1. Legal Framework - Spain - Multi-Layer

A. EU Level - Directly Applicable in Spain from 2024-2026:

EU AI Act Regulation 2024/1689 - 13 June 2024:

• Financial sector classified as High-Risk due to use of AI systems that influence creditworthiness, risk scoring, customer profiling.
• Requirements: Risk management system, data governance, technical documentation, human oversight, transparency, accuracy, conformity assessment before deployment.
• Spain is set to become first EU state to implement aspects of AI Regulation ahead of schedule.

DORA - Digital Operational Resilience Act Regulation EU 2022/2554 - In force 17 Jan 2025 in Spain:

• Governance requirements for distributed financial networks, expert systems.
• Must manage concentration of critical ICT providers [AWS, Cloudflare, Chainlink oracles for DLT]
• Supervision by Bank of Spain and CNMV.

GDPR + AEPD [Spanish Data Protection Authority]:

• Automated decision-making Art 22 GDPR - right not to be subject to solely automated decision including profiling that produces legal effects.

B. Spanish National Level:

Draft Bill on Proper Use and Governance of AI - Public consultation opened 18 March 2025:

• Establishes domestic governance and enforcement framework across full AI value chain.
• Creates Spanish AI Supervisory Agency with sanctioning powers.
• Dedicated complaints channel and whistleblower protection.
• Art 64.4.d Workers' Statute: Legal representatives' right to be informed by employer of parameters, rules, instructions forming basis of algorithms or AI systems having effect on working conditions, including profiling.
• Collective bargaining agreement for banking industry recognises use of AI can bring changes - must inform unions.

AEPD Innovative Project - CaixaBank Prize:

• AEPD awarded prize to CaixaBank for innovative project Evolution of supervision and governance of data protection aimed at meeting new challenges of AI and threats to information security submitted by DPO Pablo Díaz Ortiz. Model for privacy governance for AI in banking.

2. Governance Architecture - Expert Systems in Bank

Spanish doctrine proposes Five Beacons Model - President of Spanish BPO Banking Association paper:

A prudential architecture for AI explainability and legal liability in banking. Vertical liability-oriented governance ensuring decision-centric traceability across 5 institutional nodes:

1. Machine Interface
2. Engineering Layer
3. Human Supervision
4. Corporate Governance
5. Client Communication

Plus new concept of Reconstructibility - working papers on AI Governance in Banking:

Institutional capacity to recover causal chain linking data, models, outcomes to attributable responsibility when decisions challenged. In high-risk environments, explainability may not be sufficient, reconstructibility required.

Banco Sabadell Case - Nov 2025:

• Spain's 4th largest banking group accelerates adoption of agentic AI at scale, agreement with T-Systems [Deutsche Telekom] to build technological and governance foundations needed to scale agentic AI across Group while driving operational efficiency for 7 million customers, ensuring technological sovereignty.

3. Case Laws - Spain - The Core

A. BOSCO Case - Algorithmic Transparency - Landmark for All Expert Systems

Tribunal Supremo, Sala de lo Contencioso-Administrativo, 11 September 2025, No. 1119/2025 - Cassation 7878/2024 - Civio Foundation v. Spanish Administration

Facts: BOSCO is software created by Spanish Ministry of Ecological Transition to determine which citizens eligible for social electricity subsidy bono social eléctrico - aid for vulnerable consumers managed through energy companies. Civio Foundation found software turning down eligible applications after dozens of calls from wrongly dismissed applicants. Requested access to source code under Transparency Law. Administration denied citing IP and security.

Held - Supreme Court:

Computer applications and their source code, when held by public administration and used in determination of public rights, especially entitlement to social benefits, must be disclosed. Source code is mechanism of algorithmic transparency.

Court ordered Administration to disclose source code of BOSCO algorithm. Recognized constitutional right to access, at least in part, source code of algorithms used in public administration when those algorithms determine public rights. Neither security reasons nor intellectual property can justify total denial of citizen's right to information - assessed case-by-case.

Impact for Banking: Although not banking case, it is binding precedent [jurisprudencia] with erga omnes effects. White & Case AI Watch notes: BOSCO litigation relevant background for algorithmic transparency and access to algorithmic source code. If public administration must disclose source code, banks using expert systems for credit decisions must disclose parameters, rules, instructions under GDPR Art 22 + Workers Statute 64.4.d + AI Act transparency. Bank cannot claim trade secret to deny explanation to customer whose loan rejected by AI.

B. Banking Liability for Expert System Failure

2. Tribunal Supremo Spain STS 571/2025 - Ibercaja Phishing - 9 April 2025 - Most Recent

• Facts: Bank failed to prevent suspicious transactions such as multiple transfers at unusual times for large amounts. Customer claimed fraud via phishing, bank claimed customer negligence.
• Held: Bank must prove system operated flawlessly. Quasi-objective liability under PSD2 + failure of DETECT controls under NIST. Bank liable if expert fraud detection system fails.
• This applies to all expert systems for AML, fraud - if your AI does not flag unusual pattern, bank liable.

3. Tribunal Supremo - Validity of Electronic Signature & Expert System Audit Trail

• Case 2: Bankia vs Grupo Inmobiliario 2022 + STS 2020-2021 Advanced Electronic Signature
• Supreme Court upheld validity of contract signed with advanced electronic signature because signature creation process included audit trail and two-factor authentication as key factors.
• For expert systems: Must maintain reconstructible audit trail.

C. Automated Credit Scoring

4. AEPD v. Banco Santander (2020) - Automated Credit Scoring

• Spanish Data Protection Agency sanctioned Banco Santander for automated decision-making without adequate information and human intervention. Bank used expert system for loan denial based solely on scoring, no human review, no explanation of logic.
• Held: Violates Art 22 GDPR - customer has right to obtain human intervention, express point of view, contest decision. Bank must inform logic involved, significance, envisaged consequences.
• Similar to GDPR cases across EU.

5. Right to Honour vs Creditworthiness Files - Tribunal Supremo STS 672/2014, 19 Nov; STS 6 March 2013 RJ 2013/2587; STS 12/2020 Vodafone

• Supreme Court on inclusion in creditworthiness files [ASNEF, Equifax] via expert systems - bank must ensure data accuracy, cannot automatically include customer without prior warning. Expert system that auto-reports default without verification violates honour.

D. Product Liability for AI Malfunction

6. Tribunal Supremo - Liability for AI Malfunction in Autonomous Vehicles (2021) - Extended to Banking Robo-Advisors

• Court held manufacturer liable under Product Liability Law even without direct human negligence.
• Transplanted to banking: If robo-advisor expert system gives erroneous investment advice causing loss, bank as deployer liable under product liability + MiFID suitability.

4. Spain's Compliance Checklist for Bank Expert System - 2026

Before deploying credit scoring AI:

1. Classify risk under EU AI Act - High-risk = conformity assessment, technical documentation, EU database registration.
2. Human Oversight: Art 14 AI Act - Human must be able to override, understand limitations, be aware of automation bias. Cannot be fully automated denial.
3. Transparency to Client: Provide clear information that AI used, logic, parameters - per BOSCO precedent, cannot hide behind IP.
4. AEPD Governance: Appoint DPO, conduct DPIA, implement CaixaBank-style privacy governance model.
5. Workers Information: Inform union representatives of parameters per Art 64.4.d.
6. DORA Resilience: Test ICT resilience, concentration risk, exit strategy from cloud provider.
7. Reconstructibility: Must be able to reconstruct causal chain data -> model -> decision for regulator / court.

Sanction: Spanish AI Supervisory Agency can fine up to 35M EUR or 7% global turnover under AI Act.