Law Establishing the Framework for the Development and Use of Artificial Intelligence

· About Law Establishing the Framework for the Development and Use of Artificial Intelligence

Key Takeaways

  • Law No. 31814 is Peru’s national AI framework, and its implementing regulation was approved by Supreme Decree No. 115-2025-PCM on 9 September 2025.[1][4]
  • The regime applies broadly to public entities, private companies, academia, and civil society involved in AI development or deployment in Peru, with sector-specific obligations phased in over time.[1][9]
  • The regulation entered into force on 22 January 2026 after a transition period, while some administrative and guidance obligations began earlier on 10 September 2025.[8][12]
  • For higher-risk AI uses, organizations must maintain transparency, human oversight, documentation, and impact-assessment controls, especially in sectors such as health, education, justice, security, and finance.[7][9][13]
  • The framework prohibits or restricts AI uses that create unacceptable risks, including certain forms of mass surveillance, crime prediction, and autonomous lethal decision-making, as summarized in official and expert analyses.[9][10]
  • The current status in October 2026 is that the framework is in force, with staggered sectoral deadlines already running and a maximum transition window extending to 2028 for some sectors.[7][12][13]

What It Is

Peru’s Law No. 31814 is the country’s general legal framework for the development, implementation, and use of artificial intelligence, designed to promote innovation while requiring ethical and risk-based governance.[1][10] The implementing instrument is Supreme Decree No. 115-2025-PCM, published on 9 September 2025, which approved the regulation and gave operational content to the law.[1][4]

The enforcement and technical coordination role is centered in Peru’s Secretariat of Government and Digital Transformation within the Presidency of the Council of Ministers (PCM), which is identified in official materials as the national authority for the AI framework.[5][11] Official government pages confirm the regulation’s approval in September 2025 and describe the framework as the country’s legal basis for AI development and use.[3][10]

On dates, the key milestones are: the regulation was approved on 9 September 2025; the first general effective date commonly reported for the regulatory package is 22 January 2026 after the transition period; and specific administrative obligations and digital channels began on 10 September 2025.[7][8][12] Public-government summaries also note that the first sectoral compliance deadline fell on 10 September 2026.[7][13]

Who Must Comply

The framework applies to entities public and private, including public companies, the private sector, academia, and civil society actors that design, deploy, procure, or use AI systems in Peru’s digital transformation ecosystem.[1][9] Official and professional summaries describe the law as broadly applicable rather than limited to a single industry.[1][10]

The regulation uses a risk-based structure, with heightened obligations for AI in sectors such as health, education, justice, security, economy, and finance, and later deadlines for other sectors such as transport, commerce, labor, production, agriculture, energy, and mining.[7][12][13] That means a company outside Peru can still be caught if it places AI into service for the Peruvian market or operates AI affecting Peru-based users or activities, although the exact extraterritorial phrasing should be checked against the official text before finalizing a legal position.[1][4]

The framework also appears to preserve room for public-interest experimentation and controlled testing, including regulatory sandboxes described in secondary analyses.[9] No broad exemption for small enterprises is described in the government summaries reviewed; instead, the regime uses phased compliance and sectoral timing rather than a full-size exemption model.[7][12]

Core Requirements

  1. Risk-based governance: Organizations must classify AI uses by risk and apply stronger controls to systems with higher potential impact, especially in sensitive sectors.[9][13]
  2. Transparency and explainability: Providers and deployers must disclose meaningful information about AI use and support understandable explanations for affected persons where required.[7][9]
  3. Human oversight: High-risk systems must remain subject to effective human review and intervention, not fully autonomous decision-making in all cases.[7][9]
  4. Impact assessments: High-risk AI deployments require documented evaluation of foreseeable harms, proportionality, and mitigation measures before or during use.[7][13]
  5. Internal controls and documentation: Organizations must adopt internal policies, maintain records, and keep technical and governance documentation for systems subject to the regime.[7][13]
  6. Data protection alignment: AI processing that uses personal or sensitive data must align with Peru’s privacy rules, including lawful use, security, and rights protection.[10][14]
  7. Restricted-use compliance: Uses associated with prohibited or strongly restricted outcomes, such as unlawful mass surveillance or autonomous lethal decision-making, must be avoided.[9]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Regulation approved | 9 September 2025 | Supreme Decree No. 115-2025-PCM approves the implementing regulation.[1][4] | | Early administrative obligations | 10 September 2025 | Government-side channels and certain preparatory obligations begin.[12] | | General effective date | 22 January 2026 | Core regulation enters practical force after the transition period.[8][12] | | First sectoral deadline | 10 September 2026 | High-priority sectors begin applying specific transparency, oversight, and documentation duties.[7][13] | | Later sectoral deadline | 10 September 2027 | Additional sectors enter the compliance schedule.[12] | | Outer sectoral deadline | 10 September 2028 | Remaining phased obligations reach the longest timeline reported in secondary summaries.[12][13] |

Maximum penalties depend on how the conduct is characterized under Peru’s broader administrative, consumer, privacy, sectoral, and competition laws, because the AI framework itself is described in the sources reviewed as a governance regime rather than a fully self-contained sanctions code.[1][10][14] The practical sanctions exposure therefore includes administrative orders, suspension of deployment, compliance mandates, privacy enforcement, and sector-specific penalties, with the precise fine ceiling requiring review of the connected enforcement provisions and any implementing action by the competent authority.[1][4][14]

How to Comply

  1. Inventory all AI systems in use, including vendor tools, internal models, decision-support tools, and automated scoring systems.
  2. Map each use case to risk tier and sector, then flag anything in health, education, justice, security, finance, transport, commerce, labor, agriculture, energy, or mining.
  3. Build a governance framework aligned to ISO 42001 for AI management, with assigned accountability, approval workflows, logging, and periodic review.
  4. Embed security controls consistent with ISO 27001 and NIST CSF 2.0, especially asset management, access control, incident response, and continuous monitoring.
  5. Run impact assessments before deployment of high-risk systems, covering harm scenarios, bias, explainability, human override, and third-party dependencies.
  6. Document transparency notices and human oversight procedures so users, employees, and affected individuals can understand when AI is used and how review works.
  7. Align privacy operations with Peru’s personal-data rules by checking lawful basis, minimization, retention, cross-border transfer, and automated-decision rights.
  8. Test and retrain controls regularly using audit trails, red-teaming, model-change approval, and vendor reassessment before major updates.

Related Regulations

  • Peru Personal Data Protection Law (Law No. 29733): This is the main privacy law that AI deployments must follow when they process personal or sensitive data.[14]
  • Supreme Decree No. 016-2024-JUS: This privacy implementing rule strengthens the operational layer for data subject rights and automated processing disclosures.[14]
  • EU AI Act: It overlaps conceptually on risk-based governance, but Peru’s regime is narrower and nationally tailored, so multinational organizations must run parallel compliance tracks.
  • EU GDPR: It can conflict or overlap where Peru-based AI also handles EU residents’ data, especially on automated decision-making, transparency, and cross-border transfers.
  • Sectoral financial, health, and consumer rules in Peru: These may add mandatory documentation, audit, and notice duties beyond the AI regulation itself.

FAQ

Does Peru’s AI law apply to companies outside Peru?

Yes, if the AI system is developed, offered, or used in a way that affects the Peruvian market or Peruvian users, the company may fall within the regime’s scope.[1][9] The sources reviewed describe broad applicability, but the precise extraterritorial test should be confirmed in the official text before concluding on a specific cross-border model.[4][10]

Does the law ban all high-risk AI?

No. The framework does not ban all high-risk AI; it requires stronger governance, oversight, and documentation for higher-risk uses.[7][9][13] The line is drawn instead around specific prohibited or strongly restricted uses, including some surveillance and autonomous lethal applications described in secondary analyses.[9]

When did compliance actually start?

The regulation was approved on 9 September 2025, and the general effective date is commonly reported as 22 January 2026 after the transition period.[1][8][12] Some preparatory duties started earlier on 10 September 2025, and the first sectoral compliance deadline is reported as 10 September 2026.[7][12][13]

What sectors face the earliest obligations?

The earliest reported obligations apply to health, education, justice, security, economy, and finance.[7][13] Later phases extend to transport, commerce, labor, and then production, agriculture, energy, and mining.[12][13]

Are there separate privacy obligations for AI systems?

Yes. If AI systems use personal or sensitive data, organizations must also comply with Peru’s data protection framework, including lawful processing, security, and rights handling.[10][14] This means AI compliance and privacy compliance need to be designed together, not in separate silos.[14]

Sources

Put it into practice

More compliance guides