Everything asesorías and
gestorías ask.

No. The February 2026 AEPD doctrine specifically addresses this defence. Data residency answers where the bytes sit at rest. Operational sovereignty asks a different question: who can technically and legally cause the processing to stop, be inspected, be modified, or be subpoenaed? For OpenAI, Anthropic, Microsoft and Google, the answer is the same: a US-headquartered company subject to US extraterritorial law (CLOUD Act, FISA 702, EO 14117). EU residency does not change that. The AEPD has now formalised that this is an Article 32 problem in its own right. See source 2.

A valid Article 28 DPA is a necessary condition, not a sufficient one. The February 2026 guidance is explicit that Article 28 (the processor relationship) and Article 32 (security of processing) are independent obligations. A perfect DPA does not cure an operational-sovereignty defect. You also still need to defend the processor relationship itself — and for asesorías as sujetos obligados under Ley 10/2010 anti-money-laundering rules, sharing client financial profiles with unverified third parties is a separate problem on top. See source 2, source 5 and source 6.

The moment a name, a NIF, a tax figure, a payslip line, a bank statement, a contract clause or an AEAT communication enters the prompt, you are processing personal data under GDPR. The AEPD's January 2026 decalogue (Cuidado con lo que le confías) is explicit on this point and directed at workers in firms exactly like yours. The "we only use it for emails" defence does not survive a single inspection that pulls actual prompt logs. See source 4.

In 2023, yes. In 2026, no — not for the workloads that matter to a Spanish firm. Modern open-weight models (Llama 3.x, Qwen 2.5, Mistral Large, DeepSeek) running on the right hardware match or beat first-generation commercial APIs on Spanish-language tasks, document Q&A, citation-preserving retrieval, structured extraction and agentic workflows. AIibiza is built on Mac Studio (96GB unified memory) and NVIDIA DGX Spark (128GB) — hardware that hosts the same class of model that ran on a datacentre rack two years ago. The compliance gap has closed; the capability gap has not opened.

They may be Spanish-branded, but the sovereignty question is architectural rather than linguistic. Where a legal-AI product depends on US-controlled cloud infrastructure, identity, key-management or control-plane services, it creates the same class of CLOUD Act and FISA 702 exposure that the February 2026 sovereignty doctrine requires controllers to document. Under that doctrine, a Spanish-language UI on top of non-sovereign control-plane infrastructure is not enough by itself. AIibiza is designed so the inference, embeddings, index, orchestrator and keys can sit on hardware the client can physically point to. See source 2, source 9, source 10 and source 11.

The AEPD has issued more than €40M in fines in the last three years and the trend line is steeper, not flatter. But the more immediate exposure is not the AEPD: it is civil liability to the client when sensitive data leaks, professional indemnity insurance that excludes cloud AI use, AML supervision by SEPBLAC for asesorías as sujetos obligados, and the EU AI Act's Article 50 transparency duties, which took effect on schedule on 2 August 2026 even after the Digital Omnibus pushed the high-risk system deadlines back to December 2027 and August 2028. The February 2026 doctrine is not the ceiling of the risk — it is the floor. See source 6 and source 8.

You can, and it is dramatically better than ChatGPT. But a VPS at Hetzner, OVH or AWS Frankfurt still leaves you with a control-plane problem: the keys, the IAM, the underlying virtualisation and the physical hardware are not under your sovereignty. The AEPD's sovereignty doctrine is hardware-aware. A local appliance — physically located in the client's office or in a Spanish-sovereign datacentre under a Spanish entity — is the architecture that most directly addresses the sovereignty question. See source 2.