Uruguay AI Regulation Overview

Overview

Uruguay has developed an AI governance landscape grounded in multi-stakeholder strategic planning, international human rights frameworks, and integrated data protection oversight. Rather than enacting a single comprehensive AI statute, Uruguay's regulatory philosophy relies on delegating statutory authority to executive agencies to design national strategies while adhering to international legal standards. The primary domestic legal foundation is established by Law No. 20.212 Article 74, which entrusts the Agencia para el Desarrollo del Gobierno de Gestión Electrónica y la Sociedad de la Información y el Conocimiento (AGESIC) with formulating national AI and data strategies across both public and private sectors.

Alongside its domestic statutory mandates, Uruguay has positioned itself as an international leader in AI governance within Latin America. The nation adopted the Montevideo Declaration on Artificial Intelligence in October 2024 to establish a human-centric regional governance approach. Furthermore, in September 2025, Uruguay became the first Latin American state to sign the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225), committing its legal framework to human rights, democratic principles, and risk-based AI management.

Regulatory Approach

Uruguay favors a strategic, principle-based, and human-centric regulatory approach over rigid prescriptive rules. The country relies on soft-law roadmaps, policy strategies, and international treaties to guide AI lifecycle development across both the public and private sectors. Key principles underpinning this governance model include equity, non-discrimination, transparency, accountability, auditability, and respect for human dignity. Governance structures established by AGESIC promote active multi-stakeholder participation, utilizing dialogue tables (mesas de diálogo), consultative processes, and dedicated state observatories.

Through its signature of CETS No. 225, Uruguay aligns with a technology-neutral, risk- and lifecycle-based model. This international framework requires iterative risk assessments, procedural safeguards, and notice requirements across all stages of an AI system's lifecycle—from design and research to deployment and decommissioning. The approach allows flexibility for research while contemplating bans or moratoria for high-risk applications that threaten fundamental rights or democratic processes.

Key AI Legislation

• Law No. 20.212 Article 74 (2023): Statutory mandate assigning AGESIC the responsibility to design and execute a unified national strategy for data and artificial intelligence across public and private sectors, requiring joint action with URCDP for personal data handling.
• Decree No. 276/025 (2025): Executive decree regulating Articles 74 and 75 of Law No. 20.212 to operationalize the national AI and data strategies.
• Montevideo Declaration on Artificial Intelligence (2024): Regional decree and declaration adopting a regional approach to AI governance and establishing the Ethical AI Roadmap 2024-2025 for Latin America and the Caribbean.
• Council of Europe Framework Convention (CETS No. 225) (2024/2025): Multilateral binding treaty signed by Uruguay in September 2025 establishing lifecycle and risk-based human rights protections for AI systems.

Governance & Enforcement Bodies

The institutional architecture for AI governance in Uruguay is anchored by AGESIC, which oversees national AI strategy, policy development, and digital transformation initiatives. To fulfill its mandate under Law No. 20.212 Article 74, AGESIC created the Strategic Committee for the Public Sector on AI and Data (Comité Estratégico del Sector Público para la Inteligencia Artificial y Datos) and the State AI Observatory (Observatorio de Inteligencia Artificial en el Estado). These bodies coordinate inter-agency policy, conduct public consultation, and monitor public sector deployment of automated tools.

Data protection oversight in AI applications is shared with the Unidad Reguladora y de Control de Datos Personales (URCDP). Under Law No. 20.212 and data protection Law No. 18.331, AGESIC must act jointly with URCDP whenever an AI system processes personal data. URCDP maintains regulatory oversight to ensure processing operations comply with fundamental privacy rights and statutory data protection principles.

Penalties & Enforcement

The available legal records do not specify monetary fine amounts or specific statutory penal provisions directly created under Law No. 20.212 Article 74 or the Montevideo Declaration. Enforcement mechanisms for AI systems currently operate through general administrative oversight bodies and existing data protection law mechanisms overseen by URCDP.

Under the international framework established by CETS No. 225, participating states are required to maintain administrative and oversight arrangements that provide effective remedies, complaint handling procedures, and judicial review mechanisms for affected individuals when AI deployment materially impacts human rights or democratic guarantees.

Data Protection Framework

Uruguay's data protection architecture is governed by Law No. 18.331 and enforced by the URCDP. Under Article 74 of Law No. 20.212, any national AI strategy, public initiative, or private system involving the treatment of personal data must be designed and executed in joint coordination with URCDP to guarantee full compliance with established data protection norms.

The integration of URCDP into AI governance ensures that automated data processing respects privacy, individual autonomy, and security principles. AI development processes must maintain compatibilities with data stewardship, data provenance, and transparency standards articulated within national data strategy materials.

Sector-Specific Rules

The provided legal records contain no evidence of dedicated sector-specific legislation governing AI in domains such as healthcare, financial services, or autonomous transport. Sectoral implementation currently relies on broad national strategies that encompass both public administration and private enterprise.

Sector-specific initiatives are addressed at a policy level through priority areas outlined in the Montevideo Declaration's 2024-2025 Roadmap. These priority domains include AI talent and the future of work, environmental protection, protection of vulnerable groups, and digital infrastructure expansion.

International Alignment

Uruguay exhibits strong international alignment, positioning itself as a key Latin American partner in international AI governance initiatives. Its definitions of artificial intelligence systems draw upon technology-neutral, OECD-derived concepts as reflected in the Council of Europe Framework Convention CETS No. 225, which Uruguay signed on September 2, 2025 in Strasbourg.

Regionally, Uruguay hosted the Second Ministerial and High-Level Authorities Summit on the Ethics of AI in October 2024, producing the Montevideo Declaration supported by UNESCO and CAF. Uruguay active participates in regional digital platforms including eLAC and the GEALC Network, while sharing national AI policies on UNESCO's Global AI Ethics and Governance Observatory.

Future Developments

Future policy progression in Uruguay centers on executing the National AI Strategy 2024-2030 and National Data Strategy 2030, promulgated following AGESIC's regulatory recommendations submitted to Parliament. Executive Decree No. 276/025 provides the implementing foundation for these long-term strategic plans.

At the international level, ongoing developments include the formal domestic ratification process for CETS No. 225 following Uruguay's signature, alongside semi-annual monitoring reviews of the Montevideo Declaration's Roadmap and participation in annual Ministerial Summits on AI Ethics.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Agencia para el Desarrollo del Gobierno de Gestión Electrónica y la Sociedad de la Información y el Conocimiento (AGESIC)	Lead agency responsible for designing and developing national data and AI strategies for public and private sectors under Law No. 20.212 Article 74.	Strategy design, policy coordination, convening stakeholder dialogue tables, operating state observatories, and producing legislative recommendation reports.
Unidad Reguladora y de Control de Datos Personales (URCDP)	National personal data protection authority responsible for joint coordination on AI strategies involving personal data under Law No. 18.331 and Law No. 20.212.	Oversight of personal data processing, enforcing privacy compliance in AI systems, and defining data protection guidelines.
Comité Estratégico del Sector Público para la Inteligencia Artificial y Datos	Inter-institutional committee established by AGESIC to organize public sector AI implementation and policy governance.	Public sector AI policy coordination, monitoring strategy implementation, and developing evaluation indicators.