Literacy for everyone, certification for approvers, and a renewal cycle that keeps both current: that is what organisations in Spain need before AI agents act. Article 4 of the EU AI Act sets the literacy expectation, GDPR and the AEPD govern personal data, and Banco de España supervises the banks that will ask the hardest questions about oversight.
What should literacy cover for Spanish teams?
Literacy for agents is practical. Staff should be able to read what an agent did and why, in the language they work in, whether that is Spanish, Catalan, Basque, Galician or English. The core concepts are the same everywhere:
- Depth, held by the agent and needed by each action: 1 read, 2 draft, 3 routine work within bounds, 4 money or hard-to-undo actions, 5 coordinating other agents.
- The four verdicts: allowed, held for a named person, refused as outside bounds, withheld at the platform floor.
- Provenance: sealed, signed, declared or external. An external claim cannot authorise a payment.
- The record: every verdict is filed in an append-only log that names who released each held action.
Which Spanish and EU rules shape it?
Spain applies the EU framework through national authorities. Banco de España supervises banks; the AEPD enforces GDPR. Article 4 of the EU AI Act asks deployers to ensure sufficient AI literacy among staff who operate AI systems. Article 14 requires human oversight for high-risk systems, and GDPR Article 22 limits decisions based solely on automated processing with legal or similarly significant effects. Health data is special-category data under GDPR, which raises the bar for hospital teams. DORA applies to financial entities' ICT risk.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who keeps which decision?
Take a logistics operator running a hub that serves several Spanish regions. An agent handles delivery exceptions and carrier invoices:
| Task | Agent | Person |
|---|---|---|
| Reading tracking and warehouse data | Depth 1 | Interpreting a pattern of failures |
| Drafting a notice to a customer or carrier | Depth 2 | Sending it |
| Rebooking a failed delivery within limits | Depth 3 | Exceptions outside the limits |
| Paying a carrier invoice | Prepares and holds at depth 4, if certified | Releasing it after checking the payee |
The operations manager brief for logistics in Spain covers the role that owns that table.
Why does recertification matter as much as first certification?
Agents do not stay still. An agent's certificate lapses after 90 days unless it passes again, and a run that clears no depth drops it to depth 1 the same day. New capabilities arrive, sources change, and the organisation's own limits move. An approver trained a year ago on a drafting agent may now be releasing payments.
Recertification keeps people in step. It should be short, focused on what changed in the product and the agent's capabilities, and recorded against the same credential. Tie approval rights to a current credential so an expired one removes the right without anyone having to remember.
What does this look like in a Spanish hospital?
An IT administrator in a hospital connects an agent to the scheduling system and the patient record. The agent reads appointment data at depth 1 and drafts rescheduling messages at depth 2. The administrator decides which sources the agent may read and which it may not. Because health data is special-category data, the narrowest workable access is the right default. The IT administrator brief for healthcare in Spain sets out the role. For the full model, see AI literacy and certification for people who work with agents, and compare Germany.
Where the Academy fits
Pryme Intelligence Academy's Operator certificate is valid for 12 months, and renewal is an update module and a short quiz. Lessons can be read or listened to as audio, and module tests are set in the learner's own industry and role, which suits teams spread across regions and shifts.
Questions people ask
Does Article 4 require training in Spanish?
It requires sufficient literacy, judged by role and context. Training in the language people work in is the sensible way to reach it, and tests should use cases from their own work.
How is a person's renewal different from an agent's re-certification?
An agent re-certifies against your real cases every 90 days. A person renews their credential on a longer cycle, focused on what changed in the product and in their role.
Who should own the training record in a Spanish bank?
Usually the compliance or operational risk function, so that it can be shown to Banco de España alongside the record of agent decisions.