Peru's AI Regulation: Public Sector Deadline Looms Sept 9

With just days to go until September 9, 2026, Peru's public sector entities — including Executive, Legislative, and Judicial bodies — must finalize their preparations for the phased implementation of Supreme Decree No. 115-2025-PCM. This critical deadline marks a significant step in ensuring responsible Artificial Intelligence (AI) deployment across government operations, building on the national framework that has been fully effective since January 13, 2026.

What's changing — substance

Supreme Decree No. 115-2025-PCM, which serves as the regulation for Law No. 31814, has established Peru's foundational national framework for the development and use of Artificial Intelligence. Its overarching goal is to harness AI for economic and social advancement while rigorously safeguarding fundamental rights and ensuring ethical deployment. This comprehensive framework applies broadly to anyone involved in AI systems within Peru, encompassing both government bodies and private companies.

The regulation introduces a crucial risk-based approach, categorizing AI uses into three tiers: prohibited, high-risk, and acceptable. Prohibited uses are those deemed to pose unacceptable risks to fundamental rights or public safety. These include AI systems designed for deceptive manipulation, lethal autonomous systems, mass surveillance without a clear legal basis, and real-time biometric identification in public spaces, with very few, tightly defined exceptions. Entities found developing or deploying such systems face severe consequences under existing legal frameworks.

For AI systems classified as high-risk, the Decree imposes stringent obligations to mitigate potential harm. These include:

Mandatory Transparency: Developers and users must ensure visible labeling of AI-generated content and provide clear, understandable explanations for decisions made by AI systems that significantly affect individuals.
Strong Privacy Protections: The regulation emphasizes aligning AI development and use with Peru’s existing data protection law. This means embedding privacy-by-design principles from the outset and practicing data minimization, ensuring only necessary data is collected and processed.
Robust Security Measures: High-risk AI systems require mandatory pre-deployment security audits and continuous testing throughout their lifecycle. Adherence to international standards, such as ISO/IEC 42001:2025, is strongly encouraged to ensure system integrity and resilience.

Beyond these, private developers of high-risk AI systems are also required to maintain thorough documentation, conduct comprehensive impact analyses, and ensure effective human oversight mechanisms are in place. Records related to these systems must be kept for at least three years.

It's important to note that while the Decree sets clear AI-specific rules, its enforcement relies on Peru's existing legal frameworks rather than creating entirely new AI-specific penalties. Breaches related to data protection will be handled under Peru’s established data protection law, while other violations may fall under the purview of relevant sectoral regulators or general administrative, civil, and criminal laws. Non-compliance can lead to a range of consequences, including administrative actions, orders to suspend or alter AI operations, and potential civil or criminal liability. The general provisions of this Decree became effective on January 13, 2026, meaning these obligations are already live.

Who is affected — jurisdictions, sectors, sizes

The Supreme Decree No. 115-2025-PCM, regulating Law No. 31814, establishes a comprehensive national framework for AI across Peru. It applies broadly to anyone developing, implementing, or using AI within the country, encompassing both private companies and public sector entities. This national scope ensures a consistent approach to AI governance from the federal level, without specific regional or state-level variations.

While the general provisions of the Decree became effective on January 13, 2026, a specific, phased implementation deadline for the public sector looms large. By September 9, 2026 – just days from now – all Executive, Legislative, and Judicial bodies are expected to have fully integrated the regulation's requirements into their AI strategies and operations. This means that government ministries, agencies, parliamentary offices, and judicial institutions must ensure their AI systems, whether in development or already in use, comply with the established standards, particularly concerning high-risk applications. This phased approach acknowledges the unique complexities and scale of government operations, providing a specific window for public entities to align their practices before the full weight of the regulation's enforcement mechanisms can be applied to their AI deployments. Private sector entities, while already subject to the general effective date, should also be aware of the government's heightened compliance posture, as it may influence future regulatory interpretations and enforcement trends.

Three things to do this week — concrete actions

With the September 9, 2026, deadline for public sector phased implementation just around the corner, Executive, Legislative, and Judicial bodies in Peru must take immediate, decisive action to ensure compliance with Supreme Decree No. 115-2025-PCM. Here are three critical steps to prioritize this week:

Immediately Cease Prohibited AI Development and Deployment: Public sector entities must conduct an urgent, comprehensive audit of all current and planned AI initiatives to identify and immediately halt any systems falling under the 'prohibited uses' category. This includes applications designed for deceptive manipulation, lethal autonomous systems, mass surveillance without explicit legal basis, or real-time biometric identification in public spaces, unless specific, narrow exceptions apply and are legally justified. Non-compliance in this area carries significant legal, ethical, and reputational risks, making immediate cessation of such activities paramount before the deadline.
Fast-Track Impact Analyses for High-Risk AI Systems: For any AI system identified as 'high-risk' within government operations, agencies must ensure that comprehensive impact analyses are completed and thoroughly documented without delay. These analyses are crucial for understanding, assessing, and mitigating potential risks to fundamental rights, public safety, and democratic processes. Given the September 9 deadline, any high-risk AI system currently in use or nearing deployment must have this analysis thoroughly documented, demonstrating proactive adherence to the Decree's requirements for responsible AI governance.
Establish and Verify Human Oversight Mechanisms: The regulation mandates robust human oversight for all high-risk AI systems. Public sector bodies must verify that clear, effective, and operational human oversight mechanisms are in place for such systems. This involves ensuring that human operators can meaningfully intervene, override, or correct AI decisions, and that there are clear protocols for human review of AI outputs, especially in critical decision-making processes. This isn't merely about having a policy on paper; it's about demonstrating functional human control and accountability over critical AI applications before the deadline takes full effect for the public sector.

Related context — cross-link to other regulations briefly

The Supreme Decree No. 115-2025-PCM and Law No. 31814 represent the culmination of several years of legislative effort in Peru to responsibly address the rise of Artificial Intelligence. This framework evolved from earlier proposals such as Project 2775/2022, which aimed to promote AI use, and Project 7033/2023, which specifically sought to regulate its development and application. For a broader understanding of Peru's comprehensive approach to AI, a detailed overview is available in the Peru AI Regulation Overview.

Note: this article was drafted by AI - Google Gemini