Skip to content
AI Policy Generator

ESWhat applies

Peru · Law

Peru's Artificial Intelligence Law and its regulation

In forceLaw 31814 and SD 115-2025-PCM

Summary

The region's first AI law with an implementing regulation in force. It bans certain uses, defines high-risk uses and requires companies to have an internal policy, training, transparency, records and human oversight depending on risk, with deadlines phased by sector and size.

Who it applies to

Public bodies, state-owned companies and private organizations that develop or use AI in Peru. It does not cover personal use or national defense and security.

Penalties

The regulation has no penalties of its own. Breaches can lead to penalties from the data protection authority, INDECOPI or other authorities, and to reports to the Comptroller for public officials.

Official name
Ley N.° 31814, Ley que promueve el uso de la inteligencia artificial en favor del desarrollo económico y social del país, y su Reglamento aprobado por Decreto Supremo N.° 115-2025-PCM
Official reference
Ley 31814, El Peruano, 5 de julio de 2023; DS 115-2025-PCM, El Peruano, 9 de septiembre de 2025
Regulator
Presidency of the Council of Ministers, Secretariat of Government and Digital Transformation
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Do not use AI for prohibited purposesDS 115-2025-PCM, art. 23In forceJanuary 22, 2026Any organization in Peru that develops or uses AI, from the date the regulation took effect.Verified in the official source on November 2, 2026
Check each AI use against the risk categoriesDS 115-2025-PCM, arts. 22 a 24In forceJanuary 22, 2026Any organization in Peru that develops or uses AI. It is not a standalone duty: it is the first step to know which obligations apply.Verified in the official source on November 2, 2026
Keep a record for each high-risk AI systemDS 115-2025-PCM, art. 31.1In forceSeptember 10, 2026Private companies that develop or use high-risk AI (employment, credit, healthcare, education, social programs, biometrics). The deadline depends on sector and size.Verified in the official source on November 2, 2026
Adopt an internal AI policyDS 115-2025-PCM, art. 31.2In forceSeptember 10, 2026Private companies in Peru that develop or use AI. The deadline depends on sector and size.Verified in the official source on November 2, 2026
Train staff on AI risks and responsible useDS 115-2025-PCM, art. 31.3In forceSeptember 10, 2026Private companies in Peru that develop or use AI. The deadline depends on sector and size.Verified in the official source on November 2, 2026
Tell people before using high-risk AIDS 115-2025-PCM, art. 25.1 y 25.2In forceSeptember 10, 2026Companies that develop or use high-risk AI that affects people. The deadline depends on sector and size.Verified in the official source on November 2, 2026
Explain AI decisions that affect people's rightsDS 115-2025-PCM, art. 25.3In forceSeptember 10, 2026Companies whose high-risk AI systems make or support decisions that affect people's rights. The deadline depends on sector and size.Verified in the official source on November 2, 2026
Ensure human oversight that can stop or correct the AIDS 115-2025-PCM, art. 31.4In forceSeptember 10, 2026High-risk AI systems in healthcare, education, justice, finance or access to essential programs. The deadline follows the company's sector: healthcare, education and finance passed on Sep 10, 2026; a company in another sector running a system for access to social programs has a later deadline.Verified in the official source on November 2, 2026
Voluntary impact assessment for high-risk AIDS 115-2025-PCM, art. 32Regulator guidanceJanuary 22, 2026Private companies with high-risk AI. It is voluntary; if the organization carries it out, the rule expects it to be documented and kept.Verified in the official source on November 2, 2026
Obligations for public bodies that use AIDS 115-2025-PCM, arts. 28 a 30In forceSeptember 10, 2026Public bodies and state-owned companies. Executive, Legislative, Judicial branches and autonomous bodies: Sep 10, 2026; EsSalud, regional governments, public universities and public companies: Sep 10, 2027; local governments types A to C: Sep 10, 2028.Verified in the official source on November 2, 2026

Do not use AI for prohibited purposes

DS 115-2025-PCM, art. 23In force

Applies from January 22, 2026

When it relates
Any organization in Peru that develops or uses AI, from the date the regulation took effect.
What the rule provides
  • Review every AI use and rule out prohibited uses: manipulating decisions through deceptive techniques or by exploiting vulnerabilities, mass surveillance without a legal basis, inferring sensitive traits from biometric data, real-time biometric identification in public spaces (except where the decree allows it) and predicting crimes from profiling or personality traits.
  • If you are unsure whether a use is prohibited, you can ask the Secretariat of Government and Digital Transformation (SGTD).
Typical evidence
  • Signed prohibited-use checklist for each system
  • Record of any questions sent to the SGTD
Related base documents
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. The art. 23 prohibition is not in the phased schedule, so it applies from the regulation's general entry into force (90 business days after publication; secondary sources put it at Jan 22, 2026). This is our reading of the text, not an official interpretation.

Check each AI use against the risk categories

DS 115-2025-PCM, arts. 22 a 24In force

Applies from January 22, 2026

When it relates
Any organization in Peru that develops or uses AI. It is not a standalone duty: it is the first step to know which obligations apply.
What the rule provides
  • Identify the AI systems in use and check whether any is a prohibited use or high risk. The regulation does not require a formal inventory of systems that are not high risk; those outside Articles 23 and 24 are deemed acceptable risk.
  • Treat as high risk, among others: managing critical assets (energy, telecom, water, transport, banking), educational assessment of children and teenagers, hiring, evaluating or firing staff, access to social programs, credit evaluation (except fraud detection), access to healthcare and diagnosis.
  • Review the classification when the system or its use changes.
Typical evidence
  • AI system inventory with each risk level and the reasoning
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. The regulation sets the classification; it does not expressly require an inventory of every system, but an inventory is the practical way to show the classification. Review Nov 2, 2026 in El Peruano: there is no express duty to classify or inventory (Art. 22.2; SGTD consultations are optional, Arts. 23.3 and 24.2). The only mandatory record is Art. 31.1 for high risk, which follows the sector deadlines.

Keep a record for each high-risk AI system

DS 115-2025-PCM, art. 31.1In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies that develop or use high-risk AI (employment, credit, healthcare, education, social programs, biometrics). The deadline depends on sector and size.
What the rule provides
  • Keep an up-to-date, accessible record describing how the system works, its data sources, the logic of the algorithm and its expected social and ethical impacts.
  • Update the record when the model, data or use changes.
Typical evidence
  • System sheet covering operation, data sources, logic and impacts
  • Version history of the record
Related base documents
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Adopt an internal AI policy

DS 115-2025-PCM, art. 31.2In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies in Peru that develop or use AI. The deadline depends on sector and size.
What the rule provides
  • Adopt clear policies and procedures on security, privacy, transparency, explainability and accountability for AI use.
  • Base them on international technical standards; the regulation promotes NTP-ISO/IEC 42001, 27002 and 27005.
Typical evidence
  • AI policy approved by management, dated and with an owner
  • Security and privacy procedures that cover AI
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Train staff on AI risks and responsible use

DS 115-2025-PCM, art. 31.3In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies in Peru that develop or use AI. The deadline depends on sector and size.
What the rule provides
  • Train internal staff on AI risks and on safe, responsible and ethical use, in line with the internal policy.
Typical evidence
  • Training plan and attendance or completion records
Related base documents
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Tell people before using high-risk AI

DS 115-2025-PCM, art. 25.1 y 25.2In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Companies that develop or use high-risk AI that affects people. The deadline depends on sector and size.
What the rule provides
  • Tell the person, before use and in plain language, the system's purpose, its main functions and the kinds of decisions it can make, without revealing trade secrets.
  • Label AI content or interactions visibly where relevant; this is not needed when AI only supports internal administrative processes with no direct impact on people.
Typical evidence
  • Notice text and screenshots of where it appears
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Art. 25.1 targets high-risk systems; labeling under 25.2 applies where relevant. The SGTD will issue transparency guidelines. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Explain AI decisions that affect people's rights

DS 115-2025-PCM, art. 25.3In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Companies whose high-risk AI systems make or support decisions that affect people's rights. The deadline depends on sector and size.
What the rule provides
  • Let the affected person get, in accessible language, an explanation of the main criteria and factors behind the result.
Typical evidence
  • Explanation request procedure and response templates
  • Log of explanations provided
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Ensure human oversight that can stop or correct the AI

DS 115-2025-PCM, art. 31.4In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance
  • : Small businesses; transport, commerce and labor
  • : Microbusinesses; production, agriculture, energy and mining
  • : All other sectors
When it relates
High-risk AI systems in healthcare, education, justice, finance or access to essential programs. The deadline follows the company's sector: healthcare, education and finance passed on Sep 10, 2026; a company in another sector running a system for access to social programs has a later deadline.
What the rule provides
  • Assign trained staff to oversee the system who can stop, correct or override its decisions.
  • Define when a person must step in and record each intervention.
Typical evidence
  • Human oversight procedure with named owners
  • Logs of interventions and overrides
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Art. 31.4 limits human oversight to high-risk systems in healthcare, education, justice, finance and access to essential programs; all of those sectors have the 1-year deadline. Review Nov 2, 2026: Art. 31 sits in the Title VI chapter subject to gradual implementation, so it now follows the same sector deadlines as the rest of Art. 31.

Voluntary impact assessment for high-risk AI

DS 115-2025-PCM, art. 32Regulator guidance

Applies from January 22, 2026

When it relates
Private companies with high-risk AI. It is voluntary; if the organization carries it out, the rule expects it to be documented and kept.
What the rule provides
  • Before developing or deploying a high-risk system, you may assess its impact; the SGTD may publish guidance on how.
  • If risks are found, take action: adjust the model, improve data quality or add human oversight.
  • Document findings and corrective measures and keep the documentation for at least 3 years.
Typical evidence
  • Dated impact assessment report with findings and measures
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. The assessment is voluntary for the private sector (art. 32.1); the 3-year retention (art. 32.3) applies if you do one.

Obligations for public bodies that use AI

DS 115-2025-PCM, arts. 28 a 30In force

Applies from September 10, 2026

When it relates
Public bodies and state-owned companies. Executive, Legislative, Judicial branches and autonomous bodies: Sep 10, 2026; EsSalud, regional governments, public universities and public companies: Sep 10, 2027; local governments types A to C: Sep 10, 2028.
What the rule provides
  • Adopt an institutional policy on safe, responsible and ethical AI use.
  • Develop systems following NTP-ISO/IEC 42001 and audit their security before and during operation.
  • Carry out a mandatory prior impact assessment for every high-risk system and ensure human oversight.
  • Publish the source code of publicly funded systems, with exceptions.
Typical evidence
  • Approved institutional policy
  • Impact assessments and audit reports
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. The questionnaire does not distinguish levels of government; we use the earliest date (Sep 10, 2026).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)