Does Spain really lead AI adoption among SMEs?

It depends who you ask, and how. Some figures say yes, emphatically. Others, with a very different methodology, barely see real adoption. We walk through the numbers — with their source and their fine print — so you can draw your own conclusion.

A recent survey — 4,000 SME decision-makers across five European countries — puts Spanish AI investment intent for 2026 at 35%, almost a third higher than a year ago (22% in 2025), and just one point behind France. On that figure alone, the answer to the headline question would look like a clear yes.

Source: YouGov, survey commissioned by IONOS among 4,000 SME decision-makers in 5 countries (Spain, n=514), Jan-Mar 2026. It measures declared investment intent, not verified real usage — and the company commissioning the study is a digital services provider with an interest in seeing digitalisation advance.

But there's a second figure, from a different study, worth placing next to the first before drawing conclusions:

Nearly four in ten Spanish SMEs still have no policy governing the use of AI applications.

No visibility into what information can go into an AI tool and what can't. No control over who uses it, for what, or with what data. Adopting fast and adopting with judgement aren't necessarily the same race.

Before going further, a distinction we think matters: this second figure comes from ESET's SMB Cyber Readiness Index 2026, a cybersecurity company, surveying 4,400 SME decision-makers across 13 countries (400 in Spain). The sample is large and the methodology is public. But it's worth keeping in mind: whoever publishes the figure sells precisely the tools that fix that governance gap. That doesn't invalidate the number — 38% in Spain is the real figure the study found — but it's exactly the kind of detail worth checking before citing any survey as absolute truth.

87% say they use AI. A different study, with real data, says 2.9%

Search for AI adoption figures among Spanish SMEs and you'll find wildly different numbers depending on who's asking and how. Perception surveys — where answering "yes" to "have you ever tried ChatGPT?" is enough — claim adoption above 80%. At the other extreme sits the Barometer of AI Adoption in Spanish SMEs, produced by IndesIA together with Accenture and Informa on more than 68,000 real companies — not a survey sample, but economic activity data — which puts effective AI use at just 2.9% in 2025 (up from 2.13% in 2024).

• Perception surveys: ~35-87%. Decision-makers who declare they've invested, plan to invest, or that some employee has tried an AI tool.
• Real economic activity data (IndesIA, Accenture and Informa — 68,000+ SMEs): 2.9%. Companies whose registered economic activity verifiably incorporates AI.

The gap between the two figures is partly explained by definition — "using AI" means very different things depending on the study — but also, and this is what interests us, by something simpler: part of the real AI usage in Spanish companies is happening where nobody is measuring it, because nobody in management knows it's happening.

The AI your employees already use, even if you don't know it

At Tecnea we frequently see a pattern that fits that gap: employees who already handle a good part of their work with generative AI, without the company having provided it or even knowing about it. They don't mention it because, in practice, it doesn't pay off — if their manager discovers a task now takes a fraction of the time, the most likely outcome is more work assigned, not recognition. The phenomenon has a name in industry literature: Shadow AI or BYOAI ("bring your own AI"), and there's now solid data behind it, not just perception.

A good part of real AI use at work happens out of management's sight.

What the sector's most-cited study says

• 78% of people who use AI at work bring their own tools, bypassing the company entirely — rising to 80% at SMEs.
• 52% of those who use it are reluctant to admit using it on important tasks.
• 53% fear that admitting it will make them look "replaceable".

Corroborated by other sources

• Ivanti (Feb. 2025, 6,000+ office workers) confirms the pattern: 32% of those using generative AI at work keep it secret. The most-cited reason isn't fear of losing their job — that's 30% — but wanting to keep a "secret advantage" (36%). A further 27% simply don't want their ability questioned.
• In Spain, ADP's People at Work 2026 study puts declared daily AI use at 15% — likely below the real figure, for the same reason.
• The cost of a data breach involving unauthorised AI is, on average, $670,000 higher than a conventional breach (Ponemon Institute / IBM, 2025).

Objectivity note: Microsoft sells Copilot, and Ivanti and IBM are security and IT management software vendors — all three have a direct interest in the lack of AI control impressing the reader. Even so, the scale of the phenomenon lines up across independent studies with different methodologies and samples, which reinforces that it's real rather than an isolated or inflated figure from a single source.

The practical conclusion isn't alarmist, it's simply realistic: if a company doesn't offer a good, official way to use AI, its sharpest employees will use it anyway on their own — only nobody will know what data that tool has seen, or be able to put the time saved toward anything better than hiding it.

Adopting fast and adopting well aren't the same race

It's understandable that adoption runs ahead of governance: when a tool proves its worth in weeks, it's tempting to roll it out without pausing to document anything. The problem is that, with AI, that rush carries a concrete, already-documented cost — not a future hypothesis, a risk today.

What happens without a usage policy

• Customer or case data ends up in public AI tools, outside the company's control.
• Nobody knows what an external assistant has already "learned" about the business.
• Each employee decides on their own which tool to use, and for what.
• GDPR gets breached without anyone having consciously decided to breach it.

What the legal framework already requires

• Since February 2025, AI literacy has been mandatory for staff who use it.
• The EU AI Act expands its transparency obligations this August.
• GDPR hasn't changed: personal data still requires a legal basis and control, whether or not the company uses AI.
• Documenting AI use stops being good practice and becomes a requirement.

Brussels is having the same conversation, at a different scale

The coincidence isn't accidental. In the same month this barometer came out, European companies and administrations have been asking the European Commission for common rules to protect data they consider critical or strategic in the face of AI's advance. Brussels is already working on a Data Union Strategy and a future Cloud and AI Development Act, built on an argument that sums up the underlying problem well: depending on AI infrastructure outside Europe is a risk, not just a technical detail.

It's the same debate a Spanish SME faces when deciding which AI tool to use, just at continental scale: where does your data actually live, and who really controls it?

What to do about it, specifically

Neither half of the picture — fast adoption, uncontrolled adoption — has to stay that way. Closing the gap doesn't require slowing adoption down; it requires putting it in order:

1. Ask, without hunting for someone to blame, what's already in use. Given what the cited studies show, the honest answer is likely to include more tools than the company has officially "approved".
2. Decide what information can leave the company for a public AI tool, and what should never leave — starting with customer data and case files.
3. Train the team on the basic use and limits of AI, which is now a legal obligation, not just a recommendation.
4. Offer an official route that's better than the unofficial one. If the company's alternative is slower or more limited than what an employee already uses on their own, they'll keep choosing the latter.
5. For what genuinely matters to the business, build on your own data: a tailored application, with data held in Europe, instead of depending on a generic public tool.

Whether or not Spain leads AI adoption depends, as we've seen, on which study you pick and what you understand "using AI" to mean. What the different sources do agree on is something else, harder to argue with: leadership or not, control is running well behind usage. The companies that close that gap now — whether or not they're actually ahead — will be the ones with fewer nasty surprises two years from now, when an inspection stops distinguishing between "we didn't know" and "we didn't do it properly".

That's exactly the kind of order we help put in place at Tecnea: knowing which AI tools are genuinely in use, what data can leave the company, and building a private, compliant AI on top of that. If you'd like to see how it would fit your case, let's talk.

This article is informational and does not constitute legal advice. We've tried to note each figure's source, sample size where known, and whether whoever published it has a commercial interest in the result. None of the sources cited are Tecnea's own.

Sources

1. YouGov / IONOS Newsroom Spain — survey of 4,000 SME decision-makers, 5 countries, Spain n=514 (Jan-Mar 2026)
2. ESET, SMB Cyber Readiness Index 2026
3. IndesIA, Accenture and Informa — Barometer of AI Adoption in Spanish SMEs, 2025 edition
4. Microsoft Work Trend Index
5. Ivanti, 2025 Technology at Work Report
6. ADP Research Institute, People at Work 2026 (via eldiario.es)
7. Ponemon Institute / IBM, Cost of a Data Breach Report 2025
8. European Commission — Data Union Strategy (via que.es)