Skip to content
AI Policy Generator

ESWhat applies

AI agents that take actions in Ecuador: related rules

Systems that, given a goal, plan and execute actions in other tools: sending emails, purchasing, changing records or approving requests. Their risk depends on the permissions they hold and whether they decide about people without human involvement.

Risk classification

Obligations related to this use case

Sign contracts with vendors that process data

LOPDPLOPDP, arts. 34 y 47, num. 10; Reglamento LOPDP, arts. 40 y 41In force

Already applicable

When it relates
Organizations using AI vendors that access personal data (generative AI tools, chatbots, AI-enabled software).
What the rule provides
  • Choose vendors that offer sufficient guarantees and sign contracts with confidentiality and data processing clauses.
Typical evidence
  • Signed processing agreements with each AI vendor
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 34 (processing by a processor is governed by a contract) and art. 47(10) (confidentiality contracts); Regulation, art. 40 (processor's sufficient guarantees) and art. 41 (written contract and its contents). Failing to sign them is a serious violation (LOPDP, art. 68).

Get information about the AI system from the vendor

SPDP AI ruleRes. SPDP-SPD-2026-0037-R, arts. 5 y 8, que reforma la SPDP-SPD-2026-0009-RIn force

Applies from September 14, 2026

When it relates
Organizations that use third-party AI systems with personal data.
What the rule provides
  • Request and keep the vendor's report on operation, limitations, risks and controls, and set out in the contract what access it has to the data.
Typical evidence
  • Vendor report and assessment questionnaire
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the 0037-R text published by the SPDP: art. 5 requires the processor to give the controller information on operation, limitations, risks and controls; requesting it, keeping it and setting data access in the contract helps document this. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).

Related base documents

Related kits

Includes 8 documents

AI Agents Kit

Six base documents for agents that act in systems: autonomy and permissions policy, integration map, adversarial testing, human oversight, rollback and incident response.

USD 169USD 292

Complete kit · available to buy

Find out what applies to you (free)Ecuador