Skip to content
AI Policy Generator

ESWhat applies

Credit or creditworthiness scoring in Peru: related rules

Models that estimate a person's likelihood of default or creditworthiness to approve, deny or price credit. It is high-risk in the EU and Peru and requires explaining denial reasons and allowing human review in almost every jurisdiction.

Risk classification

JurisdictionLevelDateNote
PeruHigh riskSeptember 10, 2026Credit assessment is high-risk and the finance-sector deadline has passed; the SBS requires model risk management (Res. 053-2023).

Obligations related to this use case

Keep a record for each high-risk AI system

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.1In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies that develop or use high-risk AI (employment, credit, healthcare, education, social programs, biometrics). The deadline depends on sector and size.
What the rule provides
  • Keep an up-to-date, accessible record describing how the system works, its data sources, the logic of the algorithm and its expected social and ethical impacts.
  • Update the record when the model, data or use changes.
Typical evidence
  • System sheet covering operation, data sources, logic and impacts
  • Version history of the record
Related base documents
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Adopt an internal AI policy

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.2In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies in Peru that develop or use AI. The deadline depends on sector and size.
What the rule provides
  • Adopt clear policies and procedures on security, privacy, transparency, explainability and accountability for AI use.
  • Base them on international technical standards; the regulation promotes NTP-ISO/IEC 42001, 27002 and 27005.
Typical evidence
  • AI policy approved by management, dated and with an owner
  • Security and privacy procedures that cover AI
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Train staff on AI risks and responsible use

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.3In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies in Peru that develop or use AI. The deadline depends on sector and size.
What the rule provides
  • Train internal staff on AI risks and on safe, responsible and ethical use, in line with the internal policy.
Typical evidence
  • Training plan and attendance or completion records
Related base documents
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Tell people before using high-risk AI

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 25.1 y 25.2In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Companies that develop or use high-risk AI that affects people. The deadline depends on sector and size.
What the rule provides
  • Tell the person, before use and in plain language, the system's purpose, its main functions and the kinds of decisions it can make, without revealing trade secrets.
  • Label AI content or interactions visibly where relevant; this is not needed when AI only supports internal administrative processes with no direct impact on people.
Typical evidence
  • Notice text and screenshots of where it appears
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Art. 25.1 targets high-risk systems; labeling under 25.2 applies where relevant. The SGTD will issue transparency guidelines. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Explain AI decisions that affect people's rights

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 25.3In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Companies whose high-risk AI systems make or support decisions that affect people's rights. The deadline depends on sector and size.
What the rule provides
  • Let the affected person get, in accessible language, an explanation of the main criteria and factors behind the result.
Typical evidence
  • Explanation request procedure and response templates
  • Log of explanations provided
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Ensure human oversight that can stop or correct the AI

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.4In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance
  • : Small businesses; transport, commerce and labor
  • : Microbusinesses; production, agriculture, energy and mining
  • : All other sectors
When it relates
High-risk AI systems in healthcare, education, justice, finance or access to essential programs. The deadline follows the company's sector: healthcare, education and finance passed on Sep 10, 2026; a company in another sector running a system for access to social programs has a later deadline.
What the rule provides
  • Assign trained staff to oversee the system who can stop, correct or override its decisions.
  • Define when a person must step in and record each intervention.
Typical evidence
  • Human oversight procedure with named owners
  • Logs of interventions and overrides
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Art. 31.4 limits human oversight to high-risk systems in healthcare, education, justice, finance and access to essential programs; all of those sectors have the 1-year deadline. Review Nov 2, 2026: Art. 31 sits in the Title VI chapter subject to gradual implementation, so it now follows the same sector deadlines as the rest of Art. 31.

Disclose automated decisions and allow them to be reviewed

Law 29733 and SD 016-2024-JUSLey 29733, art. 23; DS 016-2024-JUS, arts. 6.1.8 y 87In force

Applies from March 30, 2025

When it relates
Organizations that use AI to profile people or make decisions with legal or significant effects on them.
What the rule provides
  • Tell people that automated decisions, including profiling, are used.
  • Respect the right not to be subject to decisions based solely on automated processing that produce legal or significant effects, except where the law allows it.
  • If data feeds a decision without the person's involvement, tell them as soon as possible.
Typical evidence
  • Privacy notice that mentions automated decisions and profiling
  • Human review procedure and request log
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): art. 6.1(8) (disclose automated decisions and profiling) and art. 87 (right to objective processing, with the exceptions in art. 23 of the Law). The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Appoint a Personal Data Officer

Law 29733 and SD 016-2024-JUSDS 016-2024-JUS, arts. 37 a 39In force

Applies from March 30, 2025

Deadlines by profile

  • : Public bodies: from the regulation's effective date
  • : Annual sales above 2,300 UIT: 1 year from publication
  • : Annual sales of 1,700 to 2,300 UIT: 2 years from publication
  • : Annual sales of 150 to 1,700 UIT: 3 years from publication
  • : Annual sales up to 150 UIT: 4 years from publication
When it relates
Public bodies, from the regulation's effective date, and companies that process data at large scale, process sensitive data or may significantly affect people, with a deadline that depends on annual sales.
What the rule provides
  • Appoint a Data Officer (internal, external or shared within the group) and publish their contact details.
  • Notify the National Data Protection Authority within 15 days.
Typical evidence
  • Appointment record and proof of notice to the authority
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): arts. 37-39 (37.4: publish contact details; 37.5: notify the Authority within 15 days) and first final supplementary provision: for the cases in art. 37.1(2) and (3) the deadline is 1 to 4 years "after the publication date" depending on sales (Nov 30, 2025 to Nov 30, 2028); public bodies are not phased. The questionnaire approximates sales by headcount. The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Related base documents

Related kits

Includes 7 documents

Credit and Insurance Kit

Model risk with inventory and materiality, adverse-decision explanation letters, human review, a decision log, technical model documentation and the EU AI Act Art. 26 checklist for high-risk systems.

USD 139USD 253

Complete kit · available to buy

Find out what applies to you (free)Peru