Chile - AI Systems Regulation (Boletín 16821-19)

Overview

The "Proyecto de Ley que regula los Sistemas de Inteligencia Artificial" (Boletín 16821-19) is an Executive message submitted on 7 May 2024 that establishes a nationwide, risk-based regulatory framework for the development, deployment and use of AI systems affecting Chile. Its primary objectives are to (a) promote responsible innovation, (b) protect fundamental rights and democratic principles, and (c) create governance and enforcement mechanisms to manage AI-related harms. The bill adopts a four-tier risk classification (unacceptable, high, limited, no-evident-risk) and lists prohibited uses such as subliminal manipulation and certain biometric remote-identification practices. The full text of the Executive message and the project text are available from the Chamber of Deputies (full legislative message and project PDF). For the official submission see Message and bill (Chamber PDF) and the Senate tramitación portal at Senate tramitación (Boletín 16821-19).

Definitions

The bill provides detailed definitions to ground scope and obligations, including: "system of artificial intelligence" (machine-based systems that infer outputs such as predictions, content, recommendations or decisions from inputs); "use" (development, testing, validation, distribution, market placement or any activity performed by an operator); "operator/provider/implementer/importer/distributor" (roles with defined responsibilities); "person affected" (individuals impacted by system outputs); and risk categories (unacceptable, high, limited, no-evident-risk). Definitions largely mirror international models (citations to EU AI Act concepts and UNESCO recommendations appear in the explanatory memoranda) and emphasize outputs that can influence physical or virtual environments.

Governance and Institutional Framework

The bill organizes governance along three pillars: (1) policy leadership and coordination under the Ministry of Science, Technology, Knowledge and Innovation; (2) a multi-stakeholder "Consejo Asesor Técnico de IA" (technical advisory council) to provide recommendations, produce yearly reports to Congress and propose lists of high-risk or limited-risk uses; and (3) supervisory and sanctioning functions placed with Chile's data protection authority for data-related violations and with cybersecurity agencies for incidents impacting system security. The documentation of the project references coordination with the newly-created Agency for Personal Data Protection (Ley 21.719) and the national cybersecurity agency (Agencia Nacional de Ciberseguridad) to ensure alignment on incident reporting and enforcement resources. The Council's composition brings together Ministers (or delegates), technical experts, civil society and industry representatives; institutional roles include drafting risk lists, advising on guidelines and assessing the law's implementation every three years.

Key Focus Areas

The bill addresses several substantive regulatory areas: risk classification and prohibitions (defining and forbidding certain inacceptable uses of AI); obligations for high-risk systems (mandatory risk management systems, pre-deployment conformity checks, continuous monitoring, lifecycle impact assessment and documented mitigation measures); incident reporting and coordination (preliminary notifications and follow-ups, often within 72 hours for relevant incidents, coordinated with the Data Protection Agency and ANCI for cybersecurity-related breaches); transparency and disclosure (explainability obligations for affected persons, labelling of synthetic content, and provenance disclosure when AI systems generate or manipulate audio, images, video or text); data governance alignment (requiring compliance with Chilean personal data law and references to cross-border transfer safeguards); safety and cybersecurity (technical and organizational security measures, resilience requirements and integration of cybersecurity incident taxonomies); accountability and documentation (mandated record-keeping, logs, risk registers and documentation for audit and conformity assessments); proportionality and support for SMEs (scaled obligations and tailored support measures); and innovation safeguards (regulated sandboxes for supervised experimentation, limited exemptions for research prior to commercialization and measures to avoid blocking open-source components except where they are marketed as high-risk products).

Implementation Framework

Implementation is organized in sequenced layers: (a) immediate obligations tied to risk classification and basic transparency; (b) medium-term obligations requiring certification or conformity assessment for designated high-risk systems; and (c) delegated rulemaking and technical standards set by competent agencies (including interoperability and reporting protocols). The bill contemplates delegated powers for ministers and agencies to publish mandatory technical guidance, lists of high-risk systems, templates for risk-management systems and procedures for sandbox approvals. It also anticipates cooperation agreements between the data protection authority and the national cybersecurity agency to coordinate incident response and joint supervision.

Monitoring and Evaluation

The bill mandates monitoring through: (i) periodic reporting by operators (frequency depends on risk level), (ii) annual reports by the Consejo Asesor Técnico to Congress and the Ministry of Science, and (iii) mandatory impact studies for certain categories. The Advisory Council is required to evaluate the law's practical implementation and to recommend changes every three years. Supervisory authorities will maintain registers and publish enforcement outcomes to enhance accountability and market transparency.

Penalties, Liability, and Appeals

Enforcement is primarily administrative with fines and corrective orders. Public summaries and parliamentary materials indicate a graduated fine regime with amounts scaled by UTM and proportionality factors (company size, number of affected people, remediation efforts, cooperation). The bill reserves judicial review and specific civil liability routes for damage caused by AI systems, and contemplates simplified judicial procedures for liability claims. Mitigating factors—such as prompt cooperation and active remediation—are explicit. The data protection authority has investigatory and sanctioning powers for data-related breaches; cybersecurity agencies maintain parallel incident-handling authorities.

Relationship to Other Instruments

The draft explicitly cross-references and coordinates with: (a) Ley N° 21.719 (new Chilean personal-data protection law that creates the Agency for Personal Data Protection), (b) Ley N° 21.663 and its implementing regulations on cybersecurity and incident reporting (which created the Agencia Nacional de Ciberseguridad), (c) Chile's updated Política Nacional de Inteligencia Artificial and Ministry circulars on responsible AI use in the public sector, and (d) consumer protection and transparency laws (notably provisions of Ley N° 20.285 on access to public information where applicable). The bill is positioned as complementary—rather than replacing—these instruments, and relies on inter-agency memoranda and delegated rulemaking to operationalize cross-sector coordination.

International Alignment

The bill takes comparative law from the EU AI Act and UNESCO recommendations as reference points: it adopts a risk-based stratification, enumerates prohibited uses similar to EU lists (e.g., certain biometrics and subliminal manipulation), and emphasizes conformity assessment and transparency. The explanatory memorandum cites the EU approach and emphasizes interoperability with international standards to support cross-border trade and research cooperation. Chile intends to remain aligned with major regulatory regimes while tailoring obligations to national institutional capacity and economic contexts.

Implementation Timeline

Sources and References