Bureau theme
Madrid Worked from Barcelona EU · AEPD Same hour, same country

Madrid.
Same law, same clock.

Madrid is the engagement with the fewest moving parts. One country, one supervisory authority, one timezone, one currency, and a train that gets us from our office to yours in about two and a half hours. Everything that consumes the first month of a cross-border project is simply absent, which leaves the actual problem.

Last reviewed 5 September 2026 · Engineering guidance, not legal advice.
WHAT IS ACTUALLY DIFFERENT HERE
01

The same regime, not a compatible one

A Madrid client and a Barcelona supplier operate under the GDPR and the LOPDGDD, supervised by the same authority, the AEPD. There is no transfer, no adequacy decision, no standard contractual clauses and no schedule about onward processing in a third country. That is not a marketing point; it is roughly three weeks of legal work that never happens.
02

Spanish regions now genuinely exist

AWS eu-south-2, Azure Spain Central and Google Cloud europe-southwest1 are all in Spain, with the Madrid area as the anchor. In-country residency stopped being a special request a couple of years ago and became a dropdown. For a bank or an administration that has been deferring an AI project on residency grounds, that specific objection has quietly expired.
03

Supervision by sector, on top of the AEPD

Banks answer to the Banco de España and the ECB, markets to the CNMV, insurers to the DGSFP, and financial firms generally to DORA on operational resilience and third-party technology risk. Telecoms and energy have their own supervisors in the CNMC. The pattern is consistent: AI is not prohibited, but a named person stays accountable and the decision has to be reconstructable later.
04

Public-sector work brings the ENS

Anything touching public administration brings the Esquema Nacional de Seguridad into scope, and often a public tender with it. We hold no ENS certification and will not imply that we do. What we build is designed to be deployed inside an environment that is certified, operated by you or by your infrastructure provider, with our part of the work documented well enough to survive the review.
THE WORK THAT COMES OUT OF THIS CITY

Madrid is where Spain's largest institutions have their headquarters: the banks and insurers, the telecoms operators, the energy companies, and the central administration. It is also, less visibly, where a great deal of Spanish-language customer operations for Latin America is run from. The work that comes to us divides fairly neatly into three.

The first is decisioning with an audit trail. A credit file, a claim, a tariff exception, a subsidy application — a person reads it, applies a policy, and the outcome must be explicable to a supervisor and to the affected individual long afterwards. The model is the least interesting component; the evidence trail is the product. See credit decisioning and, for the reporting side, regulatory reporting.

The second is the contact centre. Spanish-language support at Madrid scale is an enormous cost line, and it is also where automation goes wrong most publicly: an agent that is confidently incorrect about a tariff generates complaints faster than it saves salaries. We build these with a hard boundary — retrieval from your own approved material, a refusal path, and escalation that carries the context so the customer does not start again. Customer support agents covers how.

The third is document pipelines in the back office: contracts, invoices, onboarding files, regulatory correspondence. Unglamorous, high volume, and usually the project with the clearest arithmetic behind it.

Across all three, the EU AI Act is now a live design input rather than a future one, particularly for anything touching creditworthiness, employment or access to a public service. Our reading of what that means in practice is on the EU AI Act page.

HOW A MADRID PROJECT ACTUALLY RUNS
01

We take the train for discovery

Barcelona to Madrid is about two and a half hours station to station, which is faster than flying once you count the airports. That makes in-person discovery easy to arrange and easy to repeat if the first session raises more than it answers.
02

Then remote, with no offset at all

Same timezone, same working calendar, same public holidays for the most part. Nothing waits for a window, and a question at 17:30 on a Thursday is still a Thursday question.
03

And back for handover

Handover is a working day with your team driving. Because we are three hours away rather than a flight away, coming back a month later to help with something awkward is a normal thing to do rather than a negotiation.
QUESTIONS
QUESTIONS — 5

No. We have one office and it is in Barcelona. Madrid is close enough that an office here would be a pretence rather than a convenience — we take the morning train, do the work in your building, and go home. If you need us on site regularly, we will say up front how often that is realistic.

Yes. There are three in-country regions between the major providers, and open-weight models can be self-hosted inside your own environment where nothing may leave it. For any hosted model we set out its retention and training position at the time of writing, and you should confirm it against the provider's current terms rather than relying on our summary indefinitely.

Sí, con normalidad. Las reuniones, los talleres de discovery y el trato diario pueden ser en español, català o inglés. La documentación técnica y el código se entregan habitualmente en inglés por convención del sector, pero si preferís la documentación funcional en español, se hace así.

As processing like any other, which is the useful part: there is no separate AI regime to learn, only the GDPR and the LOPDGDD applied to a system that happens to use a model. The recurring questions are the lawful basis, minimisation, transparency where a decision is automated, and the right to obtain human intervention. Those become architecture: what is logged, what is retained, and where the person sits. Your DPO owns the assessment.

No. The ranges are published on the pricing page in euros and exclusive of VAT, and they are the same for every city. We do not price by postcode, and being in the same country does not make us cheaper or more expensive — it makes the project shorter, which is the part that actually saves money.

Keep reading
30-minute technical call · no deck

In Madrid?
We can be there tomorrow.

Thirty minutes on the problem first. If it warrants a room and a whiteboard, we will get on the train.

CASE STUDIES

Shipped work.
Go and check it.

The work we can name, with the live site, our scope and the boundary made explicit. Select a project to see the evidence; each is a full case study, not a logo or a claim.

sonora.com
The Sonora homepage on desktop: a full-bleed dune landscape behind the headline “Transform Your Life with Sound”, with App Store and Google Play download buttons.
sonora.com — homepage, 1440×900 sonora.com →
Live Consumer wellness · Mobile + web

Sonora

Cognitive AI Ltd · 2026

A free sound-wellness app, described by its publisher as AI sound therapy that reads a short vocal sample at the start of a session and generates a soundscape for that moment. We designed and built the website and its backend, produced assets for the iOS and Android apps, and supported the application prototype.

Read the case study →

See every published project →

WHO WE HAVE BUILT FOR

Twenty-one years of applications, platforms and campaigns for names you know.

See all of our work →