Ecuador AI Regulation Overview

Overview

Ecuador's overall approach to artificial intelligence governance integrates comprehensive public policy roadmaps, internal public sector ethical directives, and pending organic legislation. Central to the country's national strategy is the Estrategia Nacional de Inteligencia Artificial (ENIA), spearheaded by the Ministry of Telecommunications and the Information Society (MINTEL). Promulgated to advance digital transformation under the Organic Law for Digital and Audiovisual Transformation (LOTDA), the ENIA serves as an authoritative framework to accelerate innovation while guaranteeing the protection of fundamental citizen rights across national territories.

In parallel with executive policy, administrative oversight bodies have established binding ethical requirements for public sector deployment. Notably, the Superintendencia de Competencia Económica (SCE) adopted a formal AI Code of Ethics and institutional auditing guidance to ensure human-centered, transparent, and non-discriminatory use of automated support tools within public administration. These existing measures position Ecuador as an emerging regional contributor to structured AI governance.

Simultaneously, Ecuador's legislative branch is processing foundational statutory frameworks, including the Draft Organic Law for the Regulation and Promotion of Artificial Intelligence and the unified AI and Data Protection Regulation Bill. Building upon existing instruments like the Organic Law on Personal Data Protection, the pending legislation seeks to establish a comprehensive, risk-based statutory framework that defines regulatory roles, mandates technical impact assessments, and enforces system transparency across both public and private sectors.

Regulatory Approach

Ecuador is adopting a risk-based and multi-layered regulatory architecture that combines horizontal strategic policy with domain-specific binding rules. The legislative bills under consideration in the National Assembly introduce a risk-based classification model heavily influenced by international precedents. Under this structure, AI applications are categorized into low-risk and high-risk systems, alongside explicit prohibitions or tight restrictions on high-danger uses, such as mass biometric surveillance and social scoring systems that produce legal or significant societal effects.

The regulatory framework balances soft law strategic planning with hard administrative compliance. The ENIA operates as a non-binding but authoritative strategic policy establishing national pillars for infrastructure, human talent, and ethical governance. Conversely, agency-level regulations—such as Resolution No. SCE-DS-2025-34 issued by the SCE—impose mandatory compliance across internal administrative units, establishing clear operational rules for algorithmic support tools.

Furthermore, proposed national legislation emphasizes systemic risk management and continuous oversight. High-risk AI systems deployed in safety-critical, fundamental rights, or public decision-making domains are subject to strict pre-deployment obligations. These include mandatory Data Protection Impact Assessments (DPIAs), model cards, dataset provenance documentation, algorithmic explainability requirements, and formal registration with supervisory authorities prior to market deployment.

Key AI Legislation

• Estrategia Nacional de Inteligencia Artificial (ENIA) (2024 / 2026): Spearheaded by MINTEL and published in Registro Oficial Suplemento N° 206, this comprehensive roadmap guides national AI development and governance across three main pillars: Capacity and Technology, Adoption and Innovation, and Governance and Ethics.
• Código de Ética para el Uso de la Inteligencia Artificial de la Superintendencia de Competencia Económica (2025): Adopted via Resolution No. SCE-DS-2025-34 and published in Registro Oficial No. 60, this binding guideline establishes ten ethical principles—including the primacy of human judgment, transparency, and personal data protection—for AI tools used within the SCE.
• Draft Organic Law for the Regulation and Promotion of Artificial Intelligence (Under Review): An 83-article bill introduced in August 2024 establishing a dedicated statutory framework for risk classification, fundamental rights protection, algorithmic explainability, and the creation of a National AI Agency and Council.
• AI and Data Protection Regulation Bill (Under Review): A legislative initiative (with bill unification authorized by CAL in February 2025) designed to create an integrated risk-based framework regulating AI systems that process personal data, overseen by the national data protection authority.

Governance & Enforcement Bodies

Governance of AI in Ecuador involves both existing supervisory agencies and proposed dedicated regulatory authorities. The Ministry of Telecommunications and the Information Society (MINTEL) serves as the primary policy rector for digital transformation and telecommunications, issuing technical standards and guidelines for public sector AI integration. Under the ENIA framework, inter-institutional coordination is facilitated by the Comité de Inteligencia Artificial, which integrates MINTEL, SENESCYT, the Ministry of Production, and the data protection authority to oversee national strategy execution.

Data protection oversight linked to AI operations falls under the Superintendencia de Protección de Datos Personales (SPDP). The SPDP holds supervisory powers over personal data processing, issues binding resolutions, manages controller registries, and is slated under pending legislation to supervise AI-related Data Protection Impact Assessments (DPIAs) and audit compliance. Additionally, market-specific bodies like the Superintendencia de Competencia Económica (SCE) manage internal ethical compliance through institutional entities like the Committee of Ethics of AI.

Under the proposed Draft Organic Law for the Regulation and Promotion of AI, overarching regulatory authority would be assigned to a new National AI Agency. Operating alongside a coordinating ministry and a National AI Council (comprising SENESCYT, SPDP, and sectoral ministries), the agency would handle national risk classifications, maintain public registers of high-risk systems, manage regulatory sandboxes, and supervise compliance across public and private sector deployers.

Penalties & Enforcement

Enforcement mechanisms in Ecuador differ across policy guidelines, institutional regulations, and pending legislative drafts. Under the active institutional framework of the SCE, enforcement is managed internally through mandatory compliance protocols, system audits overseen by the internal AI Ethics Committee, and continuous verification using the Guide for Auditing AI Tools. Under the ENIA, non-compliance or identified ethical risks in public sector initiatives trigger administrative corrective measures, including the potential suspension of specific AI projects and technical standard revisions.

The pending legislative corpus—comprising the Draft Organic Law and the AI and Data Protection Regulation Bill—foresees administrative enforcement powers, market surveillance capabilities, and formal sanctioning procedures for non-compliant AI deployers and developers. Regulators such as the SPDP and the proposed National AI Agency would be empowered to conduct mandatory audits, inspect operational logs, evaluate incident reports, and order corrective remediation. While specific monetary fine schedules are not detailed within the available corpus, the proposed legislation establishes formal administrative sanctions, project suspensions, and regulatory remediation procedures.

Data Protection Framework

Ecuador's data protection architecture in AI contexts is grounded in the national Law on Protection of Personal Data and supervised by the Superintendencia de Protección de Datos Personales (SPDP). The framework requires strict adherence to privacy, confidentiality, and security standards when personal data is processed by automated models. Existing supervisory guidance mandates mitigation techniques such as data anonymization, pseudonymization, and informed consent, while the ENIA emphasizes "Digital Sovereignty" (Soberanía Digital) to maintain state oversight over critical data assets.

Proposed statutory frameworks significantly expand data protection obligations for AI developers and operators. The AI and Data Protection Regulation Bill integrates data protection safeguards directly into AI deployment workflows, mandating Data Protection Impact Assessments (DPIAs), model documentation, and dataset provenance reporting whenever AI models process sensitive categories of personal information. The proposed law grants affected individuals explicit rights regarding automated decision-making, including access and data portability, while prohibiting invasive profiling and mass surveillance tools that infringe upon fundamental constitutional rights.

Sector-Specific Rules

Sector-specific AI guidelines in Ecuador focus heavily on public administration, market competition, and priority economic domains. In public sector operations, the ENIA designates government entities as "model users," establishing technical procurement standards, cloud infrastructure rules, and guidelines for citizen-facing automated tools. Similarly, the SCE's AI Code of Ethics explicitly mandates that within administrative proceedings, AI applications must function solely as technical support tools and cannot replace the legal analysis, decision-making, or ultimate responsibility of public officials.

Under the Draft Organic Law for the Regulation and Promotion of AI, sector-specific deployment will be coordinated between central regulators and domain authority bodies across healthcare, finance, education, and public safety. Furthermore, the ENIA targets key national economic sectors—including agriculture (precision farming), healthcare (predictive resource allocation), and public management—for tailored AI adoption, establishing controlled regulatory sandboxes to test sector-specific applications before widespread deployment.

International Alignment

Ecuador's evolving AI framework reflects strong alignment with international regulatory models and international organizational standards. The Draft Organic Law and the AI and Data Protection Regulation Bill draw extensively from international legal benchmarks, particularly the European Union AI Act, incorporating risk-based application tiers, mandatory conformity assessments, algorithmic explainability mandates, and detailed technical documentation standards.

Additionally, the ENIA embeds foundational principles established by international bodies such as the OECD and UNESCO. The formulation of the ENIA relied directly on diagnostic tools including UNESCO's Readiness Assessment Methodology (RAM) and the United Nations Development Programme's (UNDP) AI Landscape Assessment (AILA). The strategy mandates continuous international benchmarking and provides for interoperable mechanisms covering cross-border data transfers and technical standards cooperation.

Future Developments

The Ecuadorian AI regulatory landscape is progressing through several key legislative and implementation stages. Within the National Assembly, the Legislative Administration Council (CAL) authorized the unification of pending AI regulation bills in February 2025, paving the way for a unified statutory regime governing AI deployment and personal data protection. Concurrently, executive implementation under the ENIA includes scheduled rollouts for the National AI Talent Program and the opening of an AI Regulatory Sandbox.

Following the potential enactment of proposed organic legislation, compliance requirements will be rolled out in phased implementation stages. Phase 1 (months 1-12 post-enactment) focuses on establishing the National AI Agency, issuing implementing regulations, and creating certification frameworks. Phase 2 (months 12-24) foresees launching regulatory sandboxes and initiating conformity assessments for existing high-risk systems, followed by Phase 3 (from month 24 onward), which introduces full administrative enforcement and comprehensive market surveillance.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Ministerio de Telecomunicaciones y de la Sociedad de la Información (MINTEL)	Lead ministry for national telecommunications policy, digital transformation, and executive oversight of the ENIA strategy.	Issues technical standards (Acuerdos Ministeriales), establishes public sector AI procurement protocols, coordinates national cloud and infrastructure initiatives.
Superintendencia de Protección de Datos Personales (SPDP)	Primary supervisory authority for personal data protection and AI systems processing personal or sensitive data.	Issues binding resolutions, maintains data registers, supervises Data Protection Impact Assessments (DPIAs), conducts audits, enforces data compliance.
Superintendencia de Competencia Económica (SCE)	Market and competition supervisor governing internal public administration AI ethics and algorithmic support tools.	Enforces internal AI Code of Ethics, supervises administrative units, conducts system audits via the Guide for Auditing AI Tools.
National AI Agency (Proposed)	Proposed primary regulatory body under draft legislation responsible for national AI oversight, risk classification, and enforcement.	Maintains high-risk system registry, oversees conformity assessments, supervises AI regulatory sandboxes, investigates incidents, issues technical standards.