Spain’s AI Act Asks for Evidence, Not Intentions. How to Prove Runtime Evidence for AESIA

What the Spanish Guidance Actually Requires

AESIA is the Spanish Agency for the Supervision of Artificial Intelligence, a national market-surveillance authority. Its December 2025 release is not an abstract policy. It is 16 guides built out of the Spanish AI regulatory sandbox, the first of its kind in Europe, which tested 12 high-risk AI systems across six sectors including biometrics, employment, healthcare, and critical infrastructure. The guides cover risk management, data governance, transparency, and cybersecurity, and each comes with a checklist tied to a specific obligation.

The guides are not binding and do not replace the regulation. What they do is make the AI Act operational: they tell a provider what a conformity assessment and an impact assessment look like in practice, and what evidence a supervisor will expect. In applicable high-risk scenarios, an organisation has to show that identified risks are effectively controlled. Most AI deployments fall short on the word show. They have a policy document and no runtime proof.

EU AI Act, Article 9, with the Article 8 to 17 requirements for high-risk providers.
Source: Article 9: Risk Management System | EU Artificial Intelligence Act

The EU AI Act Asks for Controls that Run Continuously

The AI Act’s requirements for high-risk providers sit in Articles 8 to 17. Four of them describe a runtime control almost exactly.

• Risk management system across the full lifecycle, not a one-time assessment.
• Record-keeping, where the system automatically logs events relevant to identifying risks and substantial modifications.
• Accuracy, robustness, and cybersecurity by design.
• Human oversight, so a person can intervene in the system’s operation.

General-purpose models with systemic risk, trained above 10^25 FLOPs, carry an extra duty to run model evaluations and adversarial testing and to report serious incidents. The compliance clock is real: Annex III high-risk obligations apply 24 months after the Act’s entry into force, and prohibited-practice rules already applied at six months. A provider who waits for a supervisor to ask is starting the evidence trail too late.

A Prompt Firewall Turns an Assessment Finding into a Running Control

A red-teaming assessment tells you a model can be pushed off-topic or made to leak data. That is a finding. The AI Act wants the finding closed and the closure evidenced, continuously. A stateful prompt firewall is the layer that does both.

The firewall sits between users, applications, and the model as a policy-enforcement point. The firewall analyses prompts and responses. It blocks sensitive data from leaving, restricts out-of-scope queries, and records every decision. A public-sector chatbot meant for tax questions gets manipulated by prompt injection into producing political statements. That is the failure of the framework’s target. A firewall that enforces the chatbot’s boundaries refuses the response and logs the attempt. The refusal satisfies the robustness requirement. The log satisfies the record-keeping requirement.

The prompt firewall console, where each blocked prompt is both the enforced control and the logged evidence.

For a Spanish deployer, the evidence is generated as the control operates. An analyst does not assemble it the week before an audit. The EU AI Act compliance tooling overview covers the wider mapping.

Add ENS Mapping for the Spanish Public Sector

If the Spanish public-sector market matters to a vendor, the Esquema Nacional de Seguridad (ENS) is the framework to support. The ENS applies to the entire public sector and to the private companies that supply it, and it sets requirements for access control, confidentiality, integrity, traceability, authenticity, and availability. It was last updated by Royal Decree 311/2022, with detailed measures in the CCN-STIC 800-series guides.

Traceability and integrity are the ENS controls a runtime AI layer supports directly. The audit trail that satisfies the AI Act’s record-keeping duty is the same evidence an ENS assessment wants for traceability. A platform that already carries ENS mappings removes a procurement blocker for any Spanish public body and its suppliers.

Where to Start in the Spanish Market

For go-to-market, the Red Nacional de SOC, the national network of security operations centres led by CCN-CERT, is a public map of mature security organisations.

The requirement across all three frameworks is the same. Prove the risk is controlled, and prove it continuously. Assessment finds the gap. A runtime control closes it and leaves the record that a supervisor, an ENS auditor, or a bank’s risk team can read. Start with the assessment, then put the finding under enforcement.

See Why a Prompt Firewall Belongs Inline

This walkthrough covers what a prompt firewall enforces between users, applications, and the model, and why an enterprise needs one at runtime.

FAQ