On June 12, the Draft Organic Law for Proper Use and Governance of Artificial Intelligence was published. The law itself doesn't start from scratch, nor does it introduce anything fundamentally new, since it simply aims to —which is no small feat— transpose the European AI Regulation into Spanish law and establishes who monitors compliance, who imposes sanctions, and the severity of those sanctions. A total of forty-one articles is aimed at the distribution of powers and the creation of a sanctions regime.

First, it's important to highlight the positive aspects. The Draft designates the Spanish Agency for International Development Cooperation (AESIA) as the main competent authority and point of contact, and based on common sense, it distributes other powers among authorities such as the Spanish Data Protection Agency, the General Council of the Judiciary, the Bank of Spain, and the CNMV (National Securities Market Commission) in the areas specified in the text. Furthermore, it establishes a one-stop shop through which any natural or legal person may report a potential infringement without needing to understand the entire supervisory framework.

The project protects those who report in good faith and provides for a 25% reduction in the penalty to those who acknowledge responsibility, and a further 25% reduction for those that make voluntarily payment. The provision for controlled environments to test systems before they are commercialized is interesting. In addition, it requires public administrations to maintain an inventory of systems, appoint an AI delegate, as well as to comply with certain transparency obligations. All these obligations are backed by a sanctions regime under which fines may reach up to 35 million euros or 7% of worldwide annual turnover.

On the downside, the network of competent authorities may be too broad thereby, hindering truly effective coordination: AESIA, the Data Protection Agency and its regional counterparts, the General Council of the Judiciary (CGPJ), the Bank of Spain, the CNMV (National Securities Market Commission), the Directorate General of Insurance, and the sectoral authorities listed in Annex I. In fact, the text provides for a Joint Cooperation Committee, whose decisions are not binding on either the Judiciary or the independent administrative authorities, which means that a coordination body is created, but it lacks full capacity to impose  uniform criteria.

Furthermore, it is quite unusual that the Draft grants AESIA sanctioning powers with immediate effect, but at the same time postpones certain aspects of its structure to subsequent development by Royal Decree, which the Government must approve within six months.

In addition, we must highlight the difference between private companies and the public administration. As previously mentioned, a private operator that engages in a prohibited practice may be fined up to 35 million euros. However, if the public administration commits the same infraction, it will only receive a warning, requiring corrective measures and, where appropriate, potentially subjecting the employees involved to disciplinary action. In other words, the State holds itself to lower standards than it expects of the citizens.

Given that the primary objective of the Draft is product safety and the protection of fundamental rights, the Draft hardly regulates the cultural sector, and when it does, it is only in an indirect manner. In this area, other regulations remain crucial, such as the Consolidated Text of the Intellectual Property Law, the data mining exception, and the European Code of Good Practice for General-Purpose Models. Moreover, the Draft does not cover the supervision of general-purpose artificial intelligence models, a competence that the Draft directly assigns to the European Commission.

Nonetheless, the Draft is indeed relevant to the cultural sector in relation to the transparency obligation set forth under Article 50 of the AI European Regulation, which requires to label synthetic audio, image, or video content, as well as to identify deepfakes, establishing penalties of up to seven and a half million euros. In this sense, as far as we are concerned, this regime could serve as a deterrent to prevent situations where a performer´s voice appears -cloned and not labeled as being AI generated- on a platform.

As mentioned previously, this Draft seeks to establish a system of oversight and a sanctions regime. In other words, it serves to track down deep-fakes that are not labeled, but not to determine whether an actor's voice could have been used to train the machine that now imitates the actor. While we welcome this law, with its strengths and weaknesses, the cultural sector must continue to fight for proper regulation that ensures the survival of creators and goes beyond simply establishing potential sanctions for offenders.