Plan IA360: The Complete Guide for Businesses

Spain's Prime Minister presented the Plan IA360 on 21 September 2026 (quotations from the Plan in this article are the author's translation from the Spanish original, which has no official English version). The event was titled "IA360: Plan for a Responsible Deployment of AI". The document runs to 15 pages — the last one blank — is organised into 8 areas of action and details 14 flagship projects, numbered 1 to 14. La Moncloa's press release describes it as "a roadmap with concrete actions to be carried out over the next 12 months" — that phrase comes from the press release, not the PDF itself; the Plan's own text notes that the areas "will be developed between 2026 and 2027". The stated goal: placing Spain among the world's five leading powers "through responsible and ethical AI".

What Is the Plan IA360 (and What It Isn't)

The starting point the Plan itself documents explains the ambition. Spain ranks 7th in the world and 2nd in Europe in Stanford University's AI dynamism index (November 2025, data through 2024), ahead of Japan, Canada, France and Germany, and has climbed from 31st place in 2019. In governance, the Plan places Spain in 2nd position worldwide and credits three assets: AESIA (Europe's first AI supervisory agency), an already-completed regulatory sandbox — the first in the Union — and the ALIA family of open models. In infrastructure, it also counts two operating AI factories, the BSC in Barcelona and the CESGA in Galicia.

The gap is in adoption: only 21.1% of businesses with 10 or more employees were using AI in the first quarter of 2025 (INE's ICT use survey), compared with 44.2% of the working-age population already using generative AI according to Microsoft (Q1 2026 data; Spain ranks 6th in the world for adoption). The Plan also acknowledges a talent weakness: 23rd in the world on that pillar and 25th of 32 in professional concentration.

With those numbers on the table, what matters is not whether the Plan is ambitious, but what changes tomorrow. The short answer: nothing, yet. The Plan IA360 is a political roadmap, not a piece of legislation. It does not alter a single legal obligation. What obliges anyone who uses or places AI systems on the market today remains the European Regulation, explained in the AI Act compliance guide. What the Plan brings is something else: a calendar of projects with future funding and, on a couple of very specific fronts, new compliance that will indeed reach those who work with public administration.

At a Glance: The 14 Flagship Projects

The Plan groups its 14 projects into 8 areas. This table summarises the goal and the dated milestone of each one, based on the document itself.

The Real Calendar, Month by Month

Of the 14 flagship projects, only seven have a milestone within 2026. The rest fall in 2027 or later.

What Happens in 2026

• October: approval of the data centre regulation and the post-quantum cyber shield pilot with the financial sector.
• October/November: the Spanish Post-Quantum Cryptography Modernisation Plan and the plan against offensive AI.
• Autumn: regulatory measures on talent and the Scale-ups Act.
• Before year-end: the technical core of the AI Safety Institute and the first Red NEURONA pilot (100 SMEs, two regions).
• 3 November: launch of the Ibero-American AI Alliance.

2027

• February: construction begins on the AI gigafactory.
• First quarter: negotiation with the regions on AI in the education curriculum, the first call for the AI Marathon, the WhatsApp 060 channel and the signing of the minors' protocol.
• First half: design and controlled pilot of the business AI voucher.
• During the year: the Carpeta Ciudadana assistant, citizen AI literacy, and the Red NEURONA rollout to 10 regions and 5,000 businesses.
• Before year-end: the general call for applications for the voucher (600 M€) and the pre-commercial launch of the cybersecurity shield.

2028-2030

• 2028: the AI gigafactory opens.
• 2028/2029: 100,000 AI accelerators in operation.
• 2030: from 21.1% to 55% of businesses using AI (Red NEURONA); 25,000 businesses transformed and 5x private investment (voucher); from 13 to 50 unicorns (Scale-ups Act).

This calendar belongs to the Plan, not to the AI Act: the dates that are already a legal obligation today are in the AI Act calendar.

What Obliges You Today, and It Isn't the Plan

The Plan IA360 does not change a single date in Regulation (EU) 2024/1689, the AI Act. That regulation has applied generally since 2 August 2026. Chapters I and II have applied since 2 February 2025, except for points (b bis) and (b ter) of Article 5(1) and paragraphs 1a and 1b, applicable from 2 December 2026. Chapter III Section 4, Chapters V, VII and XII, and Article 78 have applied since 2 August 2025 (except Article 101), and Articles 102 to 110 since 27 July 2026. For high-risk systems, Annex III has a deadline of 2 December 2027 and Annex I of 2 August 2028: these are the dates changed by Regulation (EU) 2026/1744, of 8 July 2026, the Digital Omnibus. The Omnibus did more than move dates: it rewrote Article 4 on AI literacy in full and inserted two new prohibitions into Article 5 — points (b bis) and (b ter) — plus two paragraphs, 1a and 1b, that limit their scope. The two prohibitions apply from 2 December 2026, and the regulation is explained in full in the Digital AI Omnibus. Which conduct is prohibited is covered in the prohibited AI practices in Europe; the SME reliefs are in the reliefs under Articles 11 and 63.

Spain still has no AI law of its own. The Draft Organic Law for the proper use and governance of artificial intelligence (file 121/000096) was tabled on 28 May 2026 and is before the Committee on Economy, Trade and Digital Transformation. Its amendment period, which was extended, expires on 23 September 2026. As of 22 September 2026 it remains in parliamentary process and has not been published in the BOE (Spain's Official State Gazette). What that bill regulates is covered in what Spain's draft AI law regulates. Something similar is happening with NIS2: as of 22 September 2026 no Spanish law transposing it has been published in the BOE, so the transposition remains pending.

One project in the Plan does connect with an obligation that already exists: the AI literacy strategy for citizens, free and with no prerequisites, planned for 2027. It is the citizen-facing side of an obligation the AI Act already imposes on businesses, since its Chapters I and II became applicable on 2 February 2025. It is worth reading that obligation in its current wording: the Omnibus replaced Article 4 in full, which today asks providers and deployers to adopt "measures to support the promotion of AI literacy" among their staff, and clarifies that it "does not require providers or deployers to guarantee any particular person a specific level of AI literacy". Further detail is in AI literacy under Article 4.

The Money: The Business AI Voucher and Red NEURONA

The business artificial intelligence voucher will fund AI services provided by European technology companies that use foundation models as an input and add their own value: development, integration, sector expertise, data processing or process redesign. The Plan says it plainly: "the voucher will not fund the mere subscription to licences". Its design — and the Plan writes this in the conditional tense — "would include milestone-based payments and conditions on AI training for workers", plus the incorporation of AI into internal processes, with a prior maturity diagnosis, a specific use case and a subsequent measurement of the impact on productivity. None of that is settled until there are regulatory bases.

The goal is to transform 25,000 businesses and multiply private investment fivefold by 2030 compared with 2024. But the design and regulatory preparation, with a controlled pilot, do not arrive until the first half of 2027, and the general call for applications — with €600 million in funding — is not rolled out until before the end of 2027. Today there are no regulatory bases, no call for applications, and no amount per business. What AI aid genuinely exists right now, as opposed to what circulates on social media, is covered in what AI aid is actually in the BOE.

One clarification is worth making: the Kit Digital and Kit Consulting programmes both have their calls for applications closed, and the IA360 voucher is not an extension of either. If you arrived here looking for those grants, here is the Kit Consulting programme and its artificial intelligence advisory service and the current state of its call for applications.

The voucher is linked to Red NEURONA: a public-private, territorial network of AI demonstration and deployment centres. In the Plan's own words, the business "sees artificial intelligence working in its sector, tests it with its own data and deploys it by subscription", within less than 50 kilometres. It draws on the AI Factories, the Spanish Supercomputing Network, RETECH, data spaces, technology centres and Acelera Pyme, and the Plan states that this process "can be particularly relevant for SMEs, which face a higher barrier to entry". Goal: from 21.1% to 55% of businesses using AI by 2030. The first pilot, 100 SMEs across two regions, arrives before the end of 2026; the rollout to 10 regions and 5,000 businesses comes in 2027. Where to start in the meantime is covered in the guide on where to start with AI in your SME.

If You Work With Public Administration, Here's What to Watch

None of these projects creates an obligation for a business today. What they announce is future regulation that, once approved, may indeed reach government suppliers and regulated sectors. That is why they are worth following — not because there is anything to comply with yet. AESIA will carry out AI Act market surveillance, backed by a new Artificial Intelligence Safety Institute created within it — the agency whose founding statute was approved by Real Decreto 729/2023, de 22 de agosto. Exactly what it does is covered in AESIA's functions.

The Institute will have agreements with INCIBE, the National Cryptologic Centre, the National Security Department, the AEPD (Spain's Data Protection Agency) and the BSC. It will evaluate the most advanced models before and after their deployment (early access through voluntary agreements with developers, cooperation with the European AI Office), set evaluation methodology, advise Spain's General State Administration with a periodic report on frontier models, define incident-response protocols for advanced models or agents, and cooperate with counterpart institutes in other countries. Milestone: initial technical core before the end of 2026.

The second front is post-quantum cryptography, and one detail stands out: the royal decree that puts it in place is the only milestone in that project the Plan leaves without a date. The advanced cybersecurity shield includes a Royal Decree with a common framework for the post-quantum transition "in the public sector and in areas subject to sector-specific cybersecurity regulation", preceded by a pilot with the financial sector (October 2026) and the Spanish Post-Quantum Cryptography Modernisation Plan, a consortium between SETT and a group of companies (October or November 2026). Anyone providing services under the ENS (Spanish National Security Framework) or under NIS2 obligations would do well to follow this closely, although the Plan does not specify how it will fit with each framework.

The third front: the Carpeta Ciudadana will add an assistant and bring in WhatsApp as a channel, "with the guarantees of the National Security Framework and of data protection regulations". WhatsApp 060 arrives in the first quarter of 2027; the assistant, during that same year. Among the assets the Plan credits itself with is the regulatory sandbox Spain has already completed, the first in the Union. That cycle has ended, so entering a new one will mean waiting for the competent authority to publish a call: how to take part in Spain's AI sandbox.

Data Centres: The October Royal Decree

The infrastructure area rests on two projects that go together. The AI gigafactory mobilises €5,000 million in public-private investment, of which €719 million is public money, and is linked to the PERTE Chip. The goal is "the largest computing infrastructure in southern Europe", with 100,000 accelerators operating in 2028 or 2029. Construction starts in February 2027; opening, in 2028.

That infrastructure needs rules: the draft Royal Decree on data centres regulates energy and environmental sustainability, resilience and digital sovereignty. MITECO opened the public consultation on 27 August 2026, and today the comment period has already closed. It sets general requirements for centres with a grid access capacity of 1 MW or more, and reporting obligations for those with IT capacity of 500 kW or more; it partially transposes Directive (EU) 2023/1791. The Plan justifies the urgency: grid access permits already requested "far exceed the 2.5 GW of effective demand […] projected for 2030". The regulation prioritises renewables and efficient use of water and land; the gigafactory will be designed to comply with it from the outset. Approval milestone: October 2026. The full file is in the ficha de audiencia pública del MITECO.

Talent, Scale-ups and R&D

The Plan acknowledges a weak starting position: 23rd in the world on the talent pillar of the AI dynamism index, and 25th of 32 in professional concentration. Two projects try to correct this, with regulatory measures announced for autumn 2026.

The first creates centres of national interest with greater agility to hire researchers, improves the scientific career path — internal promotion, seniority pay also for technical staff, and greater compatibility for public researchers with part-time teaching and research activities — and adds permanent reductions in Social Security contributions for staff dedicated to R&D and technological innovation.

The second is the Scale-ups Act, which continues the Startups Act: it extends support for up to five more years after the first five, and extends the seven-year limit already granted to science-based or deeptech companies — without the Plan specifying the new deadline — with more R&D&I deductions and incentives for hiring researchers. Goal: doubling the rate of businesses that scale up to Ireland's level and going from 13 to 50 unicorns by 2030.

The Plan places technological development in the context of Quantum Spain and the collaboration between the CNS-BSC and NVIDIA on a European AI accelerator that combines the BSC's RISC-V CPU with NVIDIA GPU and interconnect: "the first advanced hardware carrying a European stamp" for supercomputing and AI, plus a set of open models specialised in defence, energy, climate and health. None of these pieces currently has its own dated milestone.

What the Plan Doesn't Say

A 15-page document that reorders an entire sector's policy leaves gaps. They are worth naming: they are what determines whether a business can plan around the Plan today, or can only wait for it.

1. There is no overall financial breakdown. Only separate line items: €5,000 million for the gigafactory (€719 million public), around €300 million for the cybersecurity shield and €600 million for the voucher.
2. The voucher has no call for applications and no regulatory bases. Its "regulatory preparation" is scheduled for the first half of 2027, together with a controlled pilot.
3. It sets no amount per business, no aid intensity and no eligibility criteria for the voucher. Those three details are left for later.
4. It creates no new legal obligations. Today's obligations come from the AI Act, not from this Plan.
5. The Tripartite Agreement is convened, not defined. Social partners are convened in October 2026, with sectoral working groups, a permanent labour market observatory and a culture working group. Its content is not in the document.

And the figure that puts everything in order: of the 14 flagship projects, only seven have a milestone within 2026. The rest — including the part with the biggest budget — is 2027 or later.

What to Do in the Next 90 Days

None of the above requires an immediate reaction except for one thing: the AI Act obligations already in force, regardless of whether the Plan moves forward or is delayed.

1. Inventory your AI systems. Using the AI systems inventory template.
2. Classify the risk of each system. The AI Act treats a prohibited system, a high-risk one and a minimal-risk one differently: the AI Act risk classifier resolves that sorting.
3. Draft or update your internal AI use policy. The AI Act does not require this document, but it is the standard way to demonstrate to a client or auditor the Article 4 literacy measures: the AI use policy template for businesses.
4. Calculate your real exposure to penalties. To know whether the risk justifies investing now or waiting, with the AI Act penalty calculator.
5. Consider a formal management system. If you regularly develop or integrate AI, the ISO 42001 AI management standard organises compliance within an auditable framework.
6. Mark 23 September and 2 December 2026. The end of the amendment period for Spain's draft AI law, and the date the two new Article 5 prohibitions apply: generating or manipulating realistic images, videos or audio of the intimate parts of an identifiable person, or of that person engaged in sexually explicit activities, without their consent, and generating or manipulating child sexual abuse material or performances within the meaning of Directive 2011/93/EU. Neither date depends on the Plan IA360.

What makes no sense yet is setting aside budget for the voucher: there is no call to apply to. What does make sense is preparing the maturity diagnosis and use case the Plan anticipates: if the call arrives in 2027 with that design, whoever already has it done starts with an advantage.

Frequently Asked Questions

Sources

• Plan IA360, La Moncloa, 21 September 2026.
• Nota de prensa de La Moncloa sobre la presentación del plan, 21 September 2026, the source of the description of the Plan as a twelve-month roadmap.
• Regulation (EU) 2024/1689 (AI Act), Art. 113, and Regulation (EU) 2026/1744 (the "Digital Omnibus"), of 8 July 2026.
• Real Decreto 729/2023, de 22 de agosto, AESIA's founding statute (BOE-A-2023-18911).
• Draft Royal Decree on data centres: MITECO public consultation, opened 27 August 2026.
• Draft Organic Law for the proper use and governance of AI, file 121/000096. In parliamentary process: not yet in force.