Central and South America - AI Regulation Overview

Overview

As of September 19, 2026, artificial intelligence governance across Central and South America is undergoing a structural transition. The region is moving from early foundational policy white papers, non-binding soft-law guidelines, and national digital agendas toward binding, risk-tiered statutory regimes, specialized administrative circulars, and penal code sanctions. While Latin American nations previously addressed AI through general digital transformation strategies and personal data protection mandates, the current landscape features formal risk classification models, algorithmic impact assessment requirements, mandatory judicial and public sector registries, and heightened criminal penalties for AI misuse.

The region exhibits a multi-speed regulatory trajectory. Certain jurisdictions have enacted and operationalized binding, horizontal statutory frameworks. Most notably, Peru has established a binding horizontal AI regulatory regime under Supreme Decree No. 115-2025-PCM — Regulation of Law No. 31814 (Reglamento de la Ley N° 31814) (in force since January 22, 2026), alongside strict penal code reforms. Other major economies, such as Brazil and Chile, operate under hybrid architectures: they enforce immediate, binding rules in specific sectors and state branches—such as Brazil's judicial framework under Resolução CNJ nº 615/2025 (CNJ Resolution establishing guidelines for development, use and governance of AI solutions in the Judiciary) (in force since July 14, 2025)—while comprehensive statutory acts continue through their national legislatures.

Across Central and South America, regulatory design heavily reflects international benchmarks, specifically borrowing four-tier risk taxonomies from the European Union AI Act and human rights safeguards from international treaties. At the same time, regional governance is strongly grounded in existing domestic personal data protection statutes, cybersecurity infrastructure laws, and executive science and technology agencies. This results in a regulatory environment that balances technological innovation and sovereign compute infrastructure with rigorous rights-based oversight.

Key Trends and Focus Areas

AI regulation across Central and South American jurisdictions highlights several prominent themes, structural tools, and policy priorities:

• Horizontal Risk-Based Taxonomies: Legislative bodies and executive ministries are increasingly structuring AI regulations around risk classification models (prohibited/unacceptable, high, limited, and low/acceptable risk). High-risk deployments trigger pre-implementation Algorithmic Impact Assessments (AIAs), continuous lifecycle logging, human oversight duties, and technical auditing. In Peru, Supreme Decree No. 115-2025-PCM — Regulation of Law No. 31814 (Reglamento de la Ley N° 31814) explicitly bans deceptive algorithmic manipulation, lethal autonomous weapons, mass surveillance, and unconstrained real-time biometric identification in public spaces, while subjecting high-risk systems to mandatory impact evaluations and technical standards. Similarly, Brazil's omnibus bill Projeto de Lei nº 2.338/2023 (Marco Legal da Inteligencia Artificial — Draft national AI regulatory framework) and Chile's Proyecto de Ley que regula los Sistemas de Inteligencia Artificial (Government bill to regulate AI systems) propose explicit risk tiers, mandatory impact assessments, and public registries for high-risk tools.
• Judicial and Sectoral Leadership: Judicial authorities and specialized administrative bodies have established binding rules ahead of broader national parliaments. In Brazil, the National Council of Justice issued Resolução CNJ nº 615/2025 (CNJ Resolution establishing guidelines for development, use and governance of AI solutions in the Judiciary) and Portaria CNJ nº 270/2025 (in force since September 3, 2025), creating strict risk classifications, mandatory registration on the Sinapses platform, and the Comitê Nacional de Inteligencia Artificial do Judiciário. In Argentina, sub-national governments and public prosecution services have enacted binding administrative protocols, including Decreto 2726/2025 – Protocolo para la Adopción y Uso de Tecnologías de Inteligencia Artificial Generativa en la Administración Pública (Provincia de Santa Fe) (in force since November 3, 2025), Resolución 4/2025 – Directrices de uso de Inteligencia Artificial Generativa en la Administración Pública (Provincia de Buenos Aires, Subsecretaría de Gobierno Digital) (in force since February 10, 2025), and Resolución 1486/2025 – Implementación de un Asistente Virtual con Inteligencia Artificial en el Portal de Gestión de Causas (Poder Judicial de la Nación / Consejo de la Magistratura) (in force since May 27, 2025). In Ecuador, the market regulator adopted the Código de Ética para el Uso de la Inteligencia Artificial de la Superintendencia de Competencia Económica (in force since June 16, 2025) to bind administrative support tools.
• Criminalization of Deepfakes and Algorithmic Misuse: National legislatures are using criminal law to deter malicious AI uses, synthetic media manipulation, deepfakes, and non-consensual intimate content generation. Peru enacted Ley N° 32314 — Modificación del Código Penal y de la Ley de Delitos Informáticos para incluir el uso de la Inteligencia Artificial como circunstancia agravante (in force since April 29, 2025), which increases custodial penalties by up to one-third for crimes committed using AI tools. Chilean lawmakers are reviewing penal bills including Proyecto de Ley (Boletín 15935-07) — Modifica el Código Penal para sancionar el mal uso de la inteligencia artificial, Proyecto de Ley (Boletín 16021-07) — AI-use aggravating circumstance, and Proyecto de Ley (Boletín 16112-07) — Modifica el Código Penal en lo relativo al delito de usurpación de identidad en contexto de uso de IA. In Mexico, federal lawmakers are evaluating targeted penal reforms such as Iniciativa que adiciona el artículo 199 Octies al Código Penal Federal para sancionar la creación de contenido íntimo sexual con IA sin consentimiento and Iniciativa que reforma diversas disposiciones del Código Penal Federal y de la Ley Federal del Derecho de Autor en materia de IA generativa.
• Digital Sovereignty and National AI Infrastructure: Governments are pairing regulatory oversight with initiatives to build domestic compute infrastructure, sovereign language models, and centralized state laboratories. Mexico established the Laboratorio Nacional de Inteligencia Artificial (LNIA) — programa anunciado en el marco del Plan México in 2025 to develop sovereign public-interest models and centralize compute infrastructure, operating alongside executive policy coordination under Decreto por el que se crea la Comisión Intersecretarial de Tecnologías de la Información y Comunicación y de la Seguridad de la Información (CITICSI) (in force since January 11, 2023). Brazil instituted executive steering mechanisms via Decreto nº 12.308/2024 (Decree instituting the Interministerial Committee for Digital Transformation / Comitê Interministerial para a Transformação Digital) (in force since December 12, 2024), Resolução CITDIGITAL nº 1/2025 (in force since May 12, 2025), Resolução CITDIGITAL nº 2/2025 (in force since May 12, 2025), and Portaria nº 8/2025 (in force since July 23, 2025) to manage the Brazilian Plan for Artificial Intelligence (PBIA).
• Cybersecurity and Critical Infrastructure Alignment: Digital safety regulations are increasingly requiring operators of vital digital infrastructure to audit automated decision systems and report security incidents. Chile strengthened its technical defenses through Ley N° 21.663 — Ley Marco de Ciberseguridad (Framework Law on Cybersecurity and Critical Information Infrastructure) (in force since April 8, 2024), supported by Decreto Supremo N° 285 (Reglamento) — Procedimiento de calificación de Operadores de Importancia Vital en el marco de la Ley Marco de Ciberseguridad (Law 21.663) (in force since March 13, 2025) and Instrucción General N°1 (Agencia Nacional de Ciberseguridad, ANCI) — Inscripción de prestadores de servicios esenciales en la Plataforma de Reporte de Incidentes (in force since June 11, 2025), while updating its overarching roadmap under Decreto (No. 12) Aprueba actualización de la Política Nacional de Inteligencia Artificial (in force since January 28, 2025).

Regulatory Status

The regulatory state across Central and South America can be categorized into three distinct operational tiers: binding statutory and administrative frameworks currently in force, formal legislative proposals under active review, and executive soft-law policies.

1. Enacted and Binding Regimes (In Force):

• Peru: Leads the region in binding statutory execution through Supreme Decree No. 115-2025-PCM — Regulation of Law No. 31814 (Reglamento de la Ley N° 31814) (in force since January 22, 2026), Ley N° 32314 — Modificación del Código Penal y de la Ley de Delitos Informáticos para incluir el uso de la Inteligencia Artificial como circunstancia agravante (in force since April 29, 2025), Ley N° 32082 — Ley que establece la implementación progresiva de la Transformación Digital en las Oficinas Consulares Peruanas and its implementing Decree Supreme No. 015-2025-RE (in force since June 7, 2025), anchored by the administrative baseline of Decreto Legislativo No. 1412 — Ley de Gobierno Digital.
• Brazil: Combines judicial binding governance under Resolução CNJ nº 615/2025 and Portaria CNJ nº 270/2025 with executive coordination under Decreto nº 12.308/2024, Resolução CITDIGITAL nº 1/2025, Resolução CITDIGITAL nº 2/2025, and Portaria nº 8/2025, alongside smart city security deployments such as the Programa Smart Sampa - São Paulo AI Surveillance and Smart City Program.
• Chile: Operates binding cybersecurity and critical infrastructure controls under Ley N° 21.663 — Ley Marco de Ciberseguridad, Decreto Supremo N° 285, and Instrucción General N°1 (Agencia Nacional de Ciberseguridad, ANCI), underpinned by executive policy via Decreto (No. 12) Aprueba actualización de la Política Nacional de Inteligencia Artificial.
• Uruguay: Operates under statutory mandates establishing data and AI strategies via Ley N° 20.212 Artículo 74 - Mandato de Estrategia de IA y Datos (in force since November 6, 2023) and regional ethical principles under the Declaración de Montevideo sobre Inteligencia Artificial, while having signed the international treaty Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225).
• Argentina: Enforces domain-specific and sub-national administrative binding protocols, including Decreto 2726/2025 (Santa Fe), Resolución 4/2025 (Buenos Aires), Resolución 1486/2025, Resolución 710/2024 — Creación de la Unidad de Inteligencia Artificial Aplicada a la Seguridad (UIAAS) (in force since July 29, 2024), and Decisión Administrativa 750/2023 – Mesa Interministerial sobre Inteligencia Artificial.
• Panama, Ecuador, Costa Rica, and Mexico: Enforce binding sectoral policies and administrative structures, including Panama's Plan Estratégico Nacional de Ciencia, Tecnología e Innovación (PENCYT) 2025-2029 (in force since January 1, 2025) and Ley 144 de 15 de abril de 2020...; Ecuador's Estrategia Nacional de Inteligencia Artificial (ENIA) (in force since January 19, 2026) and Código de Ética para el Uso de la Inteligencia Artificial de la Superintendencia de Competencia Económica (in force since June 16, 2025); Costa Rica's Estrategia Nacional de Inteligencia Artificial (ENIA) 2024-2027; and Mexico's executive interministerial decree Decreto por el que se crea la Comisión Intersecretarial de Tecnologías de la Información y Comunicación y de la Seguridad de la Información (CITICSI).

2. Pending Statutory Legislation (Under Review):

• Brazil: Projeto de Lei nº 2.338/2023 (Marco Legal da Inteligencia Artificial — Draft national AI regulatory framework) passed the Senate in late 2024 and remains under review before a Special Committee in the Chamber of Deputies.
• Chile: Proyecto de Ley que regula los Sistemas de Inteligencia Artificial (Government bill to regulate AI systems) and consolidated parliamentary proposals including Proyecto de Ley (Boletín 15869-19) and human rights limitation bill Proyecto de Ley (Boletín 17112-19) remain under Senate review.
• Colombia: Active review continues for Proyecto de Ley Estatutaria No.154 de 2024: Por la cual se define y regula la Inteligencia Artificial, while general statutory drafts like Por medio de la cual se regula la inteligencia artificial en Colombia para garantizar su desarrollo ético y responsable (Government bill, Senate 442/25) and Proyecto 05/24: Ley de inteligencia artificial ética y sostenible para el bienestar social remain stalled.
• Costa Rica: Ley para la Regulación de la Inteligencia Artificial en Costa Rica (Bill No. 23.771) remains under review in the Legislative Assembly following a positive committee report.
• Ecuador: The National Assembly is reviewing consolidated statutory proposals, including the Proyecto de Ley Orgánica para la Regulación y Promoción de la Inteligencia Artificial and the Proyecto de Ley de Regulación de la IA y Protección de Datos.
• Mexico: Federal lawmakers are evaluating horizontal and sectoral bills, including Iniciativa para reformar la fracción XVII del artículo 73 de la Constitución en materia de Inteligencia Artificial, Iniciativas legislativas federales de inteligencia artificial y propuesta de comisión del Senado (2023–2025), and Proyecto de decreto que regula tecnologías emergentes, disruptivas e inteligencia artificial.
• Panama and Argentina: Parliamentary review continues for Panama's Draft Bill No. 14 on Artificial Intelligence Regulation and Argentina's Expediente 3900-D-2024 – Creación del Observatorio Federal sobre Inteligencia Artificial and Expediente 3003-D-2024 – Régimen jurídico aplicable para el uso responsable de la Inteligencia Artificial.

Notable Differences

While Central and South American nations share common goals regarding human rights protections and digital modernization, significant national differences exist across regulatory structures, legislative velocity, and institutional strategies:

Statutory Codification vs. Policy Roadmaps: Peru stands out as the primary regional example of comprehensive statutory codification, having fully implemented its framework via Supreme Decree No. 115-2025-PCM — Regulation of Law No. 31814 (Reglamento de la Ley N° 31814) and criminal code reforms under Ley N° 32314. In contrast, Colombia relies heavily on executive policy roadmaps such as Política Nacional de Inteligencia Artificial (CONPES 4144 - National Policy for Artificial Intelligence) (adopted February 14, 2025), Estrategia Nacional Digital 2023-2026, and MinCiencias's Hoja de Ruta para la adopción ética y sostenible de la Inteligencia Artificial (MinCiencias), as statutory bills (such as Senate Bill 442/25) have stalled in Congress.

Judicial-Led Oversight vs. Executive Centralization: Brazil and Argentina demonstrate a distinct reliance on judicial self-regulation and sub-national administrative mandates. Brazil’s judiciary, supervised by the Conselho Nacional de Justiça under Resolução CNJ nº 615/2025, maintains an independent mandatory AI registry (Sinapses) and risk assessment framework separate from the executive branch. Similarly, Argentina relies on sub-national executive protocols—such as Santa Fe's Decreto 2726/2025 and Buenos Aires Province's Resolución 4/2025—and specialized administrative units like Resolución 710/2024 — Creación de la Unidad de Inteligencia Artificial Aplicada a la Seguridad (UIAAS). Conversely, countries like Mexico, Panama, and Costa Rica utilize centralized executive policy models directed by presidency-level digital transformation authorities, as seen in Mexico's Decreto por el que se crea la Comisión Intersecretarial de Tecnologías de la Información y Comunicación y de la Seguridad de la Información (CITICSI), Panama's Plan Estratégico Nacional de Ciencia, Tecnología e Innovación (PENCYT) 2025-2029, and Costa Rica's Estrategia Nacional de Inteligencia Artificial (ENIA) 2024-2027.

International Multilateral Commitments: Uruguay has taken a distinct path by emphasizing international treaty alignment and regional leadership. It became the first Latin American country to sign the binding multilateral Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225), committing its domestic legal order to technology-neutral, risk- and lifecycle-based human rights standards. Regionally, Uruguay hosted and led the approval of the Declaración de Montevideo sobre Inteligencia Artificial, contrasting with larger economies that prioritize domestic industrial strategies and sovereign compute capabilities.

Regional Outlook

The trajectory of artificial intelligence regulation across Central and South America points toward accelerated statutory codification, expanding administrative enforcement, and increased regional alignment through late 2026 and into 2027. As omnibus legislative proposals move through parliamentary committees—notably Brazil's Projeto de Lei nº 2.338/2023, Chile's Proyecto de Ley que regula los Sistemas de Inteligencia Artificial, Costa Rica's Ley para la Regulación de la Inteligencia Artificial en Costa Rica, and Ecuador's Proyecto de Ley Orgánica para la Regulación y Promoción de la Inteligencia Artificial—the region is moving toward a standard regulatory framework. This model combines EU-style risk classification with explicit penal sanctions for malicious AI deployments.

Over the coming years, regulatory focus will likely shift from policy formulation to operational enforcement and oversight capacity. Supervisory agencies—such as Brazil's Autoridade Nacional de Proteção de Dados (ANPD), Peru's Secretariat of Government and Digital Transformation (SGTD/PCM), Chile's Agencia Nacional de Ciberseguridad (ANCI) under Instrucción General N°1 (Agencia Nacional de Ciberseguridad, ANCI), and Ecuador's Superintendencia de Protección de Datos Personales—will face the task of managing AI registries, auditing complex high-risk models, and maintaining regulatory sandboxes. The primary challenge for the region will be building technical capacity to enforce these binding rules without fragmenting the Latin American digital market or restricting technological innovation.