Royal Decree 817/2023 establishing a controlled testing environment for testing compliance with the proposed AI Act

I. GENERAL PROVISIONS MINISTRY OF ECONOMIC AFFAIRS AND DIGITAL TRANSFORMATION 22767 Royal Decree 817/2023, of November 8, establishing a controlled testing environment for testing compliance with the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence.

I Artificial intelligence is a disruptive technology with a high capacity for impact on the economy and society. From an economic perspective, along with other digital technologies, it presents high potential for increasing productivity, opening new business lines, developing new products or services –based, for example, on personalisation, optimisation of industrial processes or value chains–, improving the ease of performing everyday tasks, automating certain routine tasks, and fostering innovation. This potential positively impacts economic growth, job creation, and social progress.

However, artificial intelligence systems can also pose risks to the respect of citizens' fundamental rights, such as those related to discrimination and the protection of personal data, or even cause serious problems for citizens' health or safety.

For this reason, the European Commission has presented a proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence, with the aim of ensuring respect for citizens' fundamental rights and generating trust in the holistic development and use of artificial intelligence in the economy and society. The aforementioned Regulation seeks to provide the European Union with a regulatory framework in order to promote reliable, ethical, and robust artificial intelligence.

The proposal does not regulate the technology itself, but rather high-risk applications of artificial intelligence. This proposal for a Regulation is currently being negotiated in both the Council of the European Union and the European Parliament, which have already published their positions with the amendments proposed by both institutions.

In this context, the Government of Spain, in collaboration with the European Commission, is launching the first controlled testing environment to check how to implement the requirements applicable to high-risk artificial intelligence systems under the European proposal for an AI Regulation, with the aim of obtaining, as a result of this experience, evidence-based and experimental guidelines that facilitate alignment with the European Artificial Intelligence Regulation proposal for entities, especially small and medium-sized enterprises (SMEs), and for society in general. During the development of this controlled testing environment, the position of the Council of the European Union of 25 November 2022 will be used as a reference, as explained in Annex I.

This controlled testing environment also enables cooperation between users and artificial intelligence providers, validating from both perspectives the implementation of requirements for both high-risk artificial intelligence systems, as well as general-purpose systems and foundational models, with respect to compliance with the requirements of the future European regulation.

OFFICIAL STATE GAZETTE No. 268 Thursday 9 November 2023 Sec. I. Page 149138 cve: BOE-A-2023-22767 Verifiable at https://www.boe.es

Therefore, the object of this environment will be to study the operability of the requirements established in the European Regulation proposal, the carrying out of a self-assessment of compliance with them, and the evaluation of the post-commercialisation plan for the artificial intelligence systems of the participating entities. This initiative is expected to result in the development of a report containing best practices and conclusions obtained, as well as technical execution and supervision guidelines based on evidence and experimentation. This documentation may be made available to the European Commission for the development of European guidelines, and to standardisation bodies as a contribution to the standardisation process, as well as to society as a whole.

II This initiative is part of the Spanish digital transformation strategy, Agenda España Digital 2026, which frames the Spanish Government's roadmap to drive the country's digital transformation process. This agenda unites the strategic pillars on which Spain's economic recovery will be based to achieve more intense and sustained growth, rich in quality employment, with higher productivity, and contributing to social and territorial cohesion, providing prosperity and well-being for all citizens.

Agenda España Digital 2026 is structured into three dimensions: infrastructure and technology; businesses; and people, in which twelve axes of action are organised. Specifically, the axis of digital rights stands out, which is of great importance to ensure that the process of change involved in digital transformation puts the individual at the centre. Spain has made humanist digitalisation the core of its digital transformation, ensuring that the principles, values, and rights that are the basis of our democratic society are also the basis of digital interactions and to guarantee the incorporation of the gender perspective in AI.

This initiative also finds its place in the Recovery, Transformation and Resilience Plan, where ten leverage policies are based, divided into a series of structural investments and reforms. These interrelate and feed off each other and are supported by four pillars that will structure the transformation of the entire Spanish economy: energy transition, digital transformation, social and territorial cohesion, and gender equality, the latter being transversal in nature.

In particular, it is inserted into axis 6 within the National Artificial Intelligence Strategy (ENIA), which within the framework of the Recovery, Transformation and Resilience Plan corresponds to Component 16. This component aims to support the massive deployment and use of artificial intelligence by large companies, Public Administrations, small and medium-sized enterprises and emerging companies, and civil society.

The rule is issued in accordance with the authorisation provided for in Article 16 of Law 28/2022, of 21 December, on the Promotion of the Ecosystem of Emerging Companies, which contemplates the creation of controlled environments, for limited periods of time, to evaluate the usefulness, viability, and impact of technological innovations applied to regulated activities, the offering or provision of new goods or services, new forms of provision or delivery of the same, or alternative formulas for their supervision and control by competent authorities. The same law states that the creation of controlled testing environments for the evaluation of their impact is justified by imperative reasons of general interest.

It should be noted that, inspired by the Digital Rights Charter, this initiative aims to give concrete and practical form to the Spanish commitment to "establish an ethical and regulatory framework that strengthens the protection of individual and collective rights" by advancing the roadmap established by said Charter to guide Spain's humanist digital transformation.

OFFICIAL STATE GAZETTE No. 268 Thursday 9 November 2023 Sec. I. Page 149139 cve: BOE-A-2023-22767 Verifiable at https://www.boe.es

Participating entities must comply with the European and national regulations applicable to them and, in particular, with what is provided in Regulation (EU) 2021/241 of the European Parliament and of the Council, of 12 February 2021, establishing the Recovery and Resilience Facility.

Regarding participation, any entity selected to participate in this environment must be subject to Spanish jurisdiction, so it is mandatory that they be entities resident in Spain or having a permanent establishment in Spain.

In this regard, it must be indicated that the Treaty on the Functioning of the European Union (TFEU) prohibits in its Article 63 restrictions on the movement of capital between Member States of the European Union and between Member States and third countries. However, Article 65.1.b) of said Treaty allows Member States of the European Union to take measures justified by reasons of security, public order, and public health.

In the present case, taking into account that the requirements to be checked are those applicable to systems classified as high-risk or general-purpose systems and foundational models, there is a possibility that they may interfere with public order or public health in Spain. In the absence of a harmonised legal framework for artificial intelligence systems before the adoption of the aforementioned Regulation, the Spanish State may require that, within the scope of this experiment, entities that participate, if they are not resident in Spain, are obliged to have a permanent establishment in Spain, or be part of a grouping of entities where the representative of the grouping or the single attorney, being a member of the same, is the participating entity and whose domicile or main establishment is necessarily located in Spanish territory for the purposes of Article 9 of Royal Legislative Decree 1/2010, of 2 July, approving the consolidated text of the Capital Companies Law.

Although it is true that within the scope of the controlled testing environment, it is not foreseen that income will be generated for the applicant entities, their participation in this experience implies the voluntary dedication of time and resources, which justifies the requirement of a permanent establishment from a point of view of relations with the Public Administration.

III With the proposal for the Regulation laying down harmonised rules on artificial intelligence, a harmonised European regulation based on the risks derived from artificial intelligence systems is established. Harmonised rules are established for the development, placing on the market, and use of artificial intelligence systems in the European Union, with a significant focus on "high-risk" artificial intelligence systems for health and safety or the fundamental rights of persons.

In this sense, the Ministry of Economic Affairs and Digital Transformation promotes the regulation of the selection procedure for the artificial intelligence systems that will participate in the controlled testing environment, whether they are high-risk systems, general-purpose systems, or foundational models, as well as the role of the users who use them, the providers of the artificial intelligence systems that develop them, the elements that the latter must implement, the verification of their correct implementation, the monitoring model, and the support channels for these activities.

In the case of general-purpose systems, they are included in the scope of this controlled testing environment because they can be used in a plurality of contexts and integrated into multiple artificial intelligence systems and have, consequently, significant potential to be transformed into high-risk artificial intelligence systems.

Similarly, in the case of foundational models, these are based on standard ideas in transfer learning and recent advances in deep learning and computer systems applied on a large scale, demonstrate emergent capabilities, and can improve performance in a wide range of subsequent tasks.

On the other hand, any private entity, Public Administration, or public sector entity that develops an artificial intelligence system under its own name or commercial brand, exercising the role of provider of artificial intelligence systems, may participate in the experience of checking the requirements.

Additionally, private entities or any of the public administrations and institutional public sector entities in Spain may access the controlled testing environment exercising the role of user of those artificial intelligence systems provided by the providers, and their participation is subject to the approval and participation of the provider of artificial intelligence systems.

Both artificial intelligence systems that are commercialised and whose development is undergoing a phase of substantial changes that facilitates the introduction of the necessary measures to comply with the European Artificial Intelligence Regulation proposal, or that, although not commercialised, have reached a sufficiently advanced level of development to be commercialised or put into service within the temporal framework of the environment, will be selected for this environment.

For the selection of participating entities in said environment, a call will be published specifying the details of interest and requirements for participation. Once the applications are evaluated, participation will be authorised for the selected entities, which will receive preliminary guidelines and technical specifications that facilitate the implementation of the requirements imposed on high-risk systems by the European Artificial Intelligence Regulation proposal.

Once the participating entities carry out this activity within the scope of the environment, they must carry out a self-assessment of compliance with the requirements of the artificial intelligence systems. This self-assessment of compliance has no effects outside the strict scope of this environment.

On the other hand, in those cases where artificial intelligence systems may fall within the scope of specific sectoral legislation and are obliged to carry out a conformity assessment, this must be carried out independently of the self-assessment of compliance that will be carried out in the controlled testing environment. The relevant notified authority that will carry out the sectoral conformity assessment as a third party may associate as an observer of the self-assessment of compliance in said environment.

During the development of the experience, an exchange of information will take place between the participating entities and the State Secretariat for Digitalisation and Artificial Intelligence regarding possible improvements to be included in the preliminary guidelines and technical specifications. This will allow the update of the preliminary guidelines and technical specifications, which will subsequently be published as final implementation guidelines and made available to society as a whole.

The results obtained from the controlled testing environment may serve as the starting point for a future software platform that facilitates a first non-binding self-assessment on the compliance with the principles of the Artificial Intelligence Regulation proposal.

IV The Royal Decree is structured in a preliminary title and two titles and seven annexes. The preliminary title contains the general provisions, establishing its object and scope of application, as well as the definitions of the main concepts for the purposes of the rule.

Title I is structured in six chapters through which the requirements for eligibility and participation in the controlled testing environment are specified, for which the applicable legal regime is regulated; the figure of the artificial intelligence system provider; the eligibility criteria; the mode of participation and admission procedure; the way in which applications will be evaluated; the particularities and specific conditions for the development of this experience, and the guarantees of the participating entities; the communication channels and the conclusion of the experience in the environment.

In order to enable participation in the controlled testing environment, specific calls will be held in which providers of artificial intelligence systems that meet the specific participation and eligibility conditions can submit an application. Subsequently, the applications will be evaluated to ensure the participation of a wide variety of high-risk, general-purpose, and foundational artificial intelligence systems as well as a great diversity of entity typologies. After the resolution of admission of the same, the experience may begin.

Title II contains a series of provisions relating to collaboration and coordination between authorities, expert advisors, and other Spanish and European bodies.

In its additional provisions first and second, the means as well as the expected results of the controlled testing environment are indicated, respectively, and in its final provisions first and second, the competent title as well as its validity and entry into force are indicated, respectively.

This Royal Decree will enter into force the day after its publication in the "Boletín Oficial del Estado", justified by the urgency to start the functioning of the controlled testing environment. Furthermore, the Royal Decree will not maintain its validity at the moment when the Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence becomes effective in the Kingdom of Spain, which will be adopted by the co-legislators of the European Union. The controlled testing environment is subject to the rules established by this Royal Decree.

V The controlled testing environment constitutes an initiative with a high component of innovation in the current framework. The project, which falls within the competence area corresponding to the State Secretariat for Digitalisation and Artificial Intelligence, represents an opportunity for the exploitation of synergies in the field of artificial intelligence in accordance with the rest of the actors of the European Union and its Member States.

Artificial intelligence is called to be a transversal element in the economic and social development of any advanced context. Based on this, it corresponds to the public powers to promote and support accordingly according to the competence and regulatory area that corresponds to it.

The creation of the controlled testing environment, the object of this Royal Decree, does not constitute the establishment of any competitive advantage in the business sector nor a disruption of the market related to this matter. This is justified on the basis that both the call for participation in the environment, its development, and the subsequent elaboration of conclusions will translate into the publication of practice guidelines available to the public. Likewise, it can also be made available to the European Commission and other public and private actors competent and interested in the matter.

The participation in the experience by the entities selected after the corresponding procedure implies inclusion in a collaborative learning and co-decision system; the results of this have as their main purpose to generate a benefit applicable to the entire civil society and in the economic sphere. On the other hand, the creation of the environment represents a great advance from the perspective of the public sector, as it will allow conscious learning in the field of artificial intelligence given its dynamic nature.

This Royal Decree responds to the principles of necessity, effectiveness, proportionality, legal certainty, transparency, and efficiency, as required by Article 129 of Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations.

To this end, the compliance with the principles of necessity and effectiveness is highlighted given the general interest in experimenting with artificial intelligence systems the execution of the proposal for the Regulation laying down harmonised rules on artificial intelligence in favour of respecting the rights of citizens in their interaction with artificial intelligence, as well as the need to facilitate such compliance through execution guidelines for all those who develop high-risk artificial intelligence systems, general-purpose systems, and foundational models, and in particular, for small and medium-sized enterprises. It is considered that the Royal Decree is the most suitable instrument to guarantee the achievement of the described objectives.

The rule is in accordance with the principle of proportionality, as it does not go beyond what is necessary regarding requirements for participating entities in the environment and establishes the necessary framework for the achievement of the previously mentioned objectives.

Likewise, it complies with the principle of legal certainty, being coherent with the rest of the legal system and integrated into it.

Regarding the principle of transparency, it is fulfilled since the Royal Decree has been submitted during its elaboration to the consultation processes required by Article 26.6 of Law 50/1997, of 27 November, on the Government, through its publication on the web portal of the Ministry of Economic Affairs and Digital Transformation. Finally, regarding the principle of efficiency, in this Royal Decree, it has been sought that the rule generates the least possible administrative burdens for citizens.

This rule is issued by virtue of exercising the legal and constitutional authorisation provided for in Article 97 of the Spanish Constitution, under which it corresponds to the Government to exercise regulatory power in accordance with the Constitution and the laws.

This Royal Decree is issued under the provisions of Articles 149.1. 13th and 15th of the Spanish Constitution, which attribute to the State exclusive competence over the bases and coordination of the general planning of economic activity and exclusive competence in matters of promotion and general coordination of scientific and technical research.

The establishment of a controlled testing environment corresponds to the competence area of the State Secretariat for Digitalisation and Artificial Intelligence as set out in Royal Decree 2024/2023, of 28 March, by