Costa Rica AI Regulation Overview

Overview

Costa Rica's approach to artificial intelligence governance reflects a proactive, multi-stakeholder model designed to balance technological innovation with human rights and constitutional protections. The country became the first in Central America to establish a comprehensive public policy for AI with the official launch of the Estrategia Nacional de Inteligencia Artificial (ENIA) 2024–2027 by the Ministry of Science, Innovation, Technology and Telecommunications (MICITT) on October 24, 2024. ENIA serves as a strategic roadmap positioning Costa Rica as a regional reference in digital transformation, focusing on human-centric principles, social inclusion, and sustainable development.

Complementing executive policy efforts, Costa Rica's legislative branch is actively advancing statutory frameworks. On May 30, 2023, lawmakers introduced comprehensive regulatory proposals, including Bill No. 23.771 ("Ley para la Regulación de la Inteligencia Artificial en Costa Rica"). Notably drafted with the technical assistance of ChatGPT-4, the bill sets out binding requirements for high-risk AI applications, algorithmic accountability, explainability, and human rights assessments. Together, executive policies and legislative proposals form a cohesive vision to modernize the public sector, stimulate R&D&i, and protect fundamental rights.

Regulatory Approach

Costa Rica currently relies on a hybrid regulatory posture comprising soft-law public policy guidelines and emerging binding legislation. Under ENIA 2024–2027, executive policy is structured around seven key strategic pillars: Ethical and Secure AI, Territorial Articulation and Economic Development, Promotion of R&D&i, Intelligent Government, Talent Development, Infrastructure and Enablers, and International Leadership. This soft-law approach emphasizes multi-stakeholder collaboration across government, academia, civil society, and private industry to build national capacity without stifling innovation.

In parallel, the pending statutory bills adopt a risk-based and rights-based regulatory approach modeled after international benchmarks such as OECD principles and the European Union AI Act. Draft legislation categorizes AI systems by risk level and places strict prohibitions on applications that violate human dignity, including automated social scoring and mass surveillance conducted without specific judicial authorization. To reconcile safety with innovation, Costa Rica's strategy and draft laws prominently feature controlled regulatory sandboxes, enabling developers to test high-risk AI systems under MICITT's supervision before commercial deployment.

Key AI Legislation

• Estrategia Nacional de Inteligencia Artificial (ENIA) 2024–2027: Official policy launched by MICITT on October 24, 2024, establishing a strategic framework across seven operational axes to foster ethical, safe, and inclusive AI development throughout Costa Rica.
• Ley para la Regulación de la Inteligencia Artificial en Costa Rica (Bill No. 23.771): Comprehensive legislative bill introduced on May 30, 2023, which received a Positive Majority Report from the Science and Technology Committee in September 2024. It establishes legal definitions for AI systems, mandates Human Rights Impact Assessments, and designates MICITT as the supervisory authority for high-risk applications.
• Artificial Intelligence Regulation Bill: Legislative initiative introduced in May 2023 proposing an independent competent authority, continuous system auditing (Article 6), mandatory explainability standards, and bias prevention mechanisms.
• Decreto Ejecutivo No. 43011-MICITT (Estrategia Nacional de Transformación Digital 2022–2025): Executive decree that established foundational governance for administrative digitalization, data interoperability, digital sovereignty, and cybersecurity protocols across state entities.

Governance & Enforcement Bodies

The Ministry of Science, Innovation, Technology and Telecommunications (MICITT) serves as the supreme rector ("Rectoría") and primary institutional authority for AI governance and digital transformation in Costa Rica. MICITT is tasked with implementing ENIA 2024–2027, managing the planned National Center of Excellence in AI, and coordinating cybersecurity defenses via its Cybersecurity Directorate. Under proposed legislation (Bill No. 23.771), MICITT would also hold formal statutory powers to supervise high-risk AI systems, maintain a national registry of AI applications, oversee regulatory sandboxes, and issue mandatory technical standards.

Administrative and operational oversight involves broader institutional collaboration. The Inhabitants' Data Protection Agency (PRODHAB) works alongside MICITT to safeguard citizen privacy and manage personal data governance under Law No. 8968. Other participating entities in the governance ecosystem include the Central Bank of Costa Rica (BCCR), the National Computer Emergency Response Team (CSIRT), academic bodies such as the National Council of Rectors (CONARE), professional associations like the College of Professionals in Informatics and Computing (CPIC), and industry chambers including CAMTIC and Infocom.

Penalties & Enforcement

Enforcement mechanisms in Costa Rica are currently defined under the supervisory frameworks set forth in legislative proposals and public sector administrative decrees. Under Article 6 of both Bill No. 23.771 and the AI Regulation Bill, the competent authority is granted explicit powers to conduct periodic audits, examine operational decision-making logs, investigate citizen complaints, and verify compliance throughout an AI system's operational lifecycle. These provisions aim to detect algorithmic drift, mitigate emerging biases, and ensure continuous accountability.

Regarding monetary fines and specific sanction scales, the corpus holds no record of finalized statutory penalty schedules or criminal fine amounts, as the primary legislation remains under review in the Legislative Assembly. Under public sector digital transformation decrees, administrative non-compliance by public officials regarding digital targets and security requirements is subject to institutional performance evaluations and potential administrative sanctions.

Data Protection Framework

Data privacy in AI development and deployment is anchored in Law No. 8968 (Protection of Personal Data) and governed by the Inhabitants' Data Protection Agency (PRODHAB). Executive directives mandate that all state digital systems and automated processing mechanisms incorporate "Privacy by Design" and "Privacy by Default" principles. These requirements enforce strict access controls, robust encryption protocols, and data anonymization to preserve confidentiality when processing citizen information.

Costa Rica's privacy regime aligns closely with international standards, referencing principles consistent with the European Union GDPR to support cross-border data adequacy and international cooperation. Under proposed AI legislation, data governance extends to the training phase of AI models; developers must demonstrate that training datasets are representative, legally obtained, and free from unlawful biases that could lead to discriminatory automated outcomes.

Sector-Specific Rules

Sectoral implementation of AI in Costa Rica prioritizes high-impact public domains, including healthcare, education, and administrative services. Within healthcare, ENIA 2024–2027 sets an explicit milestone for 2025 to develop and officialize an ethical and normative framework specifically dedicated to clinical diagnostic software powered by AI. This framework aims to ensure diagnostic accuracy and safety while protecting patient rights during automated medical evaluations.

In the public administration sector, executive strategies enforce the "Once Only" principle and data interoperability across ministries, leveraging AI to streamline citizen services and improve decision-making through the Intelligent Government axis. Additionally, proposed legislative frameworks establish heightened protections for vulnerable groups, mandating strict oversight for AI applications interacting with children or persons with disabilities to prevent unfair exploitation or systemic discrimination.

International Alignment

Costa Rica actively aligns its national AI framework with international technical and governance standards. The country participates in major global policy forums, including the OECD AI Governance Committee (AIGO), the Global Partnership on Artificial Intelligence (GPAI), and the Hiroshima AI Process. Executive decrees explicitly integrate OECD Recommendations on Digital Government Strategies to ensure modern state functionality and international interoperability.

In developing ENIA 2024–2027 and national digital strategies, Costa Rica received technical and strategic support from multilateral organizations, including UNESCO, the Inter-American Development Bank (IDB), and the Development Bank of Latin America and the Caribbean (CAF). Furthermore, legislative proposals incorporate technical benchmarks from international bodies such as ISO/IEC to facilitate global market integration for Costa Rican software developers.

Future Developments

The legislative trajectory for Costa Rica's AI framework centers on the ongoing parliamentary evaluation of Bill No. 23.771 in the Legislative Assembly. Having received a Positive Majority Report from the Science and Technology Committee on September 12, 2024, the bill is advancing toward full plenary debate for potential statutory enactment.

On the executive front, implementation under ENIA 2024–2027 anticipates key operational milestones through 2025. These include the official design and rollout of a national AI regulatory sandbox model to test emergent applications under controlled environments, the finalization of the healthcare diagnostic framework, and the establishment of a National Center of Excellence in AI to consolidate national research, talent training, and 5G-enabled innovation.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Ministry of Science, Innovation, Technology and Telecommunications (MICITT)	Lead authority ("Rectoría") for AI public policy, digital transformation, and proposed primary statutory supervisor for high-risk AI.	Formulates national AI policy, establishes regulatory sandboxes, supervises high-risk system registries, issues mandatory digital standards, and oversees continuous algorithmic auditing under proposed bills.	https://www.micitt.go.cr/inteligencia-artificial/
Inhabitants' Data Protection Agency (PRODHAB)	National data protection authority responsible for enforcing personal data privacy and Law No. 8968 compliance.	Oversees personal data protection, investigates privacy violations, and coordinates with MICITT on data protection standards in AI training and deployment.
Cybersecurity Directorate / CSIRT	National operational body for cybersecurity incident response and critical digital infrastructure protection under MICITT.	Conducts security audits, mitigates infrastructure risks associated with modern technologies, and manages national cyber incident responses.