Digital Services Act in Spain: From Entry into Force to 2026 Regulatory Milestones

The Digital Services Act (DSA) is not an isolated rule but the result of long negotiations within the European Union to create a single, secure digital space. Its primary objective is to establish a clear set of rules applicable across the EU, protecting citizens' fundamental rights and facilitating the expansion of SMEs and startups in the digital market.

Before the DSA, platform regulation was fragmented and dependent on national legislations. The new law introduces a risk and size-based approach: the larger the platform and the closer it is to end users, the stricter its obligations. This approach seeks to balance innovation with consumer protection and online security.

The DSA officially entered into force on January 1, 2024, after being approved by the European Parliament and Member States. However, its application was phased. Basic obligations for online intermediaries began to apply from February 17, 2024, affecting all platforms with users in the EU, except micro and small enterprises with fewer than 50 employees and a turnover below 10 million euros.

This February 2024 date marked the start of the obligation to provide means to flag illegal content, cooperate with trusted flaggers, and protect minors. The prohibition of targeting profile-based ads at minors and the restriction of ads based on sensitive data (such as political or religious beliefs) became immediate requirements for platforms.

In 2025, the Spanish Data Protection Agency (AEPD) published its annual report, reflecting a significant increase in regulatory activity. The AEPD received 30,931 complaints, a 64% increase compared to 2024, and fines reached 48.1 million euros. This increase was largely due to the consolidation of artificial intelligence as a central axis of supervision and the surge in security breach procedures, which jumped 157%.

The AEPD published the first public sector AI policy in Spain and prepared a joint GDPR-AI Act guide with the European Commission. This indicates that DSA supervision is not limited to content moderation but extends to personal data protection and algorithmic ethics, creating an additional compliance layer for digital platforms.

In 2026, the National Securities Market Commission (CNMV) presented its Activity Plan, which includes the introduction of new Artificial Intelligence tools in supervision and fraud prevention tasks. The plan identifies 60 specific initiatives in three areas: investor protection, market enhancement, and CNMV improvement. Content on cryptocurrencies and sustainable products will be reviewed, and monitoring of investment activity on social networks will be promoted.

This milestone is crucial because it connects digital services regulation with financial supervision. Platforms offering investment services or acting as intermediaries in the securities market must now comply with stricter algorithmic transparency requirements, especially regarding the marketing of complex products and the protection of retail investors.

Another key development in 2026 is the full application of the DORA Regulation (Digital Operational Resilience Act), which entered into force on January 17, 2025, but whose complete implementation is being consolidated in 2026. DORA establishes a uniform regulatory framework to strengthen cyber resilience in the financial sector, imposing clear obligations on financial entities and their third-party ICT service providers.

For essential service providers, this means they must comply with stricter risk mitigation requirements. The lack of uniformity in national regulations has been a historical problem, and DORA seeks to ensure that all EU financial entities, regardless of size, have the capacity to prevent, withstand, and recover from cyber incidents.

The impact of the DSA and 2026 milestones is tangible for businesses. Sanctions can reach up to 6% of annual turnover for platforms that fail to comply with the rules. This forces companies to invest in compliance systems, internal audits, and algorithmic transparency mechanisms. For users, it translates into greater control over their data, more options when browsing, and better protection against illegal content.

Companies must adapt their services to meet transparency obligations, especially regarding content moderation and advertising. Collaboration with trusted flaggers and the implementation of AI systems for fraud and illegal content detection are now key requirements. The practical decision for businesses is clear: investment in compliance is not optional but a strategic necessity to operate in the European digital market.