Skip to content
AI Policy Generator

ESWhat applies

Coding assistants in Ecuador: related rules

Tools that suggest, complete or generate source code inside the development environment or through agents. The risks are leaking code or secrets, incompatible open-source licenses, vulnerabilities and ownership of generated code.

Risk classification

Obligations related to this use case

Sign contracts with vendors that process data

LOPDPLOPDP, arts. 34 y 47, num. 10; Reglamento LOPDP, arts. 40 y 41In force

Already applicable

When it relates
Organizations using AI vendors that access personal data (generative AI tools, chatbots, AI-enabled software).
What the rule provides
  • Choose vendors that offer sufficient guarantees and sign contracts with confidentiality and data processing clauses.
Typical evidence
  • Signed processing agreements with each AI vendor
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 34 (processing by a processor is governed by a contract) and art. 47(10) (confidentiality contracts); Regulation, art. 40 (processor's sufficient guarantees) and art. 41 (written contract and its contents). Failing to sign them is a serious violation (LOPDP, art. 68).

Get information about the AI system from the vendor

SPDP AI ruleRes. SPDP-SPD-2026-0037-R, arts. 5 y 8, que reforma la SPDP-SPD-2026-0009-RIn force

Applies from September 14, 2026

When it relates
Organizations that use third-party AI systems with personal data.
What the rule provides
  • Request and keep the vendor's report on operation, limitations, risks and controls, and set out in the contract what access it has to the data.
Typical evidence
  • Vendor report and assessment questionnaire
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the 0037-R text published by the SPDP: art. 5 requires the processor to give the controller information on operation, limitations, risks and controls; requesting it, keeping it and setting data access in the contract helps document this. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).

Related base documents

Related kits

Includes 4 documents

Generative AI Starter Kit

Four base documents to start with from day one: usage rules, intellectual property, a tool inventory and staff training.

USD 109USD 176

Complete kit · available to buy

Includes 6 documents

AI Adoption Starter Kit: First 90 Days

Six base documents to launch AI adoption in the right order: 90-day roadmap, usage rules, tool approval, use case portfolio, pilots and training.

USD 139USD 234

Complete kit · available to buy

Includes 5 documents

AI Assistant Rollout Kit

Five base documents to roll out copilots and assistants in order: rollout guide, unauthorized AI regularization, usage rules, tool adoption and training.

USD 119USD 195

Complete kit · available to buy

Find out what applies to you (free)Ecuador