Most member states were supposed to name their AI supervisor by August 2025. Most have not. Spain not only did — it built a dedicated agency for it, the first of its kind in the Union. For a company choosing where to establish, that is not trivia. It decides whether there is anyone to register with, ask, and be answered by.
The AI Act is a Union-wide regulation, so its obligations are the same in every member state. What is not the same is the machinery each country has built to supervise it — and for a non-EU company deciding where to put its European entity or its authorised representative, that machinery is the deciding factor. A regulation is only as workable as the authority standing behind it.
Under Article 70, every member state had to designate its national competent authorities — a market surveillance authority and a notifying authority — and communicate a single point of contact to the Commission by 2 August 2025. It is one of the plainest obligations in the whole framework, and most states missed it.
This is the context that turns a Spanish establishment from a preference into an advantage. In a jurisdiction with no designated authority, an obligation to "register with" or "be addressed by" the competent authority is an obligation with no counterparty. In Spain, the counterparty exists, has a name, and has existed since before the deadline.
The Agencia Espanola de Supervision de la Inteligencia Artificial (AESIA) was created by Royal Decree 729/2023 and became operational in 2024 — the first public body in the EU dedicated specifically to supervising artificial intelligence, rather than an AI desk bolted onto a data-protection or telecoms regulator.
The honest version of the Spain argument is narrow and verifiable, which is exactly what makes it credible. The dishonest version invents a status that does not exist.
No provider is accredited or endorsed by AESIA, and the AI Act creates no general "certification" you can buy. Anyone marketing those words is selling a fiction. The real, defensible advantage is jurisdictional: you establish in a country whose supervisor is designated, operational and reachable — while much of the Union is still deciding who supervises what.
The Spanish implementing law reinforces the direction of travel. A Proyecto de Ley Organica on the good use and governance of AI — designating the supervisory authorities and setting a national penalty regime with fines reported up to €35 million or 7% of worldwide turnover for prohibited practices — was approved by the Council of Ministers on 26 May 2026 and is in parliamentary process. It is not yet in force, and any claim that it is should be treated as a warning about the source. What it signals is that Spain is building the enforcement architecture ahead of most of the Union, not behind it.
For a non-EU AI company, the AESIA advantage does not stand alone — it sits on top of the reasons a Spanish SL already makes sense as an EU base. The authorised-representative duty for a non-EU provider needs a party established in the Union; a Spanish entity gives that, plus a euro balance sheet, EU VAT, SEPA and the ability to contract as an EU counterparty. Establishing where the supervisor is real turns a compliance obligation into a coherent operational position.
The obligations are Union-wide; the ability to actually discharge them — register, ask, be answered — depends on the authority behind them. Spain built that authority early. For a non-EU AI company deciding where to anchor, that is the practical case, stated without the certification fictions that surround this topic.