680.21(A) pretty much puts you in conduit. You also need GFCI protection. The typical spa setup is a 50a branch circuit with a GFCI breaker and a disconnect box where the spa wires in. Some packaged spas also include a built in disconnect or even GFCI protection so it is good to know what you have before you start. I am not sure how you bond a preexisting concrete deck but by my reading it is still required. You also need to bond all metal within 5' with #8 solid (window frames, screen enclosures, rails, fences and ladders). Most AHJs also want tempered glass in windows near the tub.
