The CNMV has opened a consultation on updating the Good Governance Code, which dates back to 2015. The draft adds recommendations on digitalisation, cybersecurity and artificial intelligence, and asks IBEX 35 companies to separate the roles of chairman and CEO. Comments can be submitted until 15 December.
The CNMV asks large companies not to let AI decide for their directors
Spain’s National Securities Market Commission (CNMV) has put in writing something no one had asked of companies on the Spanish stock exchange until now: that artificial intelligence should help their boards of directors, but not decide for them. It does so in the draft of the new governance code for listed companies, which was opened to public consultation on 3 November and on which anyone can comment until 15 December.
Think of an aeroplane. Much of the flight is handled by the autopilot, which maintains course, altitude and speed better than any person. And yet no one would board a plane without pilots in the cockpit. The machine does the heavy lifting, but if something goes wrong there is someone with their hands near the controls who knows what is happening and is accountable for it. That, transferred to the room where a large company’s board meets, is what the CNMV is proposing.
What the CNMV proposes on artificial intelligence
This is the first time the code, which has existed since 2015 and was partially revised in 2020, addresses artificial intelligence, digitalisation and cybersecurity. According to the Servimedia news agency, the draft includes two recommendations.
The first: that the board of directors consider creating a committee specialising in these matters, to assist it and propose appropriate measures. A board usually already has committees for specific topics, such as audit or appointments. The idea is for technology to have its own working group too, made up of people who understand the subject.
The second is the one making headlines: the board must ensure that the use of AI does not replace “the necessary human intervention” of directors. In other words, AI can be the autopilot, but the plane does not fly without a crew.
Bear in mind that this is a recommendation, not a law. The code works on a “comply or explain” basis: each year, listed companies publish a report stating which recommendations they follow and, if they don’t follow any of them, they must explain why. No one fines them, but investors read those explanations.
Why AI is reaching the boardroom now
It hasn’t come out of nowhere. When the CNMV began preparing the reform in November 2025, it already announced working groups to study the impact of artificial intelligence on corporate governance. And in July 2026 its chairman, Carlos San Basilio, said at a forum organised by KPMG, AON and El Mundo that the new code would address new topics, citing AI as an example.
The reason is easy to see. Today any AI tool can summarise a two-hundred-page report in seconds, compare scenarios or propose a decision. For a director who receives mountains of documentation before every meeting, the temptation to read the summary rather than the report is great. The CNMV does not ban the use of these tools. What it asks is that the board not become a rubber stamp for whatever the machine says.
What “human intervention” means in practice
Imagine a board approves a multimillion acquisition because an AI system recommended it, and the deal goes wrong. Who do shareholders hold to account? Not the software. They hold the directors to account, as they are the ones responsible for the decisions they make.
That is why the recommendation makes sense even if it sounds obvious. Using AI to prepare reports, analyse data or detect risks is fine. What the code wants to avoid is a situation where no one on the board can explain why a decision was made beyond “the tool said so”. The autopilot can fly the plane, but the pilot has to understand where it is going.
Cybersecurity, the other side of the coin
Alongside AI, the draft brings cybersecurity into the code. The supervisor itself gave the reason: the risk of a company suffering a cyberattack is increasingly high. A cyberattack can shut down a factory, leak customer data or sink a share price in a single morning, so it is no longer an issue that can be left solely to the IT department. The specialised committee proposed by the CNMV would also cover this front.
The rest of the reform, in brief
AI is one part of a broader reform. The new code is much shorter, going from 52 to 23 pages, and it changes its name: it will be called the Governance Code for Listed Companies, without the “Good” in front. The measure that has generated the most headlines is the recommendation that, at IBEX 35 companies, the same person should not both chair the board and run the company as CEO. It also strengthens independent directors, those who neither work for the company nor represent a major shareholder, and incorporates sustainability throughout the text.
What this means for you
If you hold shares in a large Spanish company or a fund tracking the IBEX 35, this affects you indirectly: the companies where your money is invested will have to report whether they have AI and IT risks under control, and those reports are public.
If you work for or advise a listed company, now is the time to review how your board uses AI and whether anyone oversees cybersecurity at the highest level. The consultation exists precisely so that changes can be proposed before the text is finalised.
On a personal note, I’ll tell you something, now that no one’s listening: the CNMV was right to bring AI into the code, and this time it has even got ahead of its own timetable. But it leaves me with a strange feeling that it doesn’t want to ruffle too many feathers, and that everything boils down to “considering” creating a committee. It is such a soft recommendation that any board will be able to comply with it in a couple of lines in its annual report. AI is advancing at a speed European regulators don’t usually keep up with, and what is a suggestion today may fall short a year from now. I hope that this time they get it right and that the rules truly protect shareholders and the companies themselves, without holding back those who want to make good use of this technology.
How to take part in the consultation
Any individual or organisation can submit written comments until 15 December 2026, by email to actualizacioncgsc2026@cnmv.es or by letter to the CNMV’s Directorate General of Markets, Department of Financial and Corporate Reporting, calle Edison, 4, 28006 Madrid.
An important detail: the CNMV will publish all comments once the consultation closes. If you don’t want yours made public, you must say so expressly in your response. The usual confidentiality notice at the bottom of emails does not count.
Back to the cockpit
No one disputes that autopilot makes planes fly better. What the CNMV is reminding us is that, in a company that moves billions, there must also be someone in the cockpit who understands what the machine is doing and is accountable for it. Now the question is for you: would you trust a company whose board lets AI decide, or do you think the CNMV falls short with a mere recommendation?
Get the best of the week in your inbox
Every Monday: the most-read stories on Territorio Blockchain, the new podcast episode and news about our events. Free, no spam.
We will send you an email to confirm. You can unsubscribe at any time with the link in every newsletter. Privacy
