Peru AI Regulation Overview

Overview

Peru has developed a comprehensive legal and strategic framework for artificial intelligence governance, anchored by Law No. 31814 (promulgated in July 2023) and its implementing regulation, Supreme Decree No. 115-2025-PCM (published in September 2025). This horizontal governance model operates alongside foundational state modernization instruments, notably the National Policy for Digital Transformation to 2030 (approved via Supreme Decree No. 085-2023-PCM) and the Digital Government framework under Decree-Law No. 1412. Together, these instruments establish the administrative, technical, and normative standards governing automated decision-making and emerging technologies across public entities and private deployers nationwide.

The Peruvian regulatory philosophy balances proactive technological promotion with rights-based risk oversight. On one side, national policy emphasizes digital economic development, public service efficiency, and digital talent building. On the other side, the framework establishes strict safeguards against risks to fundamental human rights, personal data protection, and public safety. Sector-specific implementations—such as Law No. 32082 and Decree Supreme No. 015-2025-RE governing digital transformation in consular offices—demonstrate the practical integration of artificial intelligence and interoperable administrative platforms across state functions.

Regulatory Approach

Peru employs a hybrid regulatory approach that combines horizontal risk-based classification with targeted criminal law enforcement and sector-specific digitalization mandates. Under Supreme Decree No. 115-2025-PCM, artificial intelligence systems are categorized into three distinct risk tiers: prohibited uses (uso indebido), high-risk applications, and acceptable risk uses. Prohibited categories explicitly include deceptive manipulation, lethal autonomous weapons, unauthorized mass surveillance, sensitive attribute inference, and real-time public biometric identification without statutory exceptions.

The framework relies on binding regulations for public entities, AI developers, and system implementers. High-risk AI applications require mandatory pre-implementation impact assessments, formal security audits (incorporating national technical standards such as NTP-ISO/IEC 42001:2025), documented human oversight, data minimization, and audit record retention for at least three years. Concurrently, penal statutes—notably Law No. 32314—introduce strict criminal deterrence by classifying AI misuse as an aggravating factor in existing offenses, while non-binding policy documents like the National AI Strategy (ENIA) working paper provide long-term strategic guidance.

Key AI Legislation

Peru's artificial intelligence framework comprises primary statutes, executive decrees, and broad digital transformation policies:

• Law No. 31814 and Supreme Decree No. 115-2025-PCM: The core national law and implementing regulation establishing Peru's risk-based AI governance regime. The framework designates the SGTD/PCM as the national technical-normative authority, establishes prohibited and high-risk use categories, and creates supporting bodies such as the Centro Nacional de Innovación Digital e Inteligencia Artificial (CNIDIA) and Centro Nacional de Datos (CND).
• Law No. 32314: Amends the Peruvian Penal Code (Decreto Legislativo 635) and the Law on Computer Crimes (Law No. 30096) to establish the malicious use of artificial intelligence and analogous technologies as an aggravating circumstance, permitting custodial penalty increases of up to one-third above the statutory maximum for offenses including fraud, defamation, child sexual exploitation, and intellectual property violations.
• Law No. 32082 and Decree Supreme No. 015-2025-RE: Establishes the legal and operational framework for progressive digital transformation in Peruvian consular offices abroad, explicitly incorporating ethical artificial intelligence and mandating the deployment of the Platform of Digital Consular Services (PDSC).
• National Policy for Digital Transformation to 2030 (Supreme Decree No. 085-2023-PCM): Sets six national priority objectives to guide public and private digital transformation, emphasizing inclusive connectivity, digital government, talent development, cybersecurity, and ethical adoption of emerging technologies.
• Decree-Law No. 1412 (Ley de Gobierno Digital): The foundational legislative framework governing digital identity (ID Gob.pe), state interoperability (PIDE), cybersecurity management systems, and public sector data governance across all levels of government.

Governance & Enforcement Bodies

The Presidency of the Council of Ministers (PCM), acting through the Secretariat of Government and Digital Transformation (SGTD), serves as the national rector and normative authority for artificial intelligence, digital government, and digital transformation in Peru. The SGTD is empowered to formulate technical lineaments and ethical guidelines, monitor compliance for high-risk and prohibited AI systems, coordinate national platforms, and order administrative remedies for noncompliance. Institutional execution within individual public entities is managed by internal Committees for Government and Digital Transformation (CGTD), supported by designated Officers for Digital Security and Data Governance Officers.

Enforcement and oversight responsibilities are distributed across sector-specific and specialized authorities. The Autoridad Nacional de Protección de Datos Personales (ANPD), operating within the Ministry of Justice and Human Rights (MINJUSDH), maintains primary jurisdiction over personal data protection and privacy compliance in AI data processing. For criminal violations involving AI tools, investigative and prosecutorial authority rests with the Public Prosecutor's Office (Ministerio Público), the National Police of Peru (PNP), and the Judiciary (Poder Judicial). Sectoral bodies, including the Ministry of Foreign Affairs (MRE) and the Ministry of Education (MINEDU), manage domain-specific regulatory execution.

Penalties & Enforcement

Administrative enforcement under Supreme Decree No. 115-2025-PCM enables the SGTD and sector regulators to issue administrative orders, corrective measures, and operational suspensions for non-compliant AI systems. In instances where AI processing infringes upon individual privacy rights, the ANPD exercises statutory sanctioning power pursuant to Law No. 29733. Public officials who fail to adhere to administrative AI guidelines or digital government mandates under Decree-Law No. 1412 remain subject to administrative disciplinary proceedings under standard civil service rules.

Criminal enforcement was substantially heightened following the enactment of Law No. 32314, which modified the Penal Code and the Law on Computer Crimes (Law No. 30096). The statute treats the use of artificial intelligence, synthetic voice/image generation (deepfakes), or automated algorithmic manipulation as an express aggravating circumstance. Where an underlying crime—such as fraud (estafa), defamation, copyright infringement, or child sexual exploitation—is committed using AI tools, trial judges are authorized to increase custodial sentences by up to one-third above the legal maximum penalty established for the base offense.

Data Protection Framework

Peru's artificial intelligence framework is inextricably linked to its personal data protection regime, established under Law No. 29733 and overseen by the ANPD. Supreme Decree No. 115-2025-PCM mandates that all AI design, training, and operational deployment strictly observe fundamental principles of data protection, including data minimization, purpose limitation, explicit consent, and privacy-by-design. Deployers processing personal data must ensure that algorithmic operations comply with national privacy standards and avoid unauthorized profiling or inference of sensitive attributes.

For high-risk AI deployments, entities are required to perform comprehensive pre-implementation impact assessments that evaluate privacy risks and data governance controls. Sectoral instruments, such as Decree Supreme No. 015-2025-RE for consular services and educational initiatives like Project 10717/2024, emphasize heightened protection for sensitive datasets, biometric identifiers, and student records. Furthermore, Decree-Law No. 1412 categorizes state-held data as a strategic national asset, establishing formal data governance roles (Data Governance Officers) to ensure security, quality, and lawful handling.

Sector-Specific Rules

In the foreign affairs sector, Law No. 32082 and Decree Supreme No. 015-2025-RE establish a detailed operational regime for digital transformation across Peruvian consulates. The regulation governs the progressive deployment of the Platform of Digital Consular Services (PDSC) over a five-year horizon, requiring the integration of artificial intelligence for user service delivery alongside strict cybersecurity protocols, operational continuity planning, and interoperability with national registries such as RENIEC and Migraciones.

In education and general public administration, legislative initiatives and existing digital government rules dictate technology adoption. Legislative proposals such as Project 10717/2024 and Project 7659/2023 mandate the inclusion of AI pedagogy, computational thinking, and robotics within the primary and secondary education curriculum (Educación Básica Regular) under MINEDU oversight. Across public administration, Decree-Law No. 1412 and proposed measures like Project 6927/2023 structure the compulsory integration of AI into public service workflows, requiring compliance with the State Interoperability Platform (PIDE) and national digital security models.

International Alignment

Peru's AI regulatory design incorporates international risk management frameworks and normative standards. Supreme Decree No. 115-2025-PCM explicitly adopts technical standards established by international standardization bodies, referencing national management systems such as NTP-ISO/IEC 42001:2025 for AI management. Furthermore, the decree's classification of prohibited and high-risk AI applications reflects regulatory concepts aligned with international models such as the European Union AI Act, while policy instruments like the ENIA working draft draw upon OECD AI Principles and UNESCO recommendations on the ethics of artificial intelligence.

The Peruvian state actively emphasizes cross-border interoperability and international cooperation in its digital agendas. Consular digitalization under Law No. 32082 incorporates international standards for secure data exchange and administrative cooperation. Similarly, amendments to Decree-Law No. 1412 (via Supreme Decree No. 098-2025-PCM) reinforce international cross-border digital identity interoperability and electronic signature recognition to align Peru's digital infrastructure with international trade and administrative standards.

Future Developments

Several legislative proposals remain under active deliberation within the Peruvian Congress, signaling ongoing refinement of the national AI landscape. Key pending initiatives include Project 7033/2023 (proposing a horizontal AI law with pre-market conformity assessments and a national high-risk AI registry), Project 8223/2023 (promoting AI adoption while establishing a national technical center for high-performance computing), and Project 6524/2023 (mandating digital labeling / etiquetado digital to ensure user notice for synthetic media and deepfakes).

Implementation milestones established by existing executive decrees will further shape practical compliance. Supreme Decree No. 115-2025-PCM establishes phased compliance schedules across public sector entities beginning in late 2026, alongside mandatory timelines for publishing sectoral technical lineaments. Additionally, executive rulemaking required under Law No. 32314 to operationalize digital evidence preservation for AI criminal aggravating factors, together with the progressive five-year rollout of the PDSC consular platform under Decree Supreme No. 015-2025-RE, will define operational regulatory enforcement.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Secretariat of Government and Digital Transformation (SGTD / PCM)	National technical-normative authority for artificial intelligence governance, digital government, and national digital transformation.	Issues technical lineaments and ethical standards, conducts preventive monitoring, supervises high-risk and prohibited AI deployments, orders administrative remedies, and manages national platforms (CNIDIA, CND).
Autoridad Nacional de Protección de Datos Personales (ANPD / MINJUSDH)	National supervisory authority for personal data protection under the Ministry of Justice and Human Rights.	Enforces Law No. 29733 compliance, conducts privacy audits, investigates processing infractions involving AI systems, and imposes administrative fines and sanctions.
Ministry of Foreign Affairs (Ministerio de Relaciones Exteriores - MRE)	Implementing authority for digital transformation and service modernization across Peruvian consular offices under Law No. 32082.	Oversees the Platform of Digital Consular Services (PDSC), enforces internal cybersecurity and trust guidelines, and directs consular AI deployment.
Public Prosecutor's Office (Ministerio Público) & Judiciary (Poder Judicial)	Judicial and prosecutorial bodies responsible for criminal investigation, prosecution, and adjudication.	Investigate criminal offenses, apply statutory sentence enhancements for AI-assisted crimes under Law No. 32314, evaluate digital forensic evidence, and issue judicial sanctions.