Peru - AI Use in Public Entities (6927/2023)

Overview

Project 6927/2023-CR, titled "Law that obliges the use of the Artificial Intelligence in public entities," was presented in the Peruvian Congress and has been discussed publicly by members of the Commission on Science, Innovation and Technology. The draft seeks to amend the scope of the administrative procedure framework so that "entities" referred to in the Title Preliminar of the Texto Único Ordenado of Law No. 27444 are formally obliged, under functional responsibility, to implement AI tools both in administrative activity and in the provision of public services. The bill also assigns an advisory and formative role to the Presidency of the Council of Ministers (PCM) through its Secretariat of Government and Transformation Digital (SGTD). The project is programmatic—it establishes obligations at a high level without detailed technical, procedural, or sectoral rules—and therefore relies heavily on subsequent implementation instruments and coordination by PCM/SGTD. Official communications from the Congress describe the proposal as aimed at improving public service effectiveness; civil-society analyses point to gaps in safeguards and implementation capacity, especially in relation to existing instruments such as Law No. 31814 (promoting use of AI) and the national digital transformation framework.

Definitions

The bill does not provide an extensive glossary; it uses "inteligencia artificial (AI)" in broad terms to mean algorithmic, software, or computational systems applied to administrative tasks and services. For practical implementation, established definitions in national instruments (e.g., Law No. 31814 and SGTD guidance) and international norms should be referenced: (a) AI systems include software, models and algorithms that process data to make recommendations or automated decisions; (b) "public entities" are those listed in Article I of the Title Preliminar of Law No. 27444 (executive, legislative, judicial, regional and local entities and related public bodies); (c) "functional responsibility" refers to disciplinary, administrative and/or accountability duties of public officers under the civil service/regulatory regime; (d) key operational terms (e.g., "automated decision-making," "human oversight," "high-risk application") are left to implementing regulation and sectoral guidance.

Governance and Institutional Framework

The bill centralizes technical coordination and advisory functions in the PCM through the SGTD, acknowledging PCM's role as authority for digital transformation and AI policy. PCM/SGTD is expected to issue technical advisory, training and multidisciplinary assistance to public entities for AI adoption. This design aligns with the state's existing role under Law No. 31814 and PCM digital directives, but raises governance questions: how will responsibilities be divided between PCM/SGTD, sectoral ministries, supervisory agencies and the Autoridad Nacional de Protección de Datos Personales (APDP) of the Ministry of Justice? Effective governance will require formalized inter-agency protocols, memoranda of understanding, and competency maps — for example, APDP enforcement of data protection rules, sectoral regulators ensuring safe deployment in health/justice/finance, and the Contraloría General executing audit/fiscal oversight. The bill's reliance on PCM/SGTD means implementation capacity at that office (guidelines, budget, technical teams) is a crucial variable for success; existing PCM compendia and draft regulations for Law No. 31814 are important reference points (PCM IA compendium).

Key Focus Areas

The draft emphasizes institutional adoption rather than operational safeguards. Key focus areas that emerge from the text and from public analysis include: (1) mandatory deployment of AI in administrative processes and service delivery; (2) capacity-building and formative support led by PCM/SGTD; (3) unspecified obligations of functional responsibility for public officials who fail to implement AI; (4) alignment with other digital government norms (e.g., conversion of procedures to digital platforms, electronic records, interoperability); and (5) an implicit expectation to accelerate digital transformation across jurisdictions. Missing but critical focus areas identified by observers are detailed risk management (including mandatory AI impact assessments), sector-specific guardrails (health, justice, social protection), transparency and notice to users, data protection and access rights, cybersecurity, procurement standards for AI systems, procurement of explainable systems, and testing/evaluation protocols before live deployments. Without these elements, mandatory adoption risks entrenching low-quality, biased, insecure or non-transparent systems in public administration.

Implementation Framework

The bill envisions PCM/SGTD offering technical and training assistance to every entity covered by Law No. 27444. An effective implementation framework would normally include: (a) phased adoption schedules tied to entity size and sector risk profiles; (b) mandatory pre-deployment assessments (data protection impact assessments, algorithmic impact assessments, risk classification); (c) procurement rules and vendor due diligence; (d) model testing, validation and third-party audits; (e) human oversight requirements and mechanisms for contestability of automated decisions; (f) standard documentation and registries of AI systems deployed in the public sector; and (g) capacity-building for public servants and accessible digital literacy resources for users. The bill itself is silent on detailed timelines, financing or detailed procurement modalities, implying that secondary regulations and internal entity plans would define the operational pathway. Stakeholders recommend a national AI adoption roadmap, with clear budgets and milestones overseen by PCM/SGTD in collaboration with sectoral regulators and APDP (civil society analysis).

Monitoring and Evaluation

Monitoring and evaluation (M&E) are not detailed in the draft, but would be essential. A robust M&E framework should include periodic reporting by entities to PCM/SGTD; public registries of deployed AI systems; performance and outcomes metrics (service times, accuracy, fairness indicators); audited compliance reports (privacy, security, explainability) and mechanisms for independent evaluations by oversight bodies (e.g., Contraloría General, APDP). Annual consolidated reports to Congress on AI adoption progress, risks identified and remedial measures would support democratic oversight and transparency. Existing obligations under Law No. 31814 that require reporting and SGTD oversight provide a partial legal basis for M&E, but specific indicators and audit protocols are necessary for meaningful assessment.

Penalties, Liability, and Appeals

Project 6927 refers to "functional responsibility" but lacks an explicit, graduated penalty scheme or liability allocation. Practical policy design should define (a) administrative and disciplinary sanctions for negligent non-compliance by public officials; (b) civil liability for harms caused by AI systems deployed by public entities; (c) criminal referral where unlawful conduct (e.g., gross negligence, data breaches with aggravated harm) is identified; and (d) administrative fines and remedial orders. The bill should also ensure accessible remedies and administrative appeal routes for affected citizens, including rights to explanation, correction, and judicial review of automated decisions that affect legal rights. Coordination with Peru's civil service disciplinary framework (SERVIR) and Contraloría procedures is necessary to define enforceable sanctions and due-process protections.

Relationship to Other Instruments

Project 6927 must be read alongside several existing instruments: Law No. 31814 (promotion of AI, enacted July 5, 2023), the Texto Único Ordenado of Law No. 27444 (procedural law), PCM digital directives (e.g., Directiva N.° 001-2021-PCM/SGD on digital conversion) and data protection rules enforced by the Autoridad Nacional de Protección de Datos Personales (APDP) under the Ministry of Justice. The bill's requirements overlap with the PCM's mandate under Law No. 31814; this raises questions about duplication vs. complementarity. For legal coherence, implementing regulations under Law No. 31814 and SGTD guidance should specify how mandatory adoption is sequenced, how sectoral exemptions or special procedures operate, and how conflicts between obligations are resolved. Public commentary urges harmonization to avoid creating contradictory obligations between promotional and mandatory regimes (Law No. 31814).

International Alignment

The bill does not explicitly reference international instruments, but Peru's broader AI regulatory evolution has been informed by international standards (European Union AI Act principles, OECD AI principles, UNESCO recommendations). Alignment opportunities include adopting risk-based classification for AI systems, transparency mandates for high-risk systems, mandatory impact assessments, and registering critical public-sector AI systems. International alignment would also facilitate procurement and certification standards, cross-border data flow protocols, and adoption of conformity assessment models consistent with global best practice. The PCM's drafting of regulation for Law No. 31814 has referred to international comparators; Project 6927 should be harmonized with these comparative frameworks to ensure interoperability and rights protection.

Implementation Timeline

Phase	Actions	Suggested Timing
Phase 0: Preparation	PCM/SGTD issues technical guidance, capacity mapping, budget allocations	0–6 months after enactment
Phase 1: Pilot	Selected low-risk pilots and procurement pilots; mandatory impact assessments	6–18 months
Phase 2: Progressive roll-out	Sectoral roll-out, high-risk safeguards, training programs	18–48 months
Phase 3: Consolidation	Audits, public registry, full reporting to Congress	48–60 months

Compliance Checklist

Requirement	Compliant (Y/N)
Register AI system with entity record	—
Perform AI impact assessment	—
Demonstrate data protection compliance (APDP)	—
Implement human oversight mechanisms	—
Undergo third-party validation/test	—

Sources and References

Source	Type
Congress communications: "Propuesta para crear el Fondo Nacional..." (mentions Project 6927/2023-CR)	Primary Source
Hiperderecho analysis: "¿Uso obligatorio de la Inteligencia Artificial en entidades públicas?"	Secondary analysis
Law No. 31814 (Peru) – official page	Primary Source