Panama - AI Governance Overview

Overview

Panama's regulatory philosophy regarding Artificial Intelligence (AI) is deeply integrated into its broader vision of becoming a regional 'Digital Hub.' The government has adopted a proactive stance, viewing AI as a critical driver for economic diversification and public sector modernization. This approach is codified in the National Strategy for Artificial Intelligence (Estrategia Nacional de Inteligencia Artificial), which was developed by the National Authority for Government Innovation (AIG). The strategy emphasizes the ethical use of technology, focusing on social inclusion, transparency, and the improvement of public services. Panama's maturity level is considered emerging but rapidly advancing, as it has successfully transitioned from conceptual frameworks to the implementation of AI in specific government functions, such as the 'SARA' chatbot and health management systems. The overall approach is centralized under the Executive Branch, with the AIG serving as the primary architect of digital policy. Panama seeks to balance innovation with the protection of fundamental rights, particularly in the context of its strategic position in global logistics and finance. By aligning its AI goals with the Sustainable Development Goals (SDGs) of the United Nations, Panama aims to ensure that AI development does not exacerbate social inequalities. The regulatory environment is currently characterized by a mix of high-level policy guidance and binding data protection mandates, creating a framework that encourages investment while maintaining strict oversight over how personal information is processed by automated systems. This vision is articulated in the National Strategy for Artificial Intelligence, which aligns technological advancement with social development goals. The strategy emphasizes that AI deployment must be ethical, transparent, and inclusive, ensuring that the benefits of automation reach all sectors of society, from the bustling urban centers of Panama City to the more remote rural areas. By positioning itself as a regional leader in digital governance, Panama aims to attract international investment and foster a local ecosystem of innovation that can compete on a global scale. The regulatory philosophy is one of 'responsible innovation,' where the government provides a clear roadmap for development while maintaining the necessary safeguards to protect the rights and privacy of its citizens.

Regulatory Approach

Panama currently utilizes a hybrid regulatory approach that combines horizontal data protection requirements with sectoral policy guidelines. There is no single, comprehensive 'AI Law' that governs all aspects of the technology; instead, AI is regulated through the lens of existing digital transformation and data privacy statutes. The approach is predominantly 'soft law' regarding ethical standards and 'hard law' regarding data handling. The National AI Strategy acts as a horizontal policy framework, setting the ethical tone for both public and private sectors, while Law 81 of 2019 (Personal Data Protection) provides the binding legal constraints for any AI system that processes the data of Panamanian residents. The regulatory framework is risk-based, particularly within the public sector. The AIG evaluates AI projects based on their potential impact on citizens, prioritizing transparency and human oversight in high-stakes applications like healthcare and social security. While the private sector enjoys a relatively flexible environment for AI innovation, the government has signaled that future regulations may become more prescriptive, especially concerning algorithmic accountability and the prevention of bias. This evolutionary approach allows Panama to adapt to rapid technological changes without stifling the growth of its burgeoning tech sector, while ensuring that the legal infrastructure remains robust enough to handle the complexities of machine learning and autonomous systems. The regulatory approach in Panama is characterized by a 'policy-first' methodology, where high-level strategic documents set the stage for subsequent legislative and administrative actions. Rather than rushing to implement a restrictive and potentially premature AI-specific law, Panama has opted for a flexible framework that utilizes existing legal instruments to manage the risks associated with AI. This approach is anchored by the National Strategy for Artificial Intelligence, which serves as a horizontal policy guide for both the public and private sectors. The strategy is built on four fundamental pillars: Governance, Talent, Infrastructure, and Ethics. This allows the government to address the multi-faceted nature of AI, from the need for specialized human capital to the technical requirements of data processing and the ethical implications of algorithmic decision-making. In the public sector, the approach is more prescriptive, with the AIG issuing mandatory guidelines for the adoption of digital technologies. In the private sector, the environment is more permissive, encouraging experimentation through initiatives like digital sandboxes, provided that companies adhere to the strict data protection standards established by Law 81 of 2019. This dual-track system ensures that the state can lead by example in the ethical use of AI while providing the private sector with the stability and clarity needed to innovate.

Key AI Legislation

• Law 81 of 2019 on Personal Data Protection: The cornerstone of AI regulation in Panama, establishing the rights of individuals over their data and the obligations of those who process it using automated means. It defines the rights of data subjects and the obligations of data controllers, including specific provisions for automated processing.
• Executive Decree No. 285 of 2021: Provides the detailed regulations for the implementation of Law 81, including specific requirements for data transfers and the security measures necessary for automated processing. It provides the necessary regulatory detail for the implementation of Law 81, covering aspects such as international data transfers and the security protocols for data storage.
• National Strategy for Artificial Intelligence (2021): A policy document outlining the four pillars of AI development in Panama: Governance, Talent, Infrastructure, and Ethics. It serves as a horizontal policy guide for both the public and private sectors.
• Law 144 of 2020 on Government Digital Transformation: Establishes the legal framework for the use of digital technologies, including AI, to simplify administrative procedures and improve government efficiency. This law provides the legal basis for the government to use advanced technologies, including AI and machine learning, to streamline administrative processes and improve the delivery of public services.

Governance & Enforcement Bodies

The governance of AI in Panama is primarily divided between two major entities: the National Authority for Government Innovation (AIG) and the National Authority for Transparency and Access to Information (ANTAI). The AIG is responsible for the technical implementation and strategic direction of AI within the state. Its mandate includes the design of the National AI Strategy and the oversight of all digital transformation projects across government ministries. The AIG acts as a technical advisor to the executive branch, ensuring that AI tools are interoperable, secure, and aligned with the country's technological roadmap. It also manages the 'National Cloud' infrastructure, which hosts many of the data sets used for training AI models in the public sector. ANTAI, on the other hand, serves as the primary enforcement body for data protection and transparency. Through its Directorate for the Protection of Personal Data, ANTAI has the power to investigate complaints, conduct audits of AI systems that process personal data, and impose sanctions on entities that violate Law 81 of 2019. ANTAI’s role is critical in the AI ecosystem as it ensures that algorithmic decision-making does not infringe upon the privacy rights of citizens. The authority also promotes the 'Open Data' initiative, which provides the high-quality datasets necessary for AI development while ensuring that such data is properly anonymized and managed according to legal standards. Working alongside the AIG is the National Secretariat for Science, Technology and Innovation (SENACYT), which focuses on research and development and the training of high-level human capital in AI-related fields, and the various sectoral superintendencies, such as those for banking and securities, which oversee the use of AI within their respective industries.

Penalties & Enforcement

Enforcement of AI-related regulations in Panama is primarily conducted through the administrative procedures established under the Data Protection Law (Law 81). ANTAI is empowered to impose fines on both public and private entities that fail to comply with data processing standards. Fines are categorized based on the severity of the infraction: minor, serious, or very serious. For minor infractions, such as failing to register a database, fines can range from $1,000 to $5,000. For more severe violations, such as the unauthorized processing of sensitive data or failing to implement adequate security measures for AI systems, fines can reach up to $10,000. While these figures are lower than those found in the EU's GDPR, there are ongoing legislative discussions to increase these penalties to better reflect the scale of modern data-driven enterprises. Beyond financial penalties, ANTAI has the authority to order the immediate cessation of data processing activities, which can effectively shut down an AI system found to be in violation of the law. The enforcement process includes a right to appeal, where entities can challenge ANTAI's decisions before the Third Chamber of the Supreme Court of Justice. In cases where AI-related activities result in criminal negligence or fraud, the Public Ministry may intervene to pursue criminal charges under the Penal Code. The enforcement landscape is designed to be corrective, with an emphasis on bringing entities into compliance through warnings and remedial orders before resorting to the maximum financial sanctions. Furthermore, the AIG has the power to halt government AI projects that do not meet its technical or ethical standards. In cases of criminal activity, such as data theft or the malicious use of AI to commit fraud, the Public Ministry can pursue criminal charges under the Panamanian Penal Code, which includes provisions for cybercrimes and the protection of information systems.

Data Protection Framework

Panama’s data protection framework is heavily influenced by international standards, specifically the GDPR and the Ibero-American Data Protection Standards. Law 81 of 2019 establishes the fundamental principles of loyalty, purpose, proportionality, and veracity in data processing. For AI developers, this means that any system designed to process personal data must have a clear, lawful basis, and the data collected must be limited to what is strictly necessary for the AI's intended function. The law also grants citizens the ARCO rights (Access, Rectification, Cancellation, and Opposition), which are vital for ensuring transparency in automated decision-making processes. If an AI system makes a decision that affects a citizen, Law 81 provides a framework for the individual to contest that decision and demand human intervention. Executive Decree 285 of 2021 further clarifies the requirements for data localization and international transfers. While Panama does not strictly mandate that all data be stored within its borders, it requires that any data transferred abroad for AI training or processing must go to jurisdictions that offer an 'adequate level' of protection. This has led to a focus on cloud security and the use of standard contractual clauses for cross-border data flows. The framework also emphasizes the concept of 'Privacy by Design' and 'Privacy by Default,' requiring AI developers to integrate data protection safeguards into the very architecture of their algorithms from the earliest stages of development. The law is built on seven core principles: Loyalty, Purpose, Proportionality, Veracity, Security, Transparency, and Confidentiality. For AI developers, the principle of 'Purpose' is particularly important, as it requires that data be collected for specific, explicit, and legitimate purposes and not processed in a way that is incompatible with those purposes. The principle of 'Proportionality' ensures that only the data strictly necessary for the AI's function is collected.

Sector-Specific Rules

In the financial sector, the Superintendency of Banks of Panama (SBP) and the Superintendency of the Securities Market (SMV) have issued guidelines regarding the use of technology and risk management. While not AI-specific, these regulations require financial institutions to maintain strict control over the algorithms used for credit scoring and fraud detection. The SBP emphasizes that the use of AI does not exempt banks from their fiduciary responsibilities or from the requirement to maintain 'explainable' models for regulatory audits. Financial entities must ensure that their AI systems do not produce discriminatory outcomes and that they have robust disaster recovery plans for automated processes. In the healthcare sector, the Ministry of Health (MINSA) and the Social Security Fund (CSS) govern the use of AI in clinical settings. Regulations focus on the confidentiality of patient records and the requirement that AI-driven diagnostic tools be used only as aids to human medical professionals, not as replacements. There are specific protocols for the 'Digital Health' initiative, which uses AI to analyze epidemiological data. These protocols require that any AI application used in public health must undergo a rigorous security assessment by the AIG to ensure that sensitive medical data is protected against breaches and unauthorized access. Additionally, the Panama Canal Authority (ACP) has its own set of internal regulations regarding the use of AI and automated systems for maritime transit and logistics, focusing on operational safety and efficiency in one of the world's most critical trade routes. The SBP requires banks to implement robust risk management frameworks for any technology-driven service, including the use of AI for credit scoring, fraud detection, and customer service. Banks must ensure that their algorithms are 'explainable' and that they do not result in discriminatory practices. The SBP also emphasizes the importance of human oversight, requiring that significant decisions made by AI be subject to review by qualified personnel.

International Alignment

Panama is highly committed to aligning its AI regulatory framework with international best practices to maintain its status as a global logistics and financial hub. The country is a signatory to the UNESCO Recommendation on the Ethics of Artificial Intelligence, which serves as a foundational document for its domestic policy. Furthermore, Panama actively participates in the Ibero-American Network of Data Protection (RIPD), ensuring that its data privacy laws remain compatible with those of its regional neighbors and European partners. This alignment is intended to facilitate the free flow of data, which is essential for the operation of the Panama Canal and the international banking center. The influence of the EU AI Act is also visible in Panama’s legislative discourse. While Panama has not adopted the Act's specific risk classifications, the AIG and ANTAI frequently reference European standards when drafting guidelines for transparency and algorithmic accountability. Panama also adheres to the OECD Principles on Artificial Intelligence, promoting AI that is innovative, trustworthy, and respects human rights and democratic values. By participating in international forums like the Global Partnership on AI (GPAI) as an observer or participant in regional dialogues, Panama ensures that its regulatory environment remains attractive to international tech companies while upholding high ethical standards. The country has formally adopted the UNESCO Recommendation on the Ethics of Artificial Intelligence, which serves as a guiding document for the AIG's policy development. Panama is also an active member of the Ibero-American Network of Data Protection (RIPD), where it collaborates with other Spanish and Portuguese-speaking nations to harmonize data privacy standards across the region. This regional cooperation is essential for creating a unified digital market in Latin America. Furthermore, Panama closely follows the developments of the OECD AI Principles and the European Union's AI Act.

Future Developments

The future of AI regulation in Panama is expected to move toward more specific and comprehensive legislation. There are ongoing discussions within the National Assembly regarding the introduction of a dedicated 'Artificial Intelligence Law' that would build upon the current National Strategy. This proposed legislation is expected to introduce more formal requirements for algorithmic impact assessments, particularly for AI systems used in critical infrastructure and public safety. Additionally, there is a push to update Law 81 of 2019 to include higher financial penalties and more explicit protections against algorithmic bias, bringing the country even closer to the standards set by the GDPR and the EU AI Act. Another significant development is the expansion of the 'Digital Hub' strategy, which includes the creation of specialized AI research centers in collaboration with international universities and tech firms. These centers are expected to operate under 'regulatory sandboxes,' allowing for the testing of innovative AI applications in a controlled environment before they are fully deployed in the market. The AIG is also working on a 'National Data Strategy' that will complement the AI Strategy by improving the quality and availability of public sector data. This will likely involve new rules on data sharing between government agencies and the private sector, aimed at fostering a more vibrant AI ecosystem while maintaining strict privacy controls. There is a growing consensus within the government and the National Assembly that a dedicated 'Artificial Intelligence Law' will eventually be necessary to address the unique challenges posed by generative AI and autonomous systems. Such a law would likely introduce more specific requirements for algorithmic transparency, including the mandatory disclosure of when a citizen is interacting with an AI. It is also expected to establish a more formal 'AI Ethics Committee' to provide ongoing guidance on the social and ethical impacts of the technology.

Key Regulations

Enforcement Bodies