Sovereign AI Race: Spain (2026)
Updated: 5 hours ago
In this Report
This publication is part of the Sovereign AI Race series.
The Co-Intelligence-First (CI-First) approach is a genuine and unique University 365 concept: a proposal for imagining a better future where AI and Human Intelligence coexist productively, each amplifying the other rather than replacing it.
Sovereign AI Race: Spain (2026)
The Context
The five layers, and why Spain is the regulator that must also host
The five layers assessed. A public model and a public supervisor above a foreign-owned compute perimeter. University 365 Research Center.
This is the fourteenth report in a twenty-part series assessing how states attempt to control the production of artificial intelligence inside their own jurisdiction. The framework is fixed and applied identically to every country. Sovereign AI capacity separates into five layers, and a state can hold any one of them without holding the others.
Compute sovereignty is the physical layer: where the chips and data centres sit, and who may switch them off. Model sovereignty is who builds the models a country depends on, and in whose languages and domains those models are competent. Capital sovereignty is who funds the build-out and on what terms. Regulatory sovereignty is who writes the rules and whether they can be enforced. Talent and education sovereignty is who builds and runs the systems, and how the next generation is prepared.
The series treats three races as running at once: the compute race, the model race and the rules race. Spain is the country where the three are most cleanly separated between different owners. Its public sector built the model: ALIA, trained entirely on public money and public supercomputing, released openly, verified by the national supervisor. Its private sector hosts the compute: two American hyperscalers have committed more than forty billion euros between them, overwhelmingly in one inland region. And its rules race is run through Brussels as much as through Madrid, because the binding instrument is the European Union's AI Act and Spain's own statute is still a bill.
The series places Spain in the "regulator and host" posture alongside Singapore, the United Kingdom, Germany, Italy, Portugal and Bahrain. The placement is a claim to be tested layer by layer, and this report tests it. Spain owns a genuine public model infrastructure, one of the first seven European AI factories, a supervisory agency that was first in the Union, and one of Europe's strongest research bases in Barcelona. It does not own the largest compute build-out on its own soil, it passed its own AI law to a parliament that has not yet voted on it, and its supervisory agency spent two years at less than half its promised strength. The report's question is what regulatory sovereignty means when the regulator exists, the sandbox has run, the guidelines are published, and the enforcement statute has not passed.
The vocabulary this report needs
Five terms recur, and they are defined here once.
AESIA. The Spanish Agency for the Supervision of Artificial Intelligence, created by the Startups Law (Ley 28/2022) and given its operating statute by Real Decreto 729/2023 of 22 August 2023, making Spain the first European Union member state with a body dedicated to AI supervision. It is headquartered in A Coruna, designated as the national competent authority for EU AI Act enforcement, and it published sixteen practical compliance guides in December 2025. Its staffing history is part of this report: about thirty of eighty promised posts were filled as of August 2025, with a doubling planned for December 2025 and the eighty-post target spread through 2026.
ALIA. Europe's first public, open and multilingual AI infrastructure, announced by the prime minister on 21 January 2025 and coordinated by the Barcelona Supercomputing Center. Its flagship model, ALIA-40B, is a forty-billion-parameter multilingual foundation model trained on MareNostrum 5 on 9.37 trillion tokens across 35 languages, with 20 per cent representation for the languages of Spain: Spanish, Catalan and Valencian, Basque and Galician. It is 100 per cent publicly funded, verified by AESIA, and published on Hugging Face under an Apache 2.0 licence. It descends from the Catalan AINA project and the Salamandra family of models that BSC trained from scratch.
MareNostrum 5. The EuroHPC pre-exascale supercomputer hosted at BSC in Barcelona, built by Bull SAS (Eviden) with Intel, Lenovo and NVIDIA technology, quoted at 314 petaflops of peak performance at a total investment of 223 million euros. An AI upgrade was awarded in January 2026 at 129 million euros, half funded by the EuroHPC Joint Undertaking and half by a consortium of Spain, the Generalitat de Catalunya, Portugal and Turkey, with a contract signed with a consortium led by Fsas Technologies and Telefonica. The upgrade's target capacity is not stated in the sources this report could verify, and it is not claimed here.
The RD Sandbox. The regulatory sandbox created by Royal Decree 817/2023, the first European regulatory sandbox for artificial intelligence, in which twelve projects tested high-risk AI systems inside a supervised environment. The government concluded it successfully at a closing event on 12 June 2026. Its outputs fed into Spain's national implementation work and into the EU-level debate on how compliance is to be practised.
The Organic Law on AI. The Proyecto de Ley Organica para el buen uso y la gobernanza de la inteligencia artificial, approved by the Council of Ministers on 26 May 2026 and sent to the Congress of Deputies as bill 121/000096. It adapts Spanish law to the EU AI Act, designates the competent authorities, regulates controlled testing environments and requires AI-generated content to be labelled, with fines reported up to 35 million euros or 7 per cent of worldwide turnover for prohibited practices. The amendment period closed on 30 June 2026 and the bill remained in committee as of the sources this research could verify. It is not law, and the difference between it and the EU obligations already applying is the single most important distinction in this report.
Sovereign AI Race: Spain (2026)
The Question
Can a state be the Union's best supervisor when its own statute is still a bill?
Spain has made a specific and unusual bet, and it deserves to be described as a bet rather than as a delay. Instead of waiting for its national AI law, it built the institutions first: an agency with a statutory basis created in 2022 and 2023, a sandbox under a royal decree, a compliance guide set, a designated national competent authority for the European framework, and a public model that its own supervisor verifies. When its national law finally passes, it will land on machinery that has already been running, in the same sequence Brazil chose and the opposite of the sequence the European Union itself followed.
That bet is testable in three ways. An agency that exists should be enforcing something, or the gap between its architecture and its activity is the story. A sandbox that concludes should leave a measurable trace in the rules or the market. And a public model should be used by the public sector that paid for it, or it is an assertion rather than infrastructure.
The evidence this report assembles tests each of those, and the answers are specific. On enforcement, AESIA published guidance, coordinates with the European AI Office's first inspection wave in September 2026, and had not exercised sanctioning power or audited a critical system in its first two years according to press assessments; the sanctioning power itself waits on the Organic Law, and the fines the press reports with the bill are the fines of a bill. On the sandbox, twelve projects tested systems and the government describes the outputs as practical compliance that fed the national and European debates, which is real and is the kind of value a sandbox produces. On the public model, ALIA is genuinely open, genuinely multilingual and genuinely public, and the country's largest AI deployments by volume are still built on foreign models by foreign hyperscalers in Aragon.
So the question this report asks is not whether Spain can build sovereign AI capacity. At the model layer it already has, more convincingly than most countries in this series. The question is whether an agency, a sandbox and a model can substitute for an enforcement statute during the years in which AI systems are actually being deployed, and what a state's authority looks like when its most powerful rules come from Brussels, its largest compute investment comes from Seattle and Virginia, and its own law is one committee vote away from being real.
Sovereign AI Race: Spain (2026)
The Contradiction
The country that supervises AI best has the least power to stop it
Pedro Sanchez, Prime Minister of Spain, as of 2026. His government approved the Artificial Intelligence Strategy 2024, announced ALIA in January 2025, and sent the Organic Law on AI to Congress on 26 May 2026, where it remains. Photograph: La Moncloa, Attribution, via Wikimedia Commons.
Here is the paradox, stated as plainly as the evidence allows.
Spain created the first dedicated AI supervision agency in the European Union. It ran the Union's first AI regulatory sandbox. It published sixteen compliance guides in a single day. It hosts one of the first seven European AI factories and trained the first public multilingual foundation model in Europe on public hardware with public money. On any structural measure, the country's supervisory architecture is the most granular in the Union. And almost none of it is in force, because the Organic Law that would give the agency its full sanctioning regime was approved by the Council of Ministers on 26 May 2026, closed its amendment period on 30 June, and has sat in committee since, while the obligations that bind Spanish companies in the meantime come from a European regulation interpreted through national institutions that are still building their capacity.
That is the first tension, and the numbers behind it are unglamorous. AESIA had about thirty staff against eighty promised posts in August 2025. In the same year the largest AI-adjacent data protection fine in the country, 10,043,002 euros against the airports operator AENA for a biometric facial recognition assessment failure, was issued by the data protection authority, not the AI agency, under the data protection framework, not the AI one. The most consequential Spanish AI enforcement to date has come from a regulator that predates the AI Act entirely, applying a law written for a different purpose. That is not a failure of AESIA; it is a portrait of where the binding rules actually live.
The second tension is ownership of the physical layer. Spain's compute build-out is the largest in Southern Europe and it is not Spanish. Amazon has committed 33.7 billion euros to Spain, raised by a further 18 billion euros announced at MWC in March 2026, and Microsoft has committed around 6.7 billion euros. Almost all of it is in Aragon, an inland region that has become one of the densest data centre clusters in Europe, with Bloomberg framing the pipeline at 90 billion dollars in April 2026. The state's own instruments in the same period are measured in tens of millions by comparison: 719 million euros approved for the Mora la Nova gigafactory bid, 300 million euros authorised for the EuroHPC contribution, 120 million euros for the Generation IA talent programme, 14 million euros added for BSC model training in July 2026, 62.1 million euros for a photonic chip pilot line. The country that will supervise the AI systems has, in capital terms, rented its compute from the jurisdictions that own the models.
The third tension is the one Spain shares with every European state in this series and states more clearly than most: the rules race is run in Brussels while the compute race is run in dollars. The Digital Omnibus on AI, Regulation (EU) 2026/1744 published on 24 July 2026, deferred high-risk obligations to December 2027 and August 2028 and framed the deferral as necessary because the standards and authorities were not ready. Spain presented the omnibus as an achievement of Spanish leadership, and the presentational claim is the government's own framing rather than an established fact. What is not in dispute is the substance: the Union moved its own deadlines, and the member state with the most elaborate supervisory architecture is one of the states that needed the time.
And the fourth tension runs through the model layer, where the country's genuine achievement has a boundary. ALIA is real, open, multilingual and public. It is also, on the evidence available, below the strongest proprietary frontier models on general benchmarks, which is exactly what a forty-billion-parameter publicly trained model should be expected to be. Spain built a serious public model at public scale for public languages, and the firms and administrations that use AI at volume still run mostly on models owned elsewhere, with the country's own market analysis describing Spanish as an opportunity rather than an asset already captured. The achievement and the boundary are both facts, and this report keeps them together.
Sovereign AI Race: Spain (2026)
The Current State
Compute: a European pre-exascale machine, a billion-euro upgrade, and forty billion euros of foreign compute in one region
Barcelona. The city hosts MareNostrum 5 and the BSC AI Factory, one of the first seven European AI Factories, and the country's public model was trained there on public hardware. Photograph: Pexels License, via Pexels.
Spain's compute position has a public core and a private perimeter, and the report keeps them separate because their owners are different.
The public core is real. MareNostrum 5 at the Barcelona Supercomputing Center is a EuroHPC pre-exascale machine hosted in the Torre Girona chapel complex, built by Bull SAS, now Eviden, combining Bull Sequana and Lenovo architectures in two partitions: a general-purpose partition of 6,480 Intel Sapphire Rapids nodes with 725,760 cores, and an accelerated partition of NVIDIA Hopper GPUs, quoted at 314 petaflops of aggregate peak performance for a total investment of 223 million euros funded by EuroHPC and the Spanish government. The BSC AI Factory, selected on 10 December 2024 as one of the first seven EuroHPC AI Factories in a consortium of Spain, Portugal, Turkey and Romania, started operating on 1 April 2025. In January 2026 the Ministry announced the award of the MareNostrum 5 AI upgrade at 129 million euros, half from EuroHPC and half from the Spain-Generalitat-Portugal-Turkey consortium, with the Generalitat de Catalunya contributing 60 million euros, contracted to a consortium led by Fsas Technologies and Telefonica. In July 2026 the government approved a further 14 million euros for BSC to train advanced AI models. There is one number in this section the report flags rather than asserts: the prior U365 report of March 2025 described MareNostrum 5 as having reached over 450 petaflops. The sources available to this research state 314 petaflops, and the AI upgrade's post-upgrade target capacity could not be verified. The two figures are stated as a conflict rather than reconciled.
The private perimeter is the largest in Southern Europe and it is foreign-owned. Amazon announced 15.7 billion euros for Spain in May 2024 and raised the commitment by 18 billion euros at MWC Barcelona in March 2026, taking the total to 33.7 billion euros, about 40 billion dollars, with the Aragon president calling it the best economic news for the country in decades. Microsoft's Aragon programme moved from 2.1 billion dollars in February 2024 to 2.2 billion euros in June 2024 and to 6.69 billion euros in June 2025. Bloomberg framed the wider pipeline at 90 billion dollars in April 2026 and documented the local divisions the build-out has produced. Alongside the hyperscalers sit domestic and European operators: Azora committed 2 billion euros to a Zaragoza data centre with a 150 megawatt connection expandable to 300 megawatts, Calatorao's 220 kilovolt substation entered construction in March 2025 to serve new industrial consumers including data centres, and the Barcelona-Bilbao long-haul cable route was completed on 26 August 2026, cutting cross-Spain latency by 52 per cent and linking the Mediterranean landings at Barcelona, where the 2Africa cable lands, to Atlantic systems at Bilbao.
The energy layer is where Spain's compute story becomes distinctive. The country's renewable-heavy electricity mix and its grid-connection reforms have made it one of the more attractive European destinations for power-hungry compute, and the build-out is visibly anchored to specific grid assets: the Calatorao substation in Zaragoza entered construction in March 2025 to serve new industrial consumers including data centres, and Azora's Zaragoza campus carries a 150 megawatt connection expandable to 300 megawatts. One instrument could not be verified and is not asserted: a Royal Decree requiring hourly-matched renewable supply for data centres above one megawatt. It circulates in the dossier and in commentary; its final status was not confirmed in this research window.
Capital: state instruments in the tens and hundreds of millions against private commitments in the tens of billions
The office, the queue, and the stamp that has not been used. University 365 Research Center.
Spain funds AI through a layered state apparatus and a deep private market, and the gap between the two is the section's finding.
The historic baseline is ENIA, the National Artificial Intelligence Strategy presented on 2 December 2020 with 600 million euros for 2021 to 2023, and updated by the Artificial Intelligence Strategy 2024 approved on 14 May 2024. One correction travels with this report because the prior March 2025 report carried the number: the 600 million euros belongs to ENIA's 2021-2023 envelope announced in December 2020, not to a current fund, and the Estrategia de IA 2024 does not itself carry a headline 1.5 billion euro figure in the sources this research could verify. Both numbers are handled with their dates and their documents.
The state's current instruments are specific. The Council of Ministers approved 719 million euros of public contribution to the Catalan AI gigafactory project at Mora la Nova in Tarragona on 16 June 2026, with a 300 million euro EuroHPC contribution authorised alongside it, structured as a public-private consortium with Multiverse Computing as technology partner and reported participation by Santander, ACS and Telefonica, awaiting the European Commission's gigafactory call. The state is also a direct shareholder in AI companies and now holds board seats: up to 166.2 million euros committed to Multiverse Computing across two rounds with a monitoring director placed on the board, against the 70 million dollar investment reported in March 2025, and participation in Sherpa.ai's 2026 round. The venture layer runs through COFIDES, whose FOCO fund committed 80 million euros to Cathay Innovation Fund III in July 2025, and through the ICO-Red.es Accelerate initiative. FAPESP's Spanish equivalent is the CDTI, whose AI-specific Neotec allocations could not be verified and are not asserted here.
The private market is where the numbers change scale. Spanish startups raised 3.1 billion euros in venture capital in 2025, with AI the most-funded sector at 717 million euros by Dealroom's count, and AI-native startups raising about 442 million euros across 39 deals, close to eight times the prior year by Sifted's count. Multiverse Computing, the quantum and AI software company, raised 570 million dollars at a 1.7 billion dollar valuation in July 2026. Theker, in Barcelona, raised 85 million euros in June 2026. Luzia closed a 13.5 million dollar round in May 2025. The comparison the series can now draw is precise: the state's largest single AI commitment, the gigafactory contribution at 719 million euros, is roughly two per cent of Amazon's Spanish commitment alone, and the country's entire 2025 AI venture market is smaller than a single hyperscaler's annual capital expenditure in the country.
Models: a genuinely open public model, built on public hardware, in the languages of Spain
The Alhambra, Granada. The University of Granada and Amazon created a joint Chair in AI and Computing in May 2025, and Andalusia is one of the regions where the country's adoption gap between large firms and small ones is most visible. Photograph: Pexels License, via Pexels.
Spain's model layer is the strongest public model story in this series outside China's state-directed open weights, and its boundaries are as clear as its achievements.
ALIA-40B is the flagship: forty billion parameters, trained on MareNostrum 5, 9.37 trillion tokens, 35 languages, 20 per cent representation for the languages of Spain, 100 per cent publicly funded, verified by AESIA, and published as BSC-LT/ALIA-40b on Hugging Face under Apache 2.0. Its lineage is the part that matters for anyone trying to copy the model: the Spanish Language Technologies Plan began in 2019, the Catalan AINA project built the corpora and models beneath it, and BSC trained the Salamandra family of open decoder-only models in 2B, 7B and 40B sizes from scratch with a published technical report. None of it was improvised in 2025. The public chain, from a language technology plan to a pre-exascale machine to an openly licensed model, took six years.
The performance boundary is stated honestly in the sources and this report repeats it. ALIA-40B sits below the strongest proprietary frontier models on general benchmarks while being a leading open multilingual system for Spanish and the co-official languages. That is the correct outcome for a forty-billion-parameter publicly funded model trained on a single European public machine, and it is the reason the country's AI users at volume still run on models owned elsewhere. The report's own framing of the Spanish language opportunity matters here: Spanish is conventionally described as the second language of the internet on speaker-count bases, and the underlying metric varies by tracker. The opportunity is real and the capture is incomplete.
Around the public core sits a European frame and a Catalan stack. Spain participates in OpenEuroLLM through BSC among twenty European institutions and supercomputing centres, and in the wider EuroLLM research base, though the exact Spanish organisational list could not be verified in full and is not asserted. Catalonia's Projecte Aina and the Catalan-language corpora feed both ALIA and the region's own strategy, and the Catalan government announced a 1,000 million euro AI strategy to 2030 in late 2025. The private Spanish laboratories that would make the country a model player beyond the public layer are not assembled in this research window into a comparably strong finding, and the report says so rather than compiling a list.
Regulation: the first supervisor, the first sandbox, and a law still in committee
Spain's regulatory position is the most developed architecture in this series and the clearest example of an enforcement gap that is structural rather than accidental.
Three layers are in force or applying. First, the European framework: the AI Act's prohibited practices have applied since 2 February 2025, general-purpose model obligations since 2 August 2025, and Article 50 transparency obligations for AI-generated content from 2 August 2026; the Digital Omnibus on AI, published in the Official Journal as Regulation (EU) 2026/1744 on 24 July 2026, deferred the standalone high-risk obligations to 2 December 2027 and August 2028. Second, AESIA's institutional layer: created in 2022 and given its operating statute in 2023, designated the national competent authority, led from 19 December 2025 by Alberto Gago after Ignasi Belda, and publishing sixteen practical AI Act compliance guides on 16 December 2025. Third, the data protection layer: the AEPD fined the airports operator AENA 10,043,002 euros in a decision dated 26 November 2025 for a data protection impact assessment failure connected to biometric facial recognition, published in the official bulletin in March 2026, and reported the first sanction for AI-generated images in November 2025. Every AI project in the country operates under three overlapping frameworks, and only two of the three are enforced by the agencies created for the purpose.
Against those layers, the national statute waits. The draft Organic Law was approved by the Council of Ministers on 26 May 2026 and sent to Congress as bill 121/000096; the amendment period closed on 30 June 2026; and the bill remained in committee as of the analysis available to this research. Its reported content is substantive: adaptation of Spanish law to the EU regulation, designation of competent authorities with AESIA as coordinator and arbiter alongside sectoral authorities, regulation of controlled testing environments, a requirement that AI-generated content be labelled, two prohibitions additional to the European text, and fine tiers reported at up to 35 million euros or 7 per cent of worldwide turnover for prohibited practices. One distinction must be stated plainly because it is routinely conflated: the labelling duty that applied from August 2026 is the European transparency obligation, not the Spanish law. The Spanish law has not passed. The most recent assessment the research could verify is that the country's supervisory architecture is the most granular in the Union and almost none of it is in force.
Two further instruments complete the picture. The RD Sandbox under Royal Decree 817/2023 took twelve projects through supervised testing of high-risk systems and was concluded by the government at a closing event on 12 June 2026, with the outputs described as practical compliance that fed the national implementation and the European debate. And the informal layer is real: multiple outlets reported in July 2026 that the state holding company SEPI was instructed to avoid new Palantir contracts on national security and data sovereignty grounds, an informal restriction that sits outside every legal instrument in this section and demonstrates how much of state AI policy is executed by instruction rather than by statute.
Talent: a strong pipeline that is oversubscribed, and a market that cannot fill its vacancies
Spain's talent position is the most paradoxical layer in the report, and both halves are documented by national and independent sources.
The supply side is strong by European standards and undersized by its own market's needs. Spain graduates approximately 27,000 computer science engineers per year against an estimated gap of more than 120,000 roles in data, cloud and related profiles, a figure that carries a claim label on its source. AI degree programmes are heavily oversubscribed: the UPM's Data Science and AI degree closed at a 12.14 cut-off for 2025 to 2026 with 100 first-year places, and the UPC's AI degree at 11.89 with 50 places, in a system scored out of 14. The Generation IA programme funded more than 370 four-year research contracts at 120 million euros, announced on 7 April 2025. Universities are building industry links: the University of Granada and Amazon created a Chair in AI and Computing in May 2025, and the UPC was ranked among the top three organisations concentrating AI talent in Barcelona in a Dealroom report covered in May 2026. PwC's 2026 AI Jobs Barometer for Spain recorded roughly 26,000 additional AI-skill postings in 2025.
The demand side is where the country's paradox sits, and the sources state it in two ways. Spain has three times as much AI-skilled talent as the United States on a share basis, 10.2 per cent of professionals AI-trained against 3.6 per cent, while also leading in the difficulty of filling vacancies, a pairing that describes a matching problem rather than a supply problem. Spain is above the EU average on basic digital skills, at 66.5 per cent of individuals aged 16 to 74, and nearly at full broadband coverage. And the Latin American inflow is real and documented as a stock rather than a flow: 415,000 Argentines and 39,000 Colombians are based in the country by the figures available in November 2025, a demographic advantage no other country in this series holds in the same form.
The adoption layer completes the talent ledger and repeats a pattern the series has now documented five times. Spanish AI adoption is rising fast from a low base. ONTSI's indicators report, published in July 2026, records 20.5 per cent of companies with ten or more employees using AI in 2025, up 9.1 percentage points. The INE-based figure cited by the Real Instituto Elcano is 21 per cent for 2025, up from 13 per cent in 2022, placing Spain below Germany and above Italy. The older Eurostat and DESI baseline of 13.4 per cent for Spain against an EU average of 13.5 per cent is a vintage difference rather than a contradiction, and this report states each figure with its year and its company-size base. CaixaBank Research, analysing the same movement, describes the process as rapid and still uneven, and the DESI split between small and large firms, 8.7 per cent against 49.2 per cent, shows the same structural gap the series found in the United Kingdom and Germany in different institutional clothes: a sector that leads on supply and lags on use.
What changed since our March 2025 report on Spain
The Spanish sequence: institution, sandbox, model, law. University 365 Research Center.
Read the earlier report: Spain's AI Landscape in March 2025: From Historical Foundations to Future Leadership. University 365 INSIDE, 18 March 2025.
University 365 published "Spain's AI Landscape in March 2025: From Historical Foundations to Future Leadership" on 18 March 2025. That report was written in the opening weeks of the ALIA announcement and captured the country's position as one of accelerating foundations: a national strategy updated in 2024, a new supervisory agency, Europe's first AI sandbox, a public model just launched, and a compute build-out beginning in Aragon. Against that baseline, eighteen months of movement has delivered a great deal, and it has not delivered the one thing the architecture was built to carry.
The public model arrived and the numbers need correcting. The March 2025 report described ALIA-40B as trained with 6.9 billion tokens. The Barcelona Supercomputing Center's own launch release of 21 January 2025 states 9.37 trillion tokens across 35 languages with 20 per cent representation for the languages of Spain. The 6.9 billion figure is an order-of-magnitude error against the primary source, very likely a typographical slip, and this report uses the verified number. The rest of the 2025 description held: the model was trained on MareNostrum 5, it is publicly funded, it is verified by AESIA, and it is openly licensed. The Salamandra family beneath it was already published as a technical report in February 2025.
The compute figures moved in both directions. The 2025 report described MareNostrum 5 as having reached more than 450 petaflops. The sources available to this research state 314 petaflops of aggregate peak performance, and the AI upgrade contracted in January 2026 at 129 million euros is the route by which the capacity will grow; its target is not stated in the verified sources and is not claimed. On the private side the movement is large and in one direction: Amazon's commitment rose from 15.7 billion euros to 33.7 billion euros with the March 2026 announcement, Microsoft's Aragon programme from 2.2 billion to 6.69 billion euros, and by April 2026 Bloomberg was describing the wider pipeline at 90 billion dollars. The state's counterpart instruments are the 719 million euro gigafactory contribution approved in June 2026 and the 300 million euro EuroHPC authorisation alongside it.
The supervisory architecture gained depth and lost time. The 2025 report recorded an agency in formation and a sandbox running. The verified position is an agency with a permanent director appointed in December 2025, sixteen compliance guides published on a single day, a designated role in the European framework, participation in the European AI Office's first coordinated inspection wave in September 2026, a sandbox concluded successfully on 12 June 2026, and a national law that was approved by the Council of Ministers on 26 May 2026 and has sat in committee since its amendment period closed on 30 June. The staff gap is documented rather than solved: about thirty of eighty posts in August 2025 with a recovery plan across 2026.
Adoption moved up and the reporting needs its bases stated. The 2025 report carried two figures that could not be reconciled against each other, a 36 per cent adoption claim and a separate 8 per cent figure for companies above ten employees. Neither survives contact with the current data. The verified position is 20.5 per cent of companies with ten or more employees using AI in 2025 per ONTSI, up 9.1 points, and 21 per cent on the INE basis cited by the Real Instituto Elcano, up from 13 per cent in 2022. The older DESI measure of 13.4 per cent for Spain against an EU average of 13.5 per cent is a 2024 vintage and is carried with its year. The 2025 report's framing that Spain aligned with the EU average was true on the DESI basis and has since been overtaken by the national surveys.
Two numbers the earlier report carried are restated with their correct origin. The 600 million euro figure belongs to ENIA's 2021-2023 envelope announced in December 2020, not to a recovery-plan line, and it should not be connected to a current fund without a dated primary source. The Estrategia de IA 2024 approved on 14 May 2024 does not itself carry a headline 1.5 billion euro figure in the sources this research could verify. And the Multiverse Computing investment, described at 67 million euros in the 2025 report, sits against a 70 million dollar figure reported in March 2025 and up to 166.2 million euros across two rounds in 2026, with the state holding a board monitoring seat. Each figure is stated with its date and its source.
The genuinely new items are these. The MareNostrum 5 AI upgrade awarded in January 2026. The AEPD's 10,043,002 euro fine against AENA in November 2025, the largest AI-adjacent enforcement action in the period. The informal restriction on Palantir contracts reported in July 2026. The Digital Omnibus on AI deferring the European high-risk deadlines, published on 24 July 2026, with Spain presenting its input as leadership. The Mora la Nova gigafactory bid, approved for 719 million euros in June 2026 and awaiting the European call. Multiverse Computing's 570 million dollar raise in July 2026. The Catalan government's 1,000 million euro strategy to 2030. The Barcelona-Bilbao cable corridor completed in August 2026. And the country's improved index standing: 13th of 195 on the Oxford Insights Government AI Readiness Index 2025 with a score of 74.22, first in Southern Europe, an improvement of 4.97 points, which this report verified against the publisher's own report and dataset.
Sovereign AI Race: Spain (2026)
Key Findings
1. Spain built the European Union's first AI supervisory agency, its first AI sandbox, and one of its first seven AI factories, and its national AI law is still a bill. AESIA was created in 2022 and given its operating statute in August 2023, the RD Sandbox ran under Royal Decree 817/2023 and closed on 12 June 2026, and the BSC AI Factory was selected in December 2024. The Organic Law on AI was approved by the Council of Ministers on 26 May 2026, closed its amendment period on 30 June, and remains in committee as bill 121/000096.
2. The agency's staffing history is part of the enforcement story. About thirty of eighty promised AESIA posts were filled as of August 2025, with a doubling planned for December 2025 and the eighty-post target through 2026. The agency published sixteen compliance guides in December 2025 and joined the European AI Office's first inspection wave in September 2026, and its full sanctioning regime waits on the law.
3. The most consequential AI enforcement has come from the data protection authority, not the AI agency. The AEPD fined the airports operator AENA 10,043,002 euros in November 2025 over a biometric facial recognition assessment failure, published in March 2026, and reported the country's first sanction for AI-generated images in the same period. Every Spanish AI project operates under three overlapping frameworks, and the one with the enforcement record predates the AI Act.
4. The public model is genuinely public, genuinely open, and genuinely multilingual. ALIA-40B: forty billion parameters, 9.37 trillion tokens, 35 languages, 20 per cent languages-of-Spain representation, trained on MareNostrum 5, 100 per cent publicly funded, verified by AESIA, Apache 2.0 on Hugging Face. Its lineage runs from the 2019 Language Technologies Plan through Catalonia's AINA project and the Salamandra model family, which the BSC trained from scratch.
5. The public compute core is European and the private perimeter is American. MareNostrum 5 at 314 petaflops peak and 223 million euros of investment, with a 129 million euro AI upgrade awarded in January 2026, half EuroHPC funded. Against it: Amazon at 33.7 billion euros for Spain, Microsoft at about 6.7 billion, a pipeline Bloomberg framed at 90 billion dollars in April 2026, and a state gigafactory contribution of 719 million euros, roughly two per cent of one company's commitment.
6. The compute build-out is concentrated in Aragon and it is not owned in Spain. The hyperscaler capacity sits in one inland region with documented local divisions, served by the Calatorao substation and the Azora campus at 150 megawatts expandable to 300, and connected to the transatlantic cable system through the Barcelona-Bilbao corridor completed in August 2026 with a 52 per cent latency reduction.
7. State capital is direct and it takes board seats. Up to 166.2 million euros committed to Multiverse Computing across two rounds with a monitoring director on the board, participation in Sherpa.ai, 80 million euros from COFIDES' FOCO fund into Cathay Innovation Fund III, and the Spanish venture market at 3.1 billion euros in 2025 with AI leading at 717 million.
8. The country's index standing improved materially. Oxford Insights Government AI Readiness Index 2025: 13th of 195 at 74.22, first in Southern Europe, up 4.97 points, verified against the publisher's own January 2026 report and dataset.
9. Adoption is rising fast from a low base, and the reporting needs its bases. ONTSI: 20.5 per cent of companies with ten or more employees used AI in 2025, up 9.1 points. INE via Elcano: 21 per cent, up from 13 per cent in 2022, below Germany and above Italy. DESI 2024: 13.4 per cent against an EU average of 13.5, with large enterprises at 49.2 per cent against SMEs at 8.7.
10. Talent is strong on supply, difficult on matching, and exceptional on inflow. Spain graduates about 27,000 computer science engineers a year against a claimed gap of more than 120,000 roles; AI degrees close above 12 out of 14 at the UPM and above 11 at the UPC; the Generation IA programme funded more than 370 four-year research contracts at 120 million euros; PwC recorded about 26,000 additional AI postings in 2025; and 415,000 Argentines and 39,000 Colombians are based in the country, a stock figure rather than an annual flow.
11. The honest overall verdict: Spain is the series' most developed supervisory architecture attached to its least developed enforcement statute. It trained the model, built the agency, ran the sandbox and wrote the guidelines, and the law that would let it act has not passed. Its compute is foreign-owned, its most powerful rules come from Brussels, and its public model is a genuine achievement with an honest performance boundary. On the evidence, the country has bought its way to the front of the European regulatory queue and rented its way to the middle of the compute one.
Sovereign AI Race: Spain (2026)
Deep Analysis
Why the enforcement gap is the fact that matters most in this report
What runs, against what waits. University 365 Research Center.
Spain's story is easy to tell wrongly in both directions. One telling says the country is Europe's AI success: a supervisor, a sandbox, a public model, a factory, an index rank that rose. The other says the country is all architecture and no action: an agency at half strength, a law stuck in committee, and a compute build owned abroad. Both tellings cite real facts, and the difference between them is where the sovereign capacity actually sits, which is the question this series exists to ask.
The verified record supports a precise reading. The instruments that are in force are the European regulation and the data protection framework. The instruments that are not in force are the Spanish AI law and the national sanctioning regime that depends on it. The instruments in between are an agency that advises, guides, coordinates and participates in Europe-wide inspections, a sandbox that tested twelve projects and closed with the government calling it a success, and a supervisor that verified the country's own public model. In the two years in which Spanish firms began deploying AI at scale, the country's AI-specific rules arrived as guidance, and its AI-specific penalties arrived as enforcement by a different agency under a different law, while its own statute waited for a parliamentary calendar.
Three consequences follow. First, the gap is not the same as failure, and the report resists the framing that it is. Guidance published on time, a sandbox that produced usable compliance material, and a supervisor with real technical capability are all assets, and the country that built them can use the waiting period to arrive at its own law with two years of institutional practice behind it, exactly as Brazil is doing in a different order. Second, the gap has a cost, and the cost is the one the series measures: a state that cannot sanction cannot shape behaviour at the margin, and the margin is where deployment decisions are actually made. Third, and most usefully for other countries, the Spanish sequence demonstrates that an institution can be created before its statute without being useless, provided the institution is designed to advise and test rather than to enforce during the interval. Countries in this series that lack both the institution and the statute now have a European example of how to start.
The comparison the series can draw sharpens. Germany and the United Kingdom, for all their differences, both write their rules through institutions that already have enforcement power in some form: the competition authority in Britain, the European framework and national regulators in Germany. Spain wrote the institution first and left the power with the parliament, and the parliament is where the power still sits. That is a sequencing choice, and its lesson is that the sequence matters less than the date on which enforcement begins: a state with an advisory authority in 2026 is in a different position from a state with no authority and no law, and it is not in the same position as a state that can already fine.
The rented compute and what Aragon means for European sovereignty
Barcelona from above. The public compute core sits on the coast while the largest private build-out in Southern Europe sits inland in Aragon, owned by two American companies. Photograph: Pexels License, via Pexels.
The single largest AI infrastructure programme in Southern Europe is being built by two American companies in one Spanish region, and this report treats that fact as an economic outcome to be described rather than a scandal to be condemned.
The numbers are the argument. Amazon: 33.7 billion euros of planned investment, the latest tranche announced at the country's own flagship technology event in March 2026. Microsoft: around 6.7 billion euros, built up in three steps across two years. The pipeline framing in April 2026: 90 billion dollars. The state's instruments in the same window: 719 million euros for a gigafactory bid that has not yet won its European designation, 120 million euros for talent, 62.1 million euros for a photonic chip line, 14 million euros for public model training, and a 129 million euro supercomputer upgrade co-funded with the European Union. The country attracts more foreign AI infrastructure capital than any other in this series outside the Gulf, and it owns less of it than the Gulf states own of theirs.
What Aragon buys the country is real and worth stating precisely. The region gets construction, employment, land value and the beginnings of a supplier base; the country gets electricity demand it can serve from a renewable-heavy grid, a skills market for its graduates, and the physical presence of capacity that is subject to Spanish law while it operates on Spanish soil. Those are not small things, and countries in this series with no compute at all would trade places. What Aragon does not buy is control of the layer: the racks belong to companies whose models, pricing and continuation decisions are made elsewhere, and the state that will supervise the resulting AI systems has no ownership lever over the entities operating them.
The comparison across the series is now sharp enough to state as a finding. The Gulf states own the entities that build their compute. Germany lost its fab to a cancellation and its cloud to a partnership it does not control. The United Kingdom lost its flagship data centre to a tenant's pause. India announced capacity it did not fund. Spain has done the opposite of all of them: instead of announcing compute it might not build, it has attracted compute it will not own, at a scale exceeding every other country in the series outside the Gulf and the United States, in exchange for grid access, tax treatment and an English-law-adjacent business environment. That is a strategy, and the strategic question it leaves open is the one the Organic Law would answer: what rules apply to a system when the entity that runs it answers to a parent on another continent.
The three races, measured in Spain
The three races in Spain, run by three different actors. University 365 Research Center.
The series separates the compute race, the model race and the rules race, and Spain is the country where the three are run by the most different actors with the most different capitals.
In the compute race, private foreign capital runs and the state regulates. Amazon and Microsoft are building the capacity; the public layer is MareNostrum 5, its AI upgrade and the BSC AI Factory; the state's gigafactory bid would add national capacity if the European call goes Spain's way; and the country's own venture market, at 3.1 billion euros in 2025, is smaller than a single year of one hyperscaler's Spanish commitment.
In the model race, the public sector leads and the private market is thin. ALIA and the Salamandra family are genuine public infrastructure, built on public hardware, licensed openly, in the languages of Spain and 32 others. The country's private AI companies cluster at the application layer, with Multiverse Computing as the largest single example and a state board seat attached. No Spanish laboratory is on the frontier, and the country's own assessment describes its language advantage as an opportunity rather than a captured market.
In the rules race, Spain is first in institution and late in force. The agency exists, the sandbox ran, the guides are published, the European framework applies, the data authority enforces, and the national law waits. The country's input into the European simplification package is presented by its own government as leadership, and the package itself deferred the high-risk deadlines, which is the clearest evidence available that even the Union with the most developed rulebook found its own timeline too tight.
The three tempos produce the report's cleanest summary of Spain. A country that trained the model, hosts the compute, and has not yet been able to fine anyone under its own AI law, in a jurisdiction where the rules that bind it come from Brussels and the capital that builds it comes from America.
Sovereign AI Race: Spain (2026)
Data and Evidence
Table 1: The five layers, assessed for Spain in September 2026
Layer | What Spain holds | What it does not hold | Assessment |
Compute | MareNostrum 5 at BSC: EuroHPC pre-exascale, 314 petaflops peak quoted, 223 million euros invested; the BSC AI Factory operating since 1 April 2025, one of the first seven EuroHPC AI Factories; a 129 million euro AI upgrade awarded January 2026, half EuroHPC funded; 14 million euros added for BSC model training in July 2026; the Barcelona-Bilbao cable corridor completed August 2026 | Ownership of the largest build-out: Amazon at 33.7 billion euros and Microsoft at about 6.7 billion, concentrated in Aragon; the gigafactory at Mora la Nova undecided pending the European call; no leading-edge fabrication (Broadcom cancelled its planned 1 billion dollar plant in July 2025) | A public European core and a private American perimeter |
Models | ALIA-40B: 40 billion parameters, 9.37 trillion tokens, 35 languages, 20 per cent languages-of-Spain representation, trained on MareNostrum 5, 100 per cent publicly funded, AESIA-verified, Apache 2.0 on Hugging Face; the Salamandra family in 2B, 7B and 40B trained from scratch; Catalonia's Projecte Aina; participation in OpenEuroLLM through BSC | A frontier laboratory; performance parity with the strongest proprietary models (ALIA sits below them on general benchmarks by the sources' own account); a captured Spanish-language market | Europe's strongest public model infrastructure, with an honest boundary |
Capital | 719 million euros approved for the Mora la Nova gigafactory with a 300 million euro EuroHPC contribution authorised; up to 166.2 million euros committed to Multiverse Computing with a board monitoring seat; COFIDES' FOCO fund at 80 million euros into Cathay Innovation Fund III; Generation IA at 120 million euros; 62.1 million euros for the photonic chip line; AI the top Spanish venture sector at 717 million euros in 2025 | A sovereign fund; state capital at the scale of the foreign private flows it attracts (the gigafactory contribution is about two per cent of Amazon's Spanish commitment alone) | Direct state equity and a large private market, with the state as the smaller counterparty |
Regulation | AESIA created 2022, statute August 2023, national competent authority for the EU AI Act, 16 compliance guides published 16 December 2025, new director from 19 December 2025; the RD Sandbox concluded 12 June 2026; the EU AI Act applying since 2025 with Article 50 from 2 August 2026; the AEPD's 10,043,002 euro AENA fine of November 2025; reported informal restriction on Palantir state contracts (July 2026) | The Organic Law on AI in force: approved by the Council of Ministers 26 May 2026, amendment period closed 30 June 2026, in committee as bill 121/000096; the agency at full strength (about 30 of 80 posts in August 2025); the full sanctioning regime | The Union's most granular supervisory architecture, with almost none of it in force |
Talent and education | Generation IA: 370+ four-year research contracts at 120 million euros; AI degrees closing above 12 of 14 at the UPM and above 11 at the UPC; about 27,000 computer science graduates a year; PwC recording about 26,000 additional AI postings in 2025; 415,000 Argentines and 39,000 Colombians based in the country; 66.5 per cent basic digital skills, above the EU average | Match between supply and demand: a claimed gap of more than 120,000 roles; enterprise adoption at 20.5 to 21 per cent of companies, with large enterprises at 49.2 per cent and SMEs at 8.7 per cent on the DESI basis | Strong supply, weak matching, exceptional inflow |
Table 2: The controlled metrics, series bible format
Metric | Spain position | Source and date |
Flagship compute commitment | MareNostrum 5 at BSC: EuroHPC pre-exascale, two partitions (6,480 Intel Sapphire Rapids nodes; NVIDIA Hopper accelerated partition), 314 petaflops peak quoted, 223 million euros of investment; the 129 million euro AI upgrade awarded January 2026 (50 per cent EuroHPC, 50 per cent Spain-Generalitat-Portugal-Turkey, Generalitat at 60 million euros), contracted to an Fsas Technologies and Telefonica-led consortium; the BSC AI Factory operating since 1 April 2025; the Mora la Nova gigafactory (719 million euros approved, 300 million euros EuroHPC authorised) awaiting the EU call | BSC technical pages; CERN IndicO deck, 17 September 2025; digital.gob.es, January 2026; EuroHPC JU, 10 December 2024; Reuters, 16 June 2026 |
Capital committed | Amazon 33.7 billion euros for Spain (15.7 billion in May 2024 plus 18 billion announced at MWC March 2026); Microsoft about 6.7 billion euros across three announcements (February 2024, June 2024, June 2025); 719 million euros gigafactory contribution plus 300 million euros EuroHPC; up to 166.2 million euros to Multiverse Computing; Generation IA at 120 million euros; Spanish startups at 3.1 billion euros in 2025 with AI top at 717 million | Reuters; w.media and aragondigital.com, 3 March 2026; Reuters, June 2025; La Moncloa and Reuters, June 2026; The Quantum Insider, March 2025; Dealroom and Sifted data as reported |
Flagship national models | ALIA-40B, 40 billion parameters, 9.37 trillion tokens, 35 languages with 20 per cent languages-of-Spain representation, trained on MareNostrum 5, 100 per cent publicly funded, AESIA-verified, Apache 2.0 (BSC-LT/ALIA-40b on Hugging Face); the Salamandra family (2B, 7B, 40B) trained from scratch by BSC; Projecte Aina beneath them | BSC, 21 January 2025; Hugging Face model card; arXiv 2502.08489, February 2025 |
Anchor entities | BSC and the Barcelona Supercomputing Center network; SEDIA (Secretary of State for Digitalisation and AI) with the Directorate-General for AI; AESIA (supervision); the AEPD (data protection enforcement); CDTI, COFIDES, ICO and SEPI/SETT (state capital); the Generalitat de Catalunya (AINA, the Catalan strategy) | digital.gob.es; AESIA; COFIDES; Govern.cat |
Chip dependency | Complete at the accelerator layer: MareNostrum 5 runs Intel and NVIDIA silicon; no leading-edge fabrication on Spanish soil; Broadcom cancelled its planned 1 billion dollar back-end plant in July 2025; the photonic chip pilot line at 62.1 million euros is the state's alternative bet; PERTE Chip remains the framework | BiS Infotech, 14 July 2025; digital.gob.es, 31 July 2025 |
Regulatory instrument and status | In force: the EU AI Act (prohibitions since 2 February 2025; GPAI since 2 August 2025; Article 50 from 2 August 2026) and Regulation (EU) 2026/1744 (Digital Omnibus on AI, published 24 July 2026, high-risk deferred to December 2027 and August 2028); the GDPR and the AEPD. Not in force: the draft Organic Law on AI (bill 121/000096, Council of Ministers 26 May 2026, amendment period closed 30 June 2026, in committee); AESIA's full sanctioning regime dependent on it | European Commission AI Act Service Desk; Cuatrecasas, 24 July 2026; La Moncloa, 26 May 2026; Congress record |
Talent anchors | BSC and the ELLIS Unit Barcelona (23 researchers from 9 Catalan institutions); the UPM and the UPC AI degrees; the University of Granada's Chair in AI with Amazon (May 2025); Generation IA (370+ contracts, 120 million euros); PwC's Spain AI Jobs Barometer; the Latin American talent stock (415,000 Argentines, 39,000 Colombians) | ELIS, 12 July 2024; eligeuniversidad.es 2025-2026; DaSCI, 21 May 2025; digital.gob.es, 7 April 2025; PwC 2026; Nearshore Americas, 4 November 2025 |
Independent index standing | Oxford Insights Government AI Readiness Index 2025 (January 2026 edition): Spain 13th of 195 with 74.22 points, first in Southern Europe, an improvement of 4.97 points, verified against the publisher's own report and dataset. Stanford HAI AI Index 2026 Spain-specific metrics were not extracted in this research window and are not asserted | Oxford Insights, January 2026 report and dataset |
Adoption | ONTSI AI indicators (July 2026): 20.5 per cent of companies with ten or more employees used AI in 2025, up 9.1 points. INE via the Real Instituto Elcano (5 May 2026): 21 per cent, up from 13 per cent in 2022. DESI 2024: 13.4 per cent against an EU average of 13.5, with large enterprises at 49.2 per cent and SMEs at 8.7 per cent. CaixaBank Research (18 May 2026): the adoption more than doubled in firms above ten employees between 2021 and 2025 and remains uneven | ONTSI; Real Instituto Elcano; DESI; CaixaBank Research |
Distinguishing mechanism | Institution before statute: the Union's first dedicated AI supervisor and first AI sandbox, built and operated before the national AI law passed, with a public foundation model trained on public hardware and a compute perimeter financed by two American hyperscalers | This report |
Core tension | The country with the most granular AI supervision architecture in Europe cannot enforce most of it, and the compute it will supervise is owned by companies whose decisions are made on another continent | This report |
Table 3: Timeline, 2019 to 2026
Date | Event | Source | |
2019 | The Spanish Language Technologies Plan begins, the starting point of the ALIA lineage | BSC, 21 January 2025 | |
2 December 2020 | Prime Minister Sanchez presents ENIA, the National AI Strategy, with 600 million euros for 2021-2023 | La Moncloa | |
8 July 2022 | The Digital Spain Agenda 2026 is presented | DigitalES analysis, February 2026 | |
2022 | Ley 28/2022, the Startups Law, creates AESIA and the startup visa framework | Ley 28/2022 | |
22 August 2023 | Real Decreto 729/2023 gives AESIA its operating statute; Spain becomes the first EU state with a dedicated AI supervision body, headquartered in A Coruna | Real Decreto 729/2023 | |
2023 | Royal Decree 817/2023 creates the RD Sandbox, the first European AI regulatory sandbox | JD Supra and White and Case tracker | |
19 February 2024 | Microsoft announces 2.1 billion dollars for Spanish AI and cloud infrastructure | Reuters | |
14 May 2024 | The Council of Ministers approves the Artificial Intelligence Strategy 2024, updating ENIA | digital.gob.es; La Moncloa | |
May 2024 | AWS announces 15.7 billion euros for Aragon through 2033 | Reuters | |
12 June 2024 | Microsoft's Aragon commitment moves to 2.2 billion euros | AFP | |
19 June 2024 | AESIA is presented as a European pioneer entering operation | La Moncloa | |
12 July 2024 | The ELLIS Unit Barcelona is inaugurated with 23 researchers from 9 Catalan institutions | ELLIS | |
10 December 2024 | EuroHPC selects the first seven AI Factories, including the BSC AI Factory | EuroHPC JU | |
21 January 2025 | BSC announces ALIA: 9.37 trillion tokens, 35 languages, 100 per cent publicly funded, AESIA-verified | BSC | |
February 2025 | The Salamandra technical report is published (arXiv 2502.08489) | arXiv | |
3 February 2025 | OpenEuroLLM launches with 20 European institutions including BSC | OpenEuroLLM | |
4 March 2025 | Multiverse Computing announces a 70 million dollar investment from the Spanish government | The Quantum Insider | |
5 March 2025 | Red Electrica begins the Calatorao 220 kV substation | Red Electrica | |
13 March 2025 | Azora announces a 2 billion euro Zaragoza data centre at 150 MW expandable to 300 MW | Azora | |
18 March 2025 | University 365 publishes its Spain AI landscape report | University 365 INSIDE | |
1 April 2025 | The BSC AI Factory starts operation | CORDIS | |
7 April 2025 | Generation IA: 370+ research contracts, 120 million euros, four years | digital.gob.es | |
21 May 2025 | The University of Granada and Amazon create a Chair in AI and Computing | DaSCI | |
June 2025 | Microsoft's Aragon commitment moves to 6.69 billion euros | Reuters | |
July 2025 | Broadcom cancels its planned 1 billion dollar Spanish chip factory | BiS Infotech, 14 July 2025 | |
31 July 2025 | 62.1 million euros announced for the Integrated Photonics Pilot Line | digital.gob.es | |
2 August 2025 | EU AI Act GPAI obligations begin applying; AESIA reported at about 30 of 80 posts | Regulatory AI Spain tracker; La Opinion A Coruna | |
30 October 2025 | AESIA announces a December 2025 staffing doubling and the 80-post target through 2026 | Cadena SER Galicia | |
November 2025 | The first reported AEPD sanction for AI-generated images | Prodat, 18 November 2025 | |
26 November 2025 | The AEPD fines AENA 10,043,002 euros over biometric facial recognition | Regulations.ai; published in the BOE March 2026 | |
December 2025 | Oxford Insights Government AI Readiness Index 2025 published: Spain 13th of 195 at 74.22 | Oxford Insights | |
16 December 2025 | AESIA publishes 16 AI Act compliance guides | AESIA | |
19 December 2025 | Alberto Gago appointed AESIA director, succeeding Ignasi Belda | AESIA | |
Late 2025 | The Catalan government announces a 1,000 million euro AI strategy to 2030 | Govern.cat | |
January 2026 | The MareNostrum 5 AI upgrade is awarded: 129 million euros, Fsas Technologies and Telefonica consortium | digital.gob.es; Science | Business |
3 March 2026 | Amazon raises its Spanish commitment by 18 billion euros to 33.7 billion | w.media; aragondigital.com | |
8 April 2026 | ManpowerGroup publishes its 2026 talent mismatch study | ManpowerGroup Spain | |
16 April 2026 | Bloomberg frames the Spanish data centre pipeline at 90 billion dollars | Bloomberg | |
22 April 2026 | Sanchez speaks at the opening of the first UN Panel of Experts on AI meeting | La Moncloa | |
5 May 2026 | The Real Instituto Elcano publishes the INE-based adoption figure: 21 per cent | Real Instituto Elcano | |
13 May 2026 | Reuters interview: Spain pushes ahead with AI rules despite tech lobbying | Reuters via Bernama | |
18 May 2026 | CaixaBank Research publishes its AI adoption dossier | CaixaBank Research | |
26 May 2026 | The Council of Ministers approves the draft Organic Law on AI and sends it to Congress | La Moncloa; digital.gob.es | |
11 June 2026 | Theker raises 85 million euros | Sifted | |
12 June 2026 | The government concludes Europe's first AI regulatory sandbox | digital.gob.es | |
16 June 2026 | 719 million euros approved for the Mora la Nova gigafactory, with 300 million euros EuroHPC authorised | Reuters; Catalan News | |
16 and 29 June 2026 | The European Parliament and Council approve the Digital Omnibus on AI | Cuatrecasas; Ethic Eye | |
30 June 2026 | The amendment period closes on bill 121/000096; the bill remains in committee | Angel Ortega Castro, 17 July 2026 | |
1 July 2026 | Sanchez calls for public-private partnership on the gigafactory | La Moncloa | |
4 July 2026 | Reported informal instruction to SEPI companies to avoid new Palantir contracts | The Olive Press citing El Confidencial | |
21 July 2026 | 14 million euros approved for BSC to train advanced AI models | Ara English | |
24 July 2026 | The Digital Omnibus on AI is published as Regulation (EU) 2026/1744, deferring high-risk deadlines | Cuatrecasas | |
27 July 2026 | Multiverse Computing raises 570 million dollars at a 1.7 billion dollar valuation, with state participation | Silicon Republic; Dossaro | |
2 August 2026 | EU AI Act Article 50 transparency obligations begin applying | European Commission AI Act Service Desk | |
26 August 2026 | EXA completes the Barcelona-Bilbao cable route: 52 per cent latency reduction | EXA Infrastructure | |
September 2026 | The European AI Office launches its first coordinated inspections with 24 national authorities including AESIA | Kurums; AI Tech Connect | |
September 2026 | The Organic Law remains in Congress; the gigafactory bid awaits the EU call; the Palantir restriction is in effect informally | As cited above |
Sovereign AI Race: Spain (2026)
Implications
For the countries still to come in this series
Spain proposes a sequencing lesson and a warning. The sequencing lesson is that an institution can be built before its statute and still be worth building: a supervisor that advises, tests and verifies does real work during the interval before enforcement begins, and when the law arrives it lands on practised machinery. The warning is that the interval has a cost measured in behaviour that no one can correct. Any government considering the Spanish route should decide in advance what its supervisor may do without the law, staff it to that mandate, and treat the national statute as the first legislative priority of the term rather than the last, because the gap between the sandbox closing and the law passing is spent by firms who are already deploying.
For the technology providers
Spain is the largest AI infrastructure build-out in Southern Europe with the smallest domestic AI capital base underneath it, and that combination defines the market. Providers should read three signals. First, the physical layer is being won by hyperscalers and the state has no ownership lever, which means grid access, land and tax treatment are the decisive negotiating cards and they sit with the regions as much as with Madrid. Second, the model layer has a genuinely competitive public incumbent for Spanish and Catalan workloads in ALIA, openly licensed, which compresses pricing for everyone selling Spanish-language capability into the public sector. Third, compliance is a live market in Spain specifically because enforcement has been slow: the demand for guidance, audit and conformity work is running ahead of the supply, and AESIA's sixteen guides plus its inspection role are the roadmap for what firms will be asked for next.
For institutional and enterprise buyers
Spain offers buyers in Spanish-speaking markets the strongest public, open, multilingual model option in Europe and the clearest compliance environment, and the two come with different maturities. For deployment at scale without vendor lock-in, ALIA-40B and the Salamandra family are available today under open licences with a national supervisor's verification behind them. For regulated buyers, the operative rules are the European framework plus the data protection regime, and the Spanish national law is not yet among them, which means a firm's compliance work today should be built to the European text and the data authority's enforcement record, with the Organic Law treated as a pending addition rather than a current requirement. And for anyone locating compute in the country, Aragon offers the density and the connections; the contracts, however, will be governed by foreign parents' decisions about models and pricing, so buyers should negotiate continuity terms rather than assume them.
For University 365
Spain is the fourteenth country in this series and the one whose education system most closely matches the shape this institution knows best: strong supply, oversubscribed programmes, a widening gap between what graduates can do and what the market can absorb, and a demographic inflow from the Spanish-speaking world that no northern European country can match. The country's AI education is not the constraint; its matching is. Twenty-seven thousand computer science graduates a year against a claimed gap of more than 120,000 roles, with AI degrees closing above 12 out of 14, is a system producing talent faster than its labour market converts it, which is the same structural issue this series found in India, Morocco, Korea and Japan in different institutional clothes. What Spain adds is the Latin American inflow and the language advantage: a country that trains in the world's second-most-used language family and cannot yet employ everyone it trains is a country whose education policy is, whether it intends this or not, an export policy. That is a lesson our own learners can act on, and it is worth naming plainly.
Sovereign AI Race: Spain (2026)
Education and Skills Impact
What the Spanish case teaches about strong supply and weak matching
This series returns in every report to the gap between using AI and building it, because that gap is where the educational argument lives. Spain adds a case where the pipeline is strong, the demand is larger, and the two do not meet.
The supply numbers are strong by European standards and are stated with their sources throughout this report. Spain graduates approximately 27,000 computer science engineers per year, against an estimated gap exceeding 120,000 roles in data, cloud and related profiles, a figure carrying a claim label. The AI-specific degrees are among the hardest in the country to enter: the UPM's Data Science and AI degree closed its 2025 to 2026 intake at 12.14 out of 14 with 100 places, and the UPC's AI degree at 11.89 with 50 places. The Generation IA programme funded more than 370 four-year research contracts at 120 million euros, announced on 7 April 2025, placing researchers in public centres rather than in companies. PwC's 2026 Spain AI Jobs Barometer recorded about 26,000 additional AI-skill postings in 2025. The research base beneath it is real: the ELLIS Unit Barcelona brings 23 senior researchers from 9 Catalan institutions, the University of Granada and Amazon created a joint AI chair in May 2025, and the UPC was ranked among the top three organisations concentrating AI talent in Barcelona in the Dealroom report covered in May 2026.
The matching is where the country's own data describes a problem the education system cannot solve alone. Spain has three times the share of AI-skilled professionals of the United States, 10.2 per cent against 3.6 per cent, and simultaneously leads in the difficulty of filling vacancies. That pairing is not a supply failure; it is a matching and pay-structure issue, and it has a specific European form: Spanish salaries for AI specialists sit below those of northern European and American markets, so the country trains them and loses them to remote work and emigration, while its own small and medium firms report that they cannot find the profiles they need because they cannot compete on the terms the profiles command. A national system that graduates 27,000 engineers a year into a market with 120,000 unfilled roles, and reports record hiring difficulty at the same time, is not short of education. It is short of the conditions that turn education into employment.
Two additional features make the Spanish case distinctive in this series. The first is the Latin American inflow: 415,000 Argentines and 39,000 Colombians based in the country by the stock figures available in November 2025, a supply channel no other European country in this series possesses and one the Spanish language makes structurally cheaper to operate than any visa scheme. The second is the adoption gap between small and large firms, which is the demand-side mirror of the matching problem. Large Spanish enterprises reached 49.2 per cent AI deployment on the DESI 2024 basis against 8.7 per cent for SMEs, and ONTSI's own process-depth analysis found that while 35 per cent of firms above 250 employees use AI somewhere, only 9 per cent have wired AI into more than two processes. Companies that adopt shallowly have less demand for deep specialists, which is part of why the vacancies and the graduates coexist.
The finding for this series sharpens into its Spanish form. A curriculum teaches judgement; a labour market decides whether the judgement stays, and how deeply the businesses around it use what the judgement can build. Spain has the second of the series' strongest public model infrastructures and one of its most oversubscribed AI degree markets, and it is measuring the result in unfilled roles and shallow enterprise deployment. That combination says the next Spanish policy question is not how to teach more AI; it is how to make the adopting firms deep enough to need the people the country already educates.
Sovereign AI Race: Spain (2026)
The CI-First Perspective
Where the Spanish capability is real, and where the architecture outruns the enforcement
The hall that is inspected, and the cables that lead elsewhere. University 365 Research Center.
The Co-Intelligence First framework asks whether an arrangement amplifies human capability or substitutes for it, and where the risk of AI Imposture sits. Applied to Spain, the verdict is that the capability is real at the model, research and institutional layers, that the imposture risk is minimal because the country describes its own position accurately, and that the exposure is a structural gap between the supervision that exists and the enforcement that does not.
The capability is real at three layers, and each has a concrete artefact. At the model layer, ALIA-40B and the Salamandra family are open, multilingual, publicly funded, trained on public hardware, verified by the national supervisor and licensed for reuse. That is a stronger public model position than every country in this series except China's open-weight release programme, and unlike China's it was built with public money under an open licence at a scale deliberately calibrated to public languages rather than to a leaderboard. At the research layer, MareNostrum 5, the BSC AI Factory within the first seven European AI Factories, and the Barcelona research base are assets with international standing, and the 129 million euro AI upgrade extends them with European co-funding. At the institutional layer, AESIA and the RD Sandbox have done real work: sixteen compliance guides, a concluded sandbox with twelve tested projects, participation in the Union's first coordinated inspection wave, and verification of the country's own model. Those are functioning institutions, and the country's accuracy about their limits is itself evidence of institutional quality: the assessment that the supervisory architecture is the most granular in the Union and almost none of it is in force comes from the country's own policy community.
The imposture risk is minimal, and this is where Spain departs from the patterns this series has documented in other countries. There is no Stargate UK-style announcement here, no half-gigawatt campus connected at thirty-six megawatts, no cancelled fab presented as a pivot. The compute numbers that are large are being spent by companies with balance sheets, in a region that reports construction and employment, and the state's own contributions are modest and dated and are described as such by the government that announced them. The one presentational claim the report flags is the government's framing of the European simplification package as Spanish leadership, which is the government's own characterisation rather than an established fact and is labelled as framing here.
The exposure is not imposture; it is the enforcement gap, and it is the single most important fact in this report. A state whose chosen instrument for controlling AI is supervision cannot supervise at the margin of conduct without the power to sanction, and the power waits in committee while systems are deployed. The gap has a specific and quantifiable cost: in the two years in which AESIA advised and guided, the largest AI-adjacent penalty in the country was issued by the data protection authority under a different law, and the country's firms adopted AI at double-digit growth rates without exposure to a single AI-specific national sanction. Countries watching Spain should take the institutional ambition and treat the timetable as the lesson.
The CI-First verdict on Spain is this. This is the most genuinely institutional AI country in the series: it built the supervisor before it built the enforcement, funded the model before it funded the market, and trained the researchers before it retained them, and in each case the institution is real. Its population's exposure to AI runs through a European rulebook that applies, a data authority that enforces, and a national architecture that advises. Whether that counts as amplification depends on the next twelve months: the Organic Law passing with its sanctioning regime intact would convert the country's institutional first-mover advantage into the strongest AI supervision in Europe, and its continued presence in committee would leave the most granular supervisory architecture in the Union as a statement of intent.
Sovereign AI Race: Spain (2026)
What This Means for You and Us
For a reader in a country with Spain's position
The Spanish approach is the one to study if you have solid research institutions, a functioning public computing base, and no prospect of owning the frontier. Four practices are worth copying exactly: build the supervisor before the law, because guidance and testing are useful immediately and the institution will be better by the time enforcement arrives; fund a public model at the scale your languages justify rather than at the scale the benchmarks reward, because a forty-billion-parameter openly licensed model in the languages your citizens actually use is a better public asset than a frontier claim you cannot fund; use the sandbox to produce published compliance material, because that is the artefact other countries can reuse; and treat data protection enforcement as the interim instrument, because the authority you already have can act before the AI regulator can. One practice is worth a warning: do not let the interval between the sandbox closing and the law passing run longer than your adoption curve, because the firms you meant to supervise will have deployed before you can sanction.
For a reader watching the series
Fourteen countries in, Spain completes the European pair with Germany and sharpens the series' emerging finding again. Both Spain and Germany host a compute build they do not own; both have world-class research and early regulatory instincts; both buy the models they govern. They differ in one respect that matters: Germany's instrument is a cloud partnership and an industrial policy, Spain's is a supervisory institution, and Spain's is the more durable of the two because institutions outlive partnerships. The series' finding is now stable enough to state across fourteen reports: sovereignty in AI is the ownership of at least one layer that others cannot substitute. Spain owns its model layer and its supervisory layer, both built with public money, and rents its compute from two American companies. That is a more defensible position than the countries holding none, and it is less defensible than the countries holding the layer the frontier runs on.
For University 365
Spain is the fourteenth country in this series and the closest to this institution's own student base outside the countries already examined, because of the Spanish language and the Latin American connection that flows through it. The country's education system produces AI graduates at scale and its labour market cannot yet absorb them all, which is the structural issue this series has now documented in six different institutional forms. What Spain adds to our own work is the clearest available example of a country that built public AI capability correctly and is waiting for the law to catch up, which is a lesson about timing rather than about capability: the institutions you build before you need them are the ones that matter most, and the clock starts on the day the technology arrives, not the day the statute passes. Our own learners should read the Spanish case as evidence that public investment in model infrastructure and supervision pays back, and as evidence that the payment arrives late.
Sovereign AI Race: Spain (2026)
The Road Ahead
Three observable things would change this assessment.
Whether the Organic Law passes and with what sanctioning power. The bill is in Congress as 121/000096 after a 26 May 2026 Council of Ministers approval and a 30 June amendment deadline. Watch whether the final text keeps AESIA as coordinator and arbiter with the reported fine tiers up to 35 million euros or 7 per cent of worldwide turnover, and watch its two Spain-specific prohibitions against the European text. A law passing in the 2026 to 2027 session with the sanctioning regime intact converts the country's first-mover institution into the Union's strongest enforcement authority. A law that arrives stripped of its penalties leaves the gap structurally open.
Whether the Mora la Nova gigafactory bid wins its European designation. The state has committed 719 million euros and authorised a 300 million euro EuroHPC contribution, and the project awaits the European Commission's call. A successful bid gives Spain national-scale AI compute under public co-ownership, which is the layer it does not have. A failed bid leaves the country's compute position entirely dependent on the two American hyperscalers already building in Aragon, and the state without an ownership instrument in the physical layer.
Whether the country's talent matching improves before its adoption deepens. The numbers to watch are the AI-specialist salary levels against the northern European and American markets, the enterprise process-depth figures (35 per cent using AI somewhere against 9 per cent with more than two processes wired), and the AESIA staffing curve toward the eighty-post target. If Spanish firms deepen their integrations and pay at competitive levels, the country's graduate pipeline becomes a national asset that compounds. If they do not, the country continues to educate AI specialists for markets that pay them better, and the language advantage remains an opportunity rather than a captured market.
Sovereign AI Race: Spain (2026)
Sources and Methodology
Methodology
This report was researched from public sources with a preference for primary documents: the Barcelona Supercomputing Center's own technical pages and the ALIA launch release of 21 January 2025; the Hugging Face model card for ALIA-40b; the EuroHPC Joint Undertaking's AI Factory selection of 10 December 2024; the Ministry for Digital Transformation's January 2026 announcement of the MareNostrum 5 AI upgrade and its December 2025 compliance guides; the La Moncloa records for the 26 May 2026 Council of Ministers approval and the June 2026 gigafactory decision; the Congress record for bill 121/000096; the European Commission's AI Act Service Desk timeline; the AEPD's enforcement record including the AENA fine of 26 November 2025; the Oxford Insights Government AI Readiness Index 2025 as published in January 2026 and its dataset; ONTSI's AI indicators; the Real Instituto Elcano's analysis of the INE figures; CaixaBank Research's adoption dossier; and the Spanish and international press for everything else. Government targets, claimed investment totals and vendor figures are labelled as claims, and where sources conflict the conflict is stated rather than resolved: the two renderings of MareNostrum 5's peak performance, the 719 million euro and 300 million euro components of the gigafactory package whose arithmetic could not be verified, the ONTSI and INE and DESI adoption bases with their different survey years, and the two Oxford Insights file variants of December 2025 and January 2026.
This report carries the series' "What Changed Since" treatment against the prior University 365 report, "Spain's AI Landscape in March 2025: From Historical Foundations to Future Leadership", published on 18 March 2025. Five specific figures from the earlier report are carried through the comparison with their corrections or their updated values: the ALIA token count (6.9 billion corrected to 9.37 trillion from the primary source), the MareNostrum 5 peak performance (450-plus petaflops against the 314 petaflops the sources state), the adoption claims (36 per cent and 8 per cent retired in favour of the ONTSI and INE figures with their bases), the ENIA 600 million euro figure restored to its 2021-2023 origin, and the Multiverse Computing investment restated across its 2025 and 2026 amounts. The standard applied to the earlier report is whether its statements were accurate as of their date, and where a figure was an order-of-magnitude slip against the primary source, the correction is made from the source rather than from the slip.
Five limits should travel with this report. First, the target capacity of the MareNostrum 5 AI upgrade is not stated in the verified sources and is not claimed. Second, the Stanford HAI AI Index 2026 Spain-specific metrics were not extracted in this research window and are not asserted. Third, the Royal Decree on hourly-matched renewable supply for data centres above one megawatt could not be verified as in force and is not asserted either way. Fourth, AESIA's staffing at the end of 2026 rests on the August 2025 figure of about thirty posts and the stated December 2025 doubling plan, and the current figure should be re-checked before any later citation. Fifth, several load-bearing figures rest on single or secondary sources and are labelled individually: the claimed 120,000-role talent gap, the twelve-project sandbox participation count, the reported two Spain-specific prohibitions in the draft law pending the final text, and the informal nature of the Palantir restriction, which this report describes as an informal instruction because no legal instrument behind it could be verified.
Principal sources
Government, regulatory and judicial. La Moncloa: the 2 December 2020 ENIA presentation, the 14 May 2024 Council approval of the Artificial Intelligence Strategy 2024, the 22 April 2026 UN Panel of Experts meeting, the 26 May 2026 Council press conference and the Organic Law presentation, and the 1 July 2026 gigafactory meeting; the Ministry for Digital Transformation and the Public Service: the January 2026 AI upgrade announcement, the 16 December 2025 compliance guides, the 7 April 2025 Generation IA announcement, the 31 July 2025 photonic chip pilot line, the 12 June 2026 sandbox closing note, and the July 2026 BSC training announcement; AESIA: the 19 December 2025 director appointment and its published materials; the Congress of Deputies record for bill 121/000096; the AEPD's AENA fine of 26 November 2025 and its publication in the BOE of 20 March 2026; Red Electrica on the Calatorao substation (5 March 2025); the Generalitat de Catalunya's Catalan AI strategy announcements; the European Commission's AI Act Service Desk, its OpenEuroLLM pages and its digital skills portal; the EuroHPC Joint Undertaking's AI Factory selections; CORDIS for the BSC AI Factory grant.
Company and institutional disclosures. Barcelona Supercomputing Center: the ALIA launch release, the MareNostrum 5 technical pages, the Salamandra technical report (arXiv 2502.08489) and the ELLIS Unit Barcelona material; Hugging Face for the ALIA-40b model card; Amazon and Microsoft announcements via Reuters, AFP and the regional press; Bloomberg's April 2026 pipeline feature; Azora on its Zaragoza campus; EXA Infrastructure on the Barcelona-Bilbao route; Multiverse Computing's releases and the Quantum Insider's March 2025 report; Theker's round via Sifted; Luzia's round; COFIDES on the FOCO commitment to Cathay Innovation Fund III; Cathay Innovation's own announcement; UPC's Dealroom coverage; the University of Granada's Amazon chair announcement via DaSCI.
Research and measurement. Oxford Insights Government AI Readiness Index 2025 and its dataset; ONTSI's AI indicators; the Real Instituto Elcano's commentary on the INE figures; CaixaBank Research's adoption dossier; PwC's 2026 AI Jobs Barometer Spain report; ManpowerGroup's 2026 talent mismatch study; the European Commission's Digital Economy and Society Index references; the AI in Europe policy atlas; JD Supra and White and Case's regulatory tracker for the sandbox; Linklaters, HSF Kramer, Ecija and Cuatrecasas for the legal analyses; the Banco de Espana's 2025 bulletin article on AI adoption.
Reporting. Reuters, Bloomberg, the Financial Times, El Pais, Cinco Dias, Expansion, La Vanguardia, Catalan News, Ara, Sifted, TechCrunch, El Confidencial via The Olive Press, La Opinion A Coruna, Cadena SER, and the specialist outlets named in the text where a claim depends on them.
Sovereign AI Race: Spain (2026)
About This Report
Sovereign AI Race: Spain (2026) is report fourteen of twenty in the Sovereign AI Race series, followed by a comparative capstone. The series assesses how states attempt to control the production of artificial intelligence inside their jurisdiction, using one five-layer framework and one metric set applied identically to every country: compute, models, capital, regulation, and talent.
Each report in the series carries a "What Changed Since" treatment against the earlier University 365 report on the same country where one exists. Spain has a 2025 landscape report from this institution, "Spain's AI Landscape in March 2025: From Historical Foundations to Future Leadership", and this report is compared against it throughout The Current State, including the corrections the comparison required.
Author: Hubert Graef, Dean of Research, University 365 Research Center.
Series: Sovereign AI Race, report 14 of 20, followed by the comparative capstone.
*Published by University 365 Research Center. CI-First is University 365's Co-Intelligence First framework, a method constant of the institution.*
Revision 3, 30 September 2026, 18:30 UTC. Published 29 September 2026.
Comments