The legal landscape in Spain for those—whether natural persons or small self-employed workers—who attempt to deceive other businessmen and women using artificial intelligence in sectors such as transport and logistics has undergone a radical transformation in 2026. Last May 26, the Council of Ministers approved the draft Organic Law for the proper use and governance of artificial intelligence, a regulation that transposes the European AI Regulation (AI Act) into the Spanish legal system. This European regulation came into force in 2024 and its general obligations will be fully applicable as of August 2, 2026. This new legal framework, which adds to existing provisions such as the Digital Services Act or the Criminal Code itself, configures an unprecedented regulatory ecosystem to combat digital fraud.

The heart of this new legal architecture is a risk-based approach, where AI systems are classified according to their potential to cause harm. For transport and warehousing entrepreneurs, this implies that any use of AI that could be considered of “unacceptable risk” would be directly prohibited. This includes, for example, the use of subliminal or manipulative techniques to deceive other businesses, such as a system that, by simulating being a legitimate commercial partner, induces error regarding the availability of goods or transport capacity. The regulation pursues with particular harshness those systems that exploit vulnerabilities or generate deepfakes to commit scams—a growing risk in a sector where trust and immediacy are the currency of the realm.

The sanctions for incurring in these deceptive practices are of a magnitude designed to deter any potential offender, from the large logistics operator to the small self-employed worker. For the most serious infringements, fines can reach 35 million euros or, if this figure is higher, up to 7% of the infringing company’s total worldwide annual turnover. Even less serious infringements can carry penalties of up to 500,000 euros. This sanctioning regime, which aligns with the European AI Act, does not distinguish between large corporations and small self-employed workers; both are subject to the same obligations and, therefore, to the same consequences if it is proven that they have used AI to deceive other business owners.

The responsibility for ensuring compliance with these regulations falls on the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), which will see its role reinforced as an independent authority to supervise and sanction. The draft law establishes a sanctioning procedure that ranges from minor to very serious infringements, with the power to impose progressive fines. For self-employed workers and small businesses in the transport sector, this means they must carry out an exhaustive inventory of all the AI tools they use (from chatbots for order management to route optimization systems), classify them according to their risk level, and ensure they meet all transparency and documentation requirements.

The transport and warehousing sector, due to its digitized nature and dependence on automation, is in the crosshairs of this regulation. AI has become the engine of operational efficiency for fleet management, route optimization, and inventory control. However, this same technology can be used maliciously, for example, to manipulate demand forecasting systems, falsify shipment tracking data, or simulate identities on service contracting platforms, thus harming other operators. The new law forces companies to rethink their data governance and the architecture of their AI systems, demanding a level of human oversight and control that was previously unnecessary, which represents both a challenge and an opportunity to professionalize the sector.

In short, the year 2026 marks a before and after in the fight against digital deception in the Spanish business sphere. The legal framework is no longer a set of scattered rules, but a coherent and severe framework that, led by the AI Law, aims to curb abuses. For the transporter or warehouse manager, the recommendation is clear: the era of uncontrolled technological experimentation is over. The new legislation demands rigorous compliance, and the cost of deception, or even of mere negligence, can literally be millions of euros.