Inspections by installation
Mandatory defibrillators in Spain: the State requires them of no one; the regions do, each with its own threshold
If you are looking for a national list of premises that must have a defibrillator, there isn't one. Real Decreto 365/2009 (Royal Decree 365/2009) sets minimums —CE marking, notification, maintenance as per the manufacturer— and leaves each autonomous community to decide where an AED is compulsory. That is why a shop with 800 m² of built floor area may need one in Bilbao but not in Seville, and a workplace of 300 people may need one in Madrid but not in Barcelona. Here are four regions, read in their official gazettes; the rest may differ.
The short answer
There is no national obligation to have a defibrillator. Royal Decree 365/2009 regulates their use outside healthcare settings and places duties on whoever installs one, but it does not say which premises must have one: it tells the autonomous communities that they "promoverán y recomendarán" (shall promote and recommend) installing them where large numbers of people gather or pass through (Art. 5). The regions that went further did so with their own decrees, and each chose its own thresholds.
Read in their official gazettes: in Madrid the obligation covers, among others, every educational centre and every workplace with more than 250 workers; in the Basque Country, shops with more than 700 m² of built floor area; in Andalusia, sports facilities with 500 or more users a day; and in Catalonia the obligation is not in its defibrillator decree at all, but in its self-protection decree.
What the national rule says
Los organismos, empresas e instituciones públicas y privadas que instalen un DESA serán responsables de garantizar su mantenimiento y conservación, de acuerdo con las instrucciones del fabricante. ("Public and private bodies, companies and institutions that install an AED shall be responsible for ensuring its maintenance and upkeep in accordance with the manufacturer's instructions.")
The device must also carry the CE marking and be used under the conditions set by its manufacturer (Art. 3). Whoever installs it notifies the health authority of their region with a responsible declaration, and the region organises that procedure, which must at least ensure the device is registered, that it and its instructions for use are visibly signposted, that there is an immediate link to the emergency services and that each use is reported afterwards (Art. 4). Training for non-medical staff is organised by the regions or by authorised bodies, and as a minimum teaches people to recognise when to use the device and how to use it (Art. 6).
National and regional rules use different acronyms: DESA for the semi-automated model, which waits for someone to press the shock button, and DEA for the automated one or for both. For the purposes of these obligations, all of them treat the two in the same way.
Who it binds: four examples with their thresholds
The four decrees below are examples, not a map of Spain. If your premises are in another region, the answer comes from that region's official gazette.
| Region | Who must have at least one AED | Rule |
|---|---|---|
| Community of Madrid | Large shops with more than 2,500 m² of display and sales area; airports and large stations; public venues for shows or leisure, cultural or religious activities with a capacity of 2,000 or more; public administration buildings with 1,000 or more users a day in towns of more than 50,000 inhabitants; sports facilities with 500 or more users a day; hotels with more than 100 places; every educational centre; workplaces with more than 250 workers; care homes for older people with 200 or more places | Decreto 78/2017, Art. 3 |
| Catalonia | As a fallback, the activities required to have a self-protection plan that have no sector rule of their own: buildings with a capacity of 2,000 or more; teaching centres with more than 1,000 occupants and special education centres with more than 200 places; care homes for older people with 100 or more places; other public residential buildings with an evacuation height of 28 m or more or 2,000 or more occupants; stations with 2,000 or more occupants, ports of general interest and airports with more than 5,000 passengers at peak time. In each case, 1 AED and two first responders trained in its use | Decret 30/2015, annex III, section 2 |
| Andalusia | Large retail outlets with more than 2,500 m² of usable display and sales area; airports, commercial ports and stations in towns of more than 50,000 inhabitants; sports facilities with 500 or more users a day (except restricted-access ones); public venues with a capacity of 5,000 or more | Decreto 22/2012, Arts. 2(b) and 3 |
| Basque Country | Shops with more than 700 m² of built floor area; airports, commercial ports and stations with 2,000 or more people a day; public venues, facilities, shows and leisure activities with an authorised capacity of more than 700; educational centres with a capacity of 2,000 or more | Decreto 9/2015, Arts. 2(b) and 3 |
A summary of the articles cited; the full text, with every transport case, is in each official gazette. Checked on 19 Oct 2026.
Mandatory defibrillators in companies
Of the four examples, only Madrid uses headcount: it covers "los centros de trabajo con más de 250 trabajadores" (workplaces with more than 250 workers). The threshold is counted per workplace, not per company, so a chain with many small branches is not caught by adding them together. In Catalonia, Andalusia and the Basque Country, an office or an industrial unit is only covered if it fits another case, such as a building with a very large capacity or a shop above the threshold.
What each region adds
- Madrid: the device is permanently connected to SUMMA 112, the regional emergency service (Art. 4(1)); installation, change of holder or removal is declared within fifteen days (Art. 5(4)); each use is reported within 72 hours (Art. 6(2)); and if nobody trained is present, 112 can authorise another person to use it under its supervision (Art. 7(3)).
- Catalonia: Decret 151/2012 does not require anyone to install one, but whoever does so notifies it beforehand and declares that, during opening hours, at least one person authorised to use it is present (Art. 3(3)(e)), except for devices on the public highway.
- Andalusia: whoever notifies the installation undertakes to have staff with knowledge of cardiopulmonary resuscitation and of using the device throughout opening hours (Art. 5(2)); each use is reported within 72 hours (Art. 8(2)).
- Basque Country: instructions for use beside the device, in Basque and Spanish (Art. 4(2)); each intervention is reported to 112 straight away and, within 72 hours, to the emergency service of Osakidetza, the Basque health service (Art. 6).
What paperwork is kept
In all four regions the device is entered in a regional register on the basis of the holder's notification or declaration; in Madrid, Andalusia and the Basque Country, each use also leaves its report together with the data stored by the device itself. Of the texts read, only the Basque one requires a written maintenance log: the Order of 30 May 2016 requires the holder of the premises to keep a record of preventive and corrective maintenance, in whatever format they choose, showing the person responsible, the action taken, the date and the name and signature of whoever did the work (Art. 5). Inspectors check that log together with the CE marking, the sign and the location of the device on the floor plans (Art. 8(2)).
What the rule does not say
Worth knowing
None of these rules sets a yearly inspection or a timetable for replacing pads and batteries. They all refer to the manufacturer's instructions. Nor does the national text contain a list of premises that must have one: if someone tells you that "the law" requires every gym or every restaurant to have an AED, ask which regional decree and which article.
In Catalonia the obligation is not where you would look. Decret 151/2012 regulates notification and training, but does not require anyone to install a device. The obligation comes from Decret 30/2015 on self-protection, and only as a fallback, "en defecte de normativa sectorial específica" (in the absence of specific sector rules). An ordinary restaurant, shop or office is not on its list, unless the building has a capacity of 2,000 people or more.
What depends on the autonomous community
Almost everything: whether you are covered, from what threshold, how notification works, which training counts and how soon a use must be reported. The decrees of the other regions have not been read here, so nothing is stated about them; in yours, look for the decree on defibrillators outside healthcare settings and, to be safe, the self-protection catalogue.
What usually applies to each type of business is on the pages for gyms, hotels and shops. In a restaurant it only appears with very large capacities, and in a school it depends heavily on the region.
Frequently asked questions
Is it compulsory for a company in Spain to have a defibrillator?
It depends on the autonomous community. The national rule, Royal Decree 365/2009, does not require any company to have one. Of the examples read, only Madrid uses headcount: it covers workplaces with more than 250 workers (Decreto 78/2017, Art. 3(i)). In Catalonia, Andalusia and the Basque Country a company is only covered if its premises fit another case, such as a large shop or a very large capacity.
What does Spanish national law require for defibrillators?
Royal Decree 365/2009 requires whoever installs a defibrillator outside a healthcare setting to make sure it is CE-marked, to notify the regional health authority with a responsible declaration and to maintain it according to the manufacturer's instructions (Arts. 3, 4 and 7). It does not say which premises must have one: it leaves that to the regions, which must promote installation where many people gather.
Does a gym in Spain have to have a defibrillator?
In Madrid and Andalusia, if the facility has 500 or more users a day (Decreto 78/2017, Art. 3(f); Decreto 22/2012, Art. 3(c)). In the Basque Country, if its authorised capacity exceeds 700 people, as a facility under Art. 3(c) of Decreto 9/2015. In Catalonia, only if the building has a capacity of 2,000 or more (Decret 30/2015, annex III). In other regions, check their decree.
Who may use the defibrillator on the premises?
Each region regulates it. In Madrid, healthcare staff, emergency technicians and anyone who has completed the training programme; if nobody trained is present, 112 can authorise another person and supervise them (Decreto 78/2017, Art. 7). In Andalusia, anyone with basic knowledge of resuscitation and of using the device that can be verified (Decreto 22/2012, Art. 7).
What maintenance does an AED need?
Whatever its manufacturer specifies: Royal Decree 365/2009 makes whoever installs it responsible for maintaining and keeping it in line with those instructions (Art. 7(1)), and the regional decrees read set no other frequency. In the Basque Country, the holder must also keep a record of each preventive and corrective maintenance task, with the date, the action taken and the signature of whoever did it (Order of 30 May 2016, Art. 5).
Do you have to report it after using the defibrillator?
Yes. Before using it, or at the same moment, you call 112 to set the chain of survival in motion. Afterwards, in Madrid, Andalusia and the Basque Country, the use is reported within 72 hours at most, on each region's form and with the data stored by the device itself (Decreto 78/2017, Art. 6(2); Decreto 22/2012, Art. 8(2); Decreto 9/2015, Art. 6(2)).
Where it usually applies
- GymsA gym: no national law; qualifications, insurance and notices under each region's sports professions act, plus low voltage, Legionella, pool, RIPCI and defibrillator as premises.
- HotelsA hotel: guest register and reporting within 24 hours, regional classification, low voltage and lift as a public-assembly venue, RIPCI, Legionella, pool, kitchen and defibrillator.
- Shops and franchisesA shop: responsible declaration up to 750 m², opening hours, prices, franchises with no register since 2018, complaint forms, accessibility adjustments and the inspections of premises open to the public.
Other mandatory inspections
- Fire protection (RIPCI)RIPCI checks: quarterly by the owner, yearly and five-yearly by the maintenance company, records kept for five years and an inspection every ten years, with its exemptions.
- Self-protection planWho needs a self-protection plan under the Basic Directive in force since 11 October 2026, what it contains, how often it is reviewed and what the regions add.
- Low-voltage inspectionInspection by an accredited body every 5 years for the premises in ITC-BT-05 (bars, restaurants and hotels always) and every 10 years for residential common areas over 100 kW.
- Thermal installations (RITE)Maintenance company from 5 kW; contract, annual certificate and efficiency inspection every 4 years above 70 kW, with the minimum intervals of table 3.1.
- LegionellaWhat Royal Decree 487/2022 requires of the holder of business premises: a control plan, hot water temperatures, yearly disinfection, Legionella sampling and records kept for five years.
- Lift inspectionWhat ITC AEM 1 (Royal Decree 355/2024) requires of a lift's holder: a contract with a lift maintenance company, monthly servicing, a periodic inspection every 2, 4 or 6 years and deadlines for defects.
- Swimming poolsWhat Royal Decree 742/2013 requires by type of pool: self-monitoring, daily and monthly checks, information for users and incidents, and what it leaves to the autonomous communities.
- HACCP (APPCC)What Article 5 of Regulation 852/2004 requires of a bar, a restaurant or an institutional kitchen in Spain: the seven principles, the records, the flexibility and what is no longer in force.