Workplace algorithms in Spain: what you must tell your staff from 5 October

What has changed

Royal Decree 723/2026, of 9 September, was published in Spain's Official Gazette (BOE) on 15 September and came into force on 5 October 2026. It transposes the EU directive on transparent and predictable working conditions and replaces the old Royal Decree 1659/1998 on the information employers must give each employee.

The change that matters most to anyone using automation or AI is in Article 3.2.k: employers must inform employees in writing of the existence of algorithmic or automated decision-making systems and, when they are used to decide on working conditions, also of their guidelines, criteria and operating rules.

On 7 October, the Spanish Data Protection Agency (AEPD) published a note on how this duty fits with the GDPR. Its core idea fits in one sentence: the decree is not a licence to use algorithms, but an additional duty to inform about their existence and how they work.

Who it affects

Any company with employment contracts longer than four weeks that uses an automated system to make decisions about its staff. There's no size exemption, so a small business is as bound as a large one.

The decisions the decree mentions are:

• Working hours: rotas, shifts, on-call duty.
• Task assignment: distributing cases, orders, clients or routes.
• Pay: commissions, variable pay, bonuses.
• Career progression: performance ratings that count towards a promotion.
• Place of work and termination of the contract.

What counts is the use, not the technology. As Merca2's analysis puts it, a system is in scope when its output (a score, a ranking, an alert or a recommendation) is systematically used to set or change working conditions, even if a person then applies it. Software that only stores documents or records working hours doesn't decide anything.

Watch out for a case we see more and more: an AI agent that distributes incoming work across the team. If it decides who handles each case or client, it's assigning tasks, and that falls squarely within scope.

What to provide, when and how

Two points from the AEPD's note worth noting:

• A reference to the collective agreement isn't enough. Information about algorithms is not among the items that can be covered by simply referring to the law or the collective agreement. It has to be explained specifically.
• Don't wait for the official template. The decree asks the Spanish public employment service (SEPE) to publish a template, but the AEPD points out that the obligation applies whether or not it is available.

Three different duties for the same system

The easiest mistake is to think one document covers everything. The AEPD distinguishes three levels, each with its own audience and content:

1. Each employee (Royal Decree 723/2026): that the system exists and, if it decides on working conditions, its guidelines, criteria and rules.
2. Employee representatives, if any (Article 64.4.d of the Workers' Statute): the parameters, rules and instructions behind the algorithms or AI that affect working conditions, access to employment and profiling.
3. Candidates and affected employees (GDPR): purpose, legal basis, data, retention and rights and, where there are significant automated decisions, meaningful information about their logic and consequences.

Treating one as covering another is exactly what the AEPD warns against. We cover the data protection risks of agents in AI agents in business: risks, GDPR and the AI Act.

The AEPD warning: the person must really decide

The note builds on a warning the AEPD made public on 23 September to a company preparing an AI tool to score and rank CVs. The tool wasn't live yet, and the company said a person would make the final decision and that no sensitive attributes would be analysed. Even so, the Agency set out what it expects:

• Assess the risk first and carry out an impact assessment if the risk may be high.
• Data protection by design, not bolted on at the end.
• Clear, understandable information for candidates and employees.
• Effective human intervention: the reviewer must be able to weigh the score critically and depart from it, not just accept it.

The note goes further: the reviewer needs to know the system's limitations, see the relevant factors and have the time and authority to change the outcome. It recommends logging disagreements with the automated recommendation, because a systematic absence of disagreements may show that, in practice, people are approving without looking. It's the same approach we argue for in supervising AI agents.

Nor is it enough to say the tool "doesn't use sensitive data": you have to check that other variables don't let it infer them. And if the system was built by another group company or a vendor, responsibility still lies with whoever uses it.

Checklist for a small business

Adapted from the steps the AEPD recommends before deployment:

1. Take inventory. List every tool, including third-party ones, that supports or makes decisions on candidates, shifts, tasks, performance, pay, promotion or dismissal.
2. Document each one. Purpose, data used and where it comes from, main variables, decision rules and the real role of the reviewer.
3. Settle the legal fit. Legal basis, whether GDPR Article 22 applies, risk level, whether an impact assessment is needed and the classification under the AI Act (summarised in the AI Act after the Digital Omnibus).
4. Write the explanation separately for employees, candidates and representatives, and test it with examples: which factors can count for or against.
5. Design the oversight with authority to correct, enough time and a log of disagreements.
6. Keep evidence of delivery, each update, system changes and incidents.

How we do it at Amud

Every AI agent we build has a written job description: what it does, with which data, which rules it follows and what a person must approve. That same documentation is the basis for the information Royal Decree 723/2026 requires. Every decision is also logged with its author and the reviewer's corrections, so disagreements can be measured from day one. If you already use a system that distributes work or evaluates your team, we'll help you inventory it and get it documented.