In May 2025 the Bank of Spain published a dedicated analysis of artificial intelligence adoption among Spanish firms. It was signed by the economic-analysis division. That is the first clue about how the regulator reads this topic.
The article, part of Economic Bulletin 2025/Q2, carries a deliberately plain title: The adoption of artificial intelligence in Spanish firms: an initial analysis based on the EBAE. Its authors (Alejandro Fernández-Cerezo, Ignacio Hidalgo and Mario Izquierdo) sit in economic analysis, not in innovation. When that division writes about a technology, it has stopped describing a novelty and started measuring a variable.
And the numbers, drawn from the Bank's own Business Activity Survey (EBAE), carry consequences no executive committee should be dispatching with a paragraph in the minutes.
What the Bank of Spain is measuring, in numbers
20% of surveyed Spanish firms report using some form of AI system. Above Italy, below Germany. The figure includes both generative AI (18.1%) and predictive AI (14.6%). That small gap already tells a story: the noise around generative AI is pushing adoption faster than fifteen-year-old predictive techniques.
60% of those AI users are still in experimental or pilot phase. Of the 20% who show up as adopters, the majority haven't integrated AI into the business; they are testing. And testing without a thesis of impact usually means spending.
The number that changes the picture comes next: Spanish firms using AI show, within the same industry, an average productivity 27% higher than firms that don't. The gap is controlled for sector, so we're not comparing apples and oranges. It is the real distance between companies already inside and companies still arguing about whether to enter.
Add the structural clues in the report: adoption is higher in technology services and among large, productive, young firms; the main barriers are the lack of qualified workforce, high implementation costs and limited data availability; and the dominant uses are internal process optimisation and marketing. The picture, in one sentence, is a country where AI still lives at the edges but is already paying.
Why a central bank is writing about this
Central banks don't publish analyses of trendy technologies. They publish when a variable starts behaving as a macroeconomic vector, that is, when it affects productivity, sectoral competitiveness, employment or business investment. The fact that the Bank of Spain ran a dedicated survey and quantified the 27% gap means AI has crossed that threshold.
After the first report come, almost always, the next moves: reference frameworks, chapters in financial stability reports, recommendations to supervised entities and, sooner or later, governance and reporting requirements landing on boards. The pattern has played out with cybersecurity, anti-money laundering, cloud vendor dependency and sustainability. Now it is starting to appear with AI.
In parallel, the large banks are rewriting their SME content in the same key. A recent guide from BBVA Empresas, published by its communications team at the end of January 2026, quotes the bank's own head of Data, Álvaro Martín, reminding readers that well-governed data is the basis for AI solutions with lasting value, and reinforces the idea that AI has stopped being the exclusive territory of large corporations. When a commercial bank says that to its SME clients on its corporate portal, the conversation has clearly moved to a new table.
"When a central bank starts measuring the adoption of a technology by sector and company size, it has already begun treating it as a national-competitiveness variable, with everything that implies for corporate governance."
Why your committee has this miscategorised
In most executive committees we sit with, AI arrives as an item on the technical agenda. It is prepared by the CIO or the head of systems. It is presented with technical criteria (models, tools, vendors) and approved with technical criteria (feasibility, integration, maintenance). At the end, someone asks about the cost.
That categorisation has three consequences, and none of them is good.
First consequence: the decision is made on the wrong axis. The discussion centres on the model, its latency or its accuracy, instead of on the P&L line the company wants to move and the opportunity cost of not moving it. By the time the proposal reaches the committee, it arrives pre-cooked with technical metrics the rest of the committee cannot challenge and that don't translate into business impact. Whoever doesn't understand approves or defers; they never decide.
Second consequence: the CIO becomes a structural bottleneck. If AI is a transversal productivity lever, having a single point in the organisation through which every decision flows is an obvious operational risk. It also carries contradictory incentives, because the same person defending the project to the board is the one executing it and the one collecting a bonus if it works. Asking someone to coolly decide on something whose execution depends on them is a defective organisational design.
Third consequence: the board finds out late. The companies we know discover their own AI map only when contracts are already signed with three vendors, data is already leaving the perimeter and nobody has the authority to stop anything. The board receives a picture without real options and signs because no comfortable alternative remains. That is the polite version of what, in regulated sectors, will eventually be called a governance failure.
The Bank of Spain report puts numbers on this pattern even if it doesn't name it that way. Recall the data point: 60% of AI adopters are stuck in pilot. Pilots don't stay in pilot because the technology fails; they stay in pilot because nobody at the table with cross-functional authority was designing what the company wanted to win with them.
The seven questions your committee must answer before signing
What follows is a filter, not an audit checklist. Every AI proposal arriving at the committee goes through these questions out loud. If the team proposing it cannot answer one, the proposal goes back to study until they can. It is the minimum discipline before committing shareholder money.
1. Which P&L line do we want to move with this, and by how much? The answer cannot be "modernise" or "not fall behind". It has to be a specific line (commercial margin, cost-to-serve, productivity per person, conversion) and a reasonable order of magnitude. If the answer doesn't fit in one sentence, the homework isn't done.
2. Who on the committee, outside IT, owns the result twelve months from now? It has to be someone with a P&L on their name. If nobody on the committee wants to sign for the result, the organisation is saying, without saying it, that it doesn't believe in the project. That signal beats any business case.
3. What data of ours leaves our perimeter when we evaluate and run this? Knowing what information is handed over, to which vendor, under which clauses, for how long and with what secondary use permitted. This question is answered at the committee with input from legal and from the relevant sector-compliance function, outside the IT office. When client data ends up entangled with a vendor's training pipeline, you already have a corporate-governance problem.
4. What happens if this vendor raises prices five times over, changes its licence or disappears? Dependency on a single model or a single vendor is an operational risk. The right answer is an explicit plan B: what migrating costs, how long it takes, what the impact is and which contractual exit clauses you hold. Without that plan, you don't sign.
5. How do we measure the result before and after, against which baseline? Without a prior snapshot, six months later any interpretation is defensible. The baseline costs little, is worth a lot and, if it isn't measured before signing, it will never be measured. It's the step almost nobody executes, and the one that separates pilots that close cleanly from the heap that survives on inertia.
6. Which internal capabilities do we want to build, and which do we externalise on purpose? AI adoption is a capabilities programme, not a software programme. Some pieces belong to the core of the business (judgement, decision, process redesign) and some can live outside (infrastructure, base models, standard tools). Deciding it on purpose prevents you from inadvertently outsourcing precisely what you should retain.
7. Which decisions of ours will remain human, no matter what? Particularly in regulated, financial, healthcare or professional-services sectors. Without that explicit boundary, AI sneaks into places where the executive's personal responsibility cannot be delegated, and you only discover that when there is already a client, a regulator or a judge in front of you.
Seven questions aren't a full methodology. They are the minimum discipline before committing shareholder money to a lever whose productivity gap the Bank of Spain is already measuring.
Three new competences expected from executives, not from the CIO
When the report identifies the lack of qualified workforce as the main barrier, the natural reading is "we need to hire more engineers". That reading, beyond being unworkable for the vast majority of mid-market companies, looks in the wrong place. The bottleneck is the committee itself.
1. Critical reading of technical proposals. You don't need to know how to code; you do need to know how to ask. Telling a measurable commitment from sales vocabulary. Asking for comparable metrics rather than demos optimised to impress the room. Spotting when the presentation talks about the vendor's product and when it talks about the client's problem.
2. Governance of the associated risk. Data risk, vendor dependency, model bias, reputational risk, sector-regulatory risk. You need the map of those five boxes and the right question to ask in each one before approving. Mid-market companies that spend the next twelve months without building this judgement will sign contracts whose implications they discover during a crisis, not before.
3. Design of redesigned processes, not automated ones. Before putting AI inside a process, look at whether the process should exist as it stands. The most expensive trap we see in committees is spending money to speed up a workflow that was poorly thought through to begin with. The redesign is led by the business; once the redesign is settled, IT can execute the result.
None of these three is acquired by reading a newsletter or attending a keynote. They are acquired by working them against real cases, with time at the table, with the entire executive team aligning judgement. That is the gap the current moment is opening, and the one the Bank of Spain documents, without naming it as such, when it talks about "organisational capabilities".
What to do this quarter
So you don't stop at reading the report, here is what fits in ninety days without hiring anyone new and without launching a transformation programme with external consultants.
First fortnight. Pull AI out of the technical committee and place it, with a named owner, on the executive committee. That owner can be the CEO, COO or CFO depending on the main lever the company wants to move, but it cannot be solely the CIO. The CIO acts as an internal supplier; the result is signed for from the business side.
First month. Build the inventory without filters: which AI uses exist in the organisation today (formal and informal, yes, including the pocket ChatGPT of the sales team), which data is being handed over to which vendors, which contracts have been signed and which pilots are open. With direct questions and no threat. The complete inventory tends to surprise people more than the Bank of Spain data point.
Second month. Pick two or three impact hypotheses, one per lever (revenue, cost, risk), and frame them as bets with a baseline metric, a target metric and an owner on the committee. Drop the portfolio of twenty parallel pilots. Running multiple pilots in parallel disperses the executive team and dilutes control over results.
Third month. Start with one of the hypotheses. Just one. With its baseline measured, its owner with P&L responsibility and its plan B if the vendor changes. The rest gets prioritised with the reading you already have at the end of the quarter, not before.
And, in parallel to all of the above, train the committee itself. The executive committee, not just the technical team. Without that piece, the next quarter looks like the previous one, and the 27% figure keeps widening for whoever is watching from outside.
The conversation the regulator is opening
The Bank of Spain report, the SME guides large financial institutions are publishing this year and the recent sector analyses all converge on an uncomfortable point: AI is moving from project status to competitiveness variable. Whoever continues treating it as a technical matter is silently giving up a strategic decision that will soon be examined from the outside, first by investors and clients, then by sector regulators.
That is the conversation we expect to have this year with every executive committee that sits with us. It doesn't start with a software vendor; it starts with a leadership team that decides to take back judgement over its own AI portfolio, before the market, the regulator or the next Bank of Spain report decides for it. It is the space we work on in our executive-mindset reset service and, specifically, in Shift Directivo, Stradiax's in-person programme for executives who want to walk out with their own ninety-day plan, defensible at board level.
Next time an AI proposal lands on your committee, before asking which model it uses, remember that the Bank of Spain is already measuring. What is measured gets compared. And what is compared, sooner or later, gets demanded.
