If you are innovating with AI … Congratulations, this post is for you.
AI strategy in 2026 will not be about "using AI". It will be about governing it without losing speed.
The publications of the Spanish Data Protection Agency (AEPD) and AESIA (Spanish Agency for the Supervision of Artificial Intelligence) put an end to the "let's try it and see" phase.
If you are a CEO, DPO, or lead a public administration, and your strategy is to work with AI this week (December 9-11), this has been an unavoidable turning point.
The publication of the AEPD's Generative AI Policy alongside AESIA's new Guides is not just paper; it is the directive that defines regulatory compliance in Spain and the EU. The regulatory message is clear: AI stops being a "cool tool" and becomes a high-risk asset subject to Multilevel Governance.*
The era of trial and error without consequences is over.
⚖️ The AEPD and AESIA require three pillars of mandatory compliance:
1. Data Quality: A Legal Obligation (the heart of the AEPD) The Spanish Data Protection Agency (AEPD) stresses that there is no lawful AI without lawful data. The famous Article 10 of the AI Regulation (AI Act) takes shape: the quality of the training dataset (its relevance, representativeness, and freedom from bias) is now a legal requirement. If a system fails due to biased data, the responsibility is yours.
👉 Legal Advice: If you use external models, you must have very clear contractual guarantees that your corporate data is not used to retrain the provider's general model.
2. Human Oversight: Control Is Not Optional. AESIA is emphatic about the Human-in-the-loop concept. Supervision cannot be a mere formality to get by. They require real intervention mechanisms. A competent human must validate critical decisions produced by the system (staff evaluations, risk scoring, etc.).
3. The Terms of Use Trap (Goodbye to IP): The Code of Use for Generative AI published this week exposes the risk from providers. Accepting their terms without reading the fine print often means surrendering the Intellectual Property of your input.
👉 Risk Strategy: It is urgent to move from "free" or standard accounts to Enterprise models or sovereign architectures (on-premise or private cloud). Confidential information should not be put at risk to save a few euros.
From Adoption to Good Governance
Companies that take these guidelines seriously and integrate Compliance from the design stage (Privacy by Design) will not only avoid million-euro fines; they will differentiate themselves as trustworthy actors in an increasingly skeptical market.
📚 Official Reference Sources (Update December 9-11, 2025):
- Spanish Data Protection Agency (AEPD): General Policy for the Use of Generative AI.
- Spanish Agency for the Supervision of AI (AESIA): Governance and Conformity Assessment Guides.
- Public Sector and AI Observatory (OSP-IA): Code of Use of Generative AI (Provider Conditions).
In what phase of this transformation is your organization with its AI strategy? Share your opinion.
Comments (4)
Log in to your Scrum Manager area to comment
Marc Torrente Cesteros
16 Dec 2025 14:13Interesting
Interesante
Automatic translation · View original
Guest
16 Dec 2025 15:42The use of AI needs to be adapted to regulation, just as the GDPR was back in its day, but on steroids, applying an SGIA, specifically ISO 42001, in line with what the regulation dictates, as you can see in the post they're working on to take effect in 2026, under the 2030 plan.
The rules of the game must follow what the law sets out. But ..... very interesting and with a lot to do.
Don't you think, Marc?
Hay que adaptar el uso de la IA a la normativa como en su día el RGPD, pero con esteroides, aplicando SGIA en concreto ISO 42001, a lo que dicta la normativa, tal y como estáis vieyen el post que están avanzado para ponerlas en activo en 2026, en el plan 2030.
Las reglas del juego deben seguir lo que marca la ley. Pero ..... muy interesante y con mucho que hacer.
¿No crees Marc?
Automatic translation · View original
Raul Morales Galisteo ★
17 Dec 2025 07:38Dear Jorge Sánchez, I appreciate the strategic information you share. Your analysis marks a before and after: in 2026, AI will no longer mean "using technology" but governing it with rigor and speed. The way you lay out the pillars of the AEPD and the AESIA—data quality, human oversight, and management of contractual risks—is a forceful reminder that the era of trial and error is over.
This message is a direct call to CEOs, DPOs, and public leaders: building compliance into design from the start is not optional; it is the only path to distinguishing yourselves as trustworthy players in an increasingly demanding market.
Thank you for putting on the table what many still avoid: AI without governance is a systemic risk. The challenge now is to move from discourse to action.
Thanks again, Jorge, for sharing such a clear and valuable vision; your contribution inspires us to turn AI strategy into concrete and responsible action.
Estimado Jorge Sánchez, agradezco la información estratégica que compartes. Tu análisis marca un antes y un después: la IA en 2026 ya no será “usar tecnología”, sino gobernarla con rigor y velocidad. La forma en que expones los pilares de la AEPD y la AESIA —calidad del dato, vigilancia humana y gestión de riesgos contractuales— es un recordatorio contundente de que el periodo de prueba y error terminó.
Este mensaje es un llamado directo a CEOs, DPOs y líderes públicos: integrar compliance desde el diseño no es opcional, es la única vía para diferenciarse como actores de confianza en un mercado cada vez más exigente.
Gracias por poner sobre la mesa lo que muchos aún evitan: la IA sin gobernanza es un riesgo sistémico. El reto ahora es pasar del discurso a la acción.
Gracias nuevamente, Jorge, por compartir una visión tan clara y valiosa; tu aporte inspira a transformar la estrategia de IA en acción concreta y responsable.
Automatic translation · View original
Jorge Sánchez López ★★★
17 Dec 2025 22:52Thank you for the feedback. I agree with you on the diagnosis, but I'd like to refine one key point from a critical thinking perspective.
We are not facing a conceptual debate or an "inspiring vision" about AI. We are facing regulatory criteria already published by AEPD and AESIA that change the rules of the game. From here on, not acting is not a strategic option: it means knowingly assuming risk.
The problem I still see in many organizations is not a lack of talk, but the gap between technological ambition and governance maturity. People talk about innovation, but they don't know:
what data trains or feeds the systems,
who is accountable when the AI makes a mistake,
or what has been ceded by accepting certain terms of use.
And that is where governance stops being "compliance" and becomes executive leadership.
Moving from talk to action does not mean slowing AI down; it means putting brakes, a steering wheel, and accountability in place, just as we did in the past with finance, risk, or cybersecurity. Organizations that don't understand this now won't have a technical problem; they'll have a management problem.
Thank you for the exchange. These kinds of conversations—clear, uncomfortable, and grounded in facts—are the ones that truly move strategy.
Gracias por el feedback. Coincido contigo en el diagnóstico, pero me gustaría afinar un punto clave desde el pensamiento crítico.
No estamos ante un debate conceptual ni ante una “visión inspiradora” sobre la IA. Estamos ante criterios regulatorios ya publicados por AEPD y AESIA que cambian el marco de juego. A partir de aquí, no actuar no es una opción estratégica: es asumir riesgo consciente.
El problema que sigo viendo en muchas organizaciones no es la falta de discurso, sino la asimetría entre ambición tecnológica y madurez de gobierno. Se habla de innovación, pero no se sabe:
qué datos entrenan o alimentan los sistemas,
quién responde cuando la IA se equivoca,
ni qué se ha cedido al aceptar unos términos de uso.
Y ahí es donde la gobernanza deja de ser “compliance” para convertirse en dirección ejecutiva.
Pasar del discurso a la acción no significa frenar la IA; significa ponerle frenos, volante y responsabilidad, igual que hicimos en su día con finanzas, riesgos o ciberseguridad. Las organizaciones que no lo entiendan ahora no tendrán un problema técnico, tendrán un problema de gestión.
Gracias por el intercambio. Este tipo de conversaciones —claras, incómodas y basadas en hechos— son las que de verdad mueven la estrategia.
Automatic translation · View original