proceedings: complainants, controllers and processors. | 2027-04-02 | Legal date set Its Chapters III and IV will apply to own-initiative investigations opened, and complaints lodged, after 2027-04-02; Chapters V and VI to matters referred for dispute resolution after that date (Art. 36). | Verified 2026-10-24 |
| NIS2 Directive (EU) 2022/2555 — cybersecurity | Cybersecurity risk-management measures and incident reporting for entities in the sectors the directive lists. | Entities in the directive's sectors, by size and activity, once each Member State transposes it. | Transposition deadline: 2024-10-17 | Not yet transposed Spain has not published a transposing law in the BOE. In its answer to the Senate of 2025-12-15, the Government described the draft cybersecurity coordination and governance law as "at an advanced stage"; it never reached the Congreso as a bill before parliament was dissolved on 2026-10-06. |
Verified 2026-10-24 |
| European Accessibility Act — Ley 11/2023, Title I (transposes Directive (EU) 2019/882) | Accessibility requirements for certain consumer products and services, including e-commerce services. | The economic operators placing those products on the market and the providers of those services. Micro-enterprises providing services (fewer than 10 people and up to 2M€ turnover or balance sheet) are exempt from the service accessibility requirements (Art. 3.3). | 2025-06-28 · transition until 2030-06-28 | Applies Until 2030-06-28 providers may keep using products they lawfully used before that date, and service contracts concluded before 2025-06-28 may continue unchanged for up to five years. | Verified 2026-10-24 |
FAQ
- Is VERI*FACTU mandatory yet?
- For producers and sellers of invoicing software, yes: they must offer compliant versions since 29 July 2025. For businesses that invoice, the legal dates are 1 January 2027 for corporate-income-tax payers and 1 July 2027 for everyone else. On 5 October 2026 the Ministry of Finance announced it will postpone the pending obligations to October 2028 (postponement announced, not yet in the BOE): until that change is published in the BOE, the 2027 dates are the ones that count.
- When does B2B e-invoicing become mandatory?
- On 6 October 2027 for those whose turnover exceeded 8 million euros in the previous year, and on 6 October 2028 for everyone else. The clocks started on 6 October 2026, when Orden HAC/1028/2026 entered into force.
- Did the Digital Omnibus postpone Article 50 of the AI Act?
- No. Article 50 has applied since 2 August 2026. For Article 50, the Omnibus only gave generative systems already placed on the market until 2 December 2026 for content marking, and it pushed the high-risk obligations back to 2027 and 2028.
- Has Spain transposed the NIS2 Directive yet?
- No. The transposition deadline passed on 17 October 2024 and, as of 24 October 2026, no transposing law has been published in the BOE. The draft never reached the Congreso before parliament was dissolved on 6 October 2026.
- How often is this page reviewed?
- Each row shows the date we checked it against its official source. We update it when we spot a change in the BOE or the Official Journal that affects it. If a date matters to you, always check the linked source before acting.
Disclaimer
This page is an informational reference compiled from official sources. It is not legal or tax advice and is not a substitute for qualified legal counsel. Dates change: always check the linked source before making a decision.
Where Dekimu fits
No tool makes you compliant with a rule on its own. For privacy paperwork:
Generates your privacy policy, terms, cookie policy and DPA from your company profile. It helps with GDPR paperwork; it is not individualised legal advice.