Peru - AI Regulation Implementation (115-2025)

Overview

The Regulation approved by Supreme Decree No. 115-2025-PCM (published 9 September 2025) implements Law No. 31814 and establishes a national framework to promote, coordinate and supervise the development and use of artificial intelligence in Peru. It is structured into six Titles and thirty‑six Articles with six Complementary Final Provisions. The SGTD (Secretariat of Government and Digital Transformation) of the Presidency of the Council of Ministers is designated as the national technical‑normative authority with competence to produce implementing rules, lineaments and protocols. The text balances a strong innovation agenda (national strategy, sandboxes, CNIDIA and public cloud resources) with a rights‑based, risk‑based regulatory approach that defines prohibited uses, high‑risk use categories and obligations for public entities and private developers. The full official publication is available in the Diary of the Nation; see Supreme Decree No. 115-2025-PCM (El Peruano publication) and the PCM information page summarizing the decree in the national regulation repository (SGTD / PCM).

Definitions

The Regulation supplements Law 31814 with operational definitions used throughout the instrument. Key definitions include: 'AI' (discipline oriented to research and development of systems based on AI), 'algorithm', 'developer', 'implementer', 'user', 'high‑risk use', 'unauthorized use / uso indebido' (prohibited use), 'center and national platforms' (e.g., Centro Nacional de Datos — CND; Centro Nacional de Innovación Digital e Inteligencia Artificial — CNIDIA), and acronyms for governance bodies (CGTD for entity committees). The language clarifies that definitions in the Regulation complement – not replace – definitions in Law 31814 and other applicable legal instruments. These foundational definitions determine the scope of obligations, supervision and exceptions (for personal use, defense and national security under specific principles).

Governance and Institutional Framework

The Regulation places primary authority with the Presidency of the Council of Ministers via the SGTD as the national technical‑normative authority for AI. SGTD is empowered to approve lineaments, standards and protocols, coordinate the System of National Digital Transformation and monitor uses considered of misuse or high risk. The Regulation creates and articulates several specialized nodes and mechanisms: the Centro Nacional de Innovación Digital e Inteligencia Artificial (CNIDIA) for R&D and public initiatives; the Centro Nacional de Datos (CND) for data governance and high‑value data publication; Committees of Government and Digital Transformation (CGTD) in each public entity to govern public AI projects; and specialized roles such as Offic ers for Digital Security, Personal Data and Data Governance. Several ministries are explicitly involved (Ministry of Education, Ministry of Production, Ministry of Justice and Human Rights through the Autoridad Nacional de Protección de Datos Personales). This multi‑actor model is explained in the official text and aligned with the PCM's digital transformation plans (SGTD / PCM) and the official publication of the Regulation (El Peruano).

Key Focus Areas

The Regulation organizes substantive obligations across four thematic pillars: (1) Risk management and prohibited uses: a clear tripartite classification (prohibited use / uso indebido; high‑risk; acceptable risk) and concrete prohibited cases (deceptive manipulation, lethal autonomous systems, mass surveillance without legal basis, sensitive attribute inference and real‑time biometric identification in public spaces with limited exceptions); (2) Transparency and explainability: mandatory algorithmic transparency for high‑risk systems, visible labelling of AI‑generated content where relevant, and mechanisms to explain decisions that affect rights; (3) Privacy and data governance: stringent alignment with Peru’s data protection regime (Law No. 29733) and the ANPDP’s authority, privacy‑by‑design, data minimization and retention limitations; and (4) Security, audit and lifecycle controls: mandatory security audits before deployment and continuous security testing, incident management, and adoption of internationally recognized technical standards (including reference to NTP‑ISO/IEC 42001:2025). The Regulation also promotes open science, sandboxes and public‑funded open code publication to support innovation and reproducibility.

Implementation Framework

Implementation is both centralized and distributed. Centralized responsibilities rest with SGTD: issuance of technical lineaments, coordination with INACAL for national standard adoption, publication of platforms and oversight of prohibited and high‑risk uses. Distributed responsibilities land with public entities and private developers: public institutions must approve institutional AI policies, include AI projects in their Plan of Government Digitalization, use the NTP‑ISO/IEC 42001:2025 management system for AI where applicable, and establish multidisciplinary teams. Private developers and implementers must document operation principles for high‑risk systems, perform impact analyses, implement human oversight, and keep documentation available for at least three years. The Regulation requires security audits prior to deployment of public AI systems and periodic audits during operations. SGTD will publish complementary protocols, and the first CGTD and entity implementation deadlines are set in the final provisions.

Monitoring and Evaluation

Monitoring is led by the SGTD with the power to design surveillance mechanisms for misuse and high‑risk systems. The Regulation mandates that SGTD, in coordination with sectoral authorities, monitors compliance and issues guidelines on algorithmic transparency and impact assessments. Public entities must create CGTDs that report and evaluate AI projects; CNIDIA and CND act as technical support centers that can host sandboxes and curated datasets. Evaluation metrics will include compliance with transparency, audit results, incident reports, bias detection findings and documented mitigation measures. Where sectoral regulators (e.g., health, education, financial supervisors) have competence, they will apply their enforcement regimes in coordination with SGTD to avoid double sanctioning.

Penalties, Liability, and Appeals

The Regulation does not create a wholly new monetary sanctioning regime; instead it relies on applicable existing sanction mechanisms: data protection breaches are subject to Law No. 29733's sanctioning regime enforced by the Autoridad Nacional de Protección de Datos Personales (ANPDP); sectoral breaches fall under the corresponding sector regulator (e.g., health, education, financial authorities); and administrative, civil and criminal liabilities continue to apply according to current legislation. The Regulation requires maintainable documentation and impact assessments to be produced on request and establishes that noncompliance may trigger administrative measures, orders to suspend or change AI operations, civil liability for damages and, where applicable, criminal investigation. The procedural and appeal routes follow existing administrative and judicial procedures under Peruvian law; specifics will be determined by SGTD and sectoral authorities through supplementary rules.

Relationship to Other Instruments

The Regulation explicitly references and operates alongside several existing instruments: Law No. 31814 (parent law), Law No. 29733 (Personal Data Protection), the Law of Government Digital and related legislative instruments (e.g., Decreto Legislativo N° 1412), and national technical standards (INACAL). It derogates the obsolete Resolution Ministerial N° 246-2007-PCM regarding the mandatory use of NTP‑ISO/IEC 17799:2007. The Regulation instructs SGTD to coordinate with sectoral regulators and to issue complementary lineaments consistent with the broader Digital Transformation agenda; the Regulation also instructs publication of the National AI Strategy (ENIA) and the National Data Governance Strategy as part of the SNTD framework.

International Alignment

The Regulation references and aligns with international best practices and standards: it cites OECD and other international principles on human‑centered AI, adopts risk‑based reasoning similar to the EU AI Act (classification of prohibited and high‑risk uses), requires adoption of the ISO AI management standard (NTP‑ISO/IEC 42001:2025) and promotes conformity with international technical standards issued by INACAL and international standardization bodies. The text seeks interoperability with global norms while tailoring obligations to Peru’s administrative architecture and constitutional protections of rights. This international alignment is intended to facilitate trade, cooperation and research in AI while safeguarding human rights and local public interests.

Implementation Timeline

Publication in Official Gazette (El Peruano): 09/09/2025. Immediate entry into force for Complementary Provisions I, II, IV and V: 10/09/2025. General entry into force (90 business days after publication): 22/01/2026. Public sector phased deadlines (certain obligations for Executive, Legislative and Judicial branches): within 1 year of publication (09/09/2026). Progressive implementation for private sector, MYPES and sectoral rollouts: phased over up to 4 years as established in final provisions and complementary lineaments.

Sources and References

Source	Type
D.S. No. 115-2025-PCM — Publication in El Peruano (Decree and Regulation)	Primary Source
Law No. 31814 — Congressional record (Gob.pe)	Primary Source
SGTD / Presidency of the Council of Ministers (PCM) — Transformación Digital	Primary Source