Skip to content
AI Policy Generator

ESWhat applies

Insurance pricing or underwriting in Peru: related rules

Models that calculate premiums, accept or decline risks or adjust coverage based on personal data. For life and health insurance it is high-risk in the EU, and several US regulators require governance and discrimination testing.

Risk classification

JurisdictionLevelDateNote
PeruSector rulesJanuary 1, 2026The SBS model risk regulation covers insurers; the AI regulation applies through its general clause.

Obligations related to this use case

Adopt an internal AI policy

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.2In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies in Peru that develop or use AI. The deadline depends on sector and size.
What the rule provides
  • Adopt clear policies and procedures on security, privacy, transparency, explainability and accountability for AI use.
  • Base them on international technical standards; the regulation promotes NTP-ISO/IEC 42001, 27002 and 27005.
Typical evidence
  • AI policy approved by management, dated and with an owner
  • Security and privacy procedures that cover AI
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Train staff on AI risks and responsible use

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.3In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies in Peru that develop or use AI. The deadline depends on sector and size.
What the rule provides
  • Train internal staff on AI risks and on safe, responsible and ethical use, in line with the internal policy.
Typical evidence
  • Training plan and attendance or completion records
Related base documents
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Disclose automated decisions and allow them to be reviewed

Law 29733 and SD 016-2024-JUSLey 29733, art. 23; DS 016-2024-JUS, arts. 6.1.8 y 87In force

Applies from March 30, 2025

When it relates
Organizations that use AI to profile people or make decisions with legal or significant effects on them.
What the rule provides
  • Tell people that automated decisions, including profiling, are used.
  • Respect the right not to be subject to decisions based solely on automated processing that produce legal or significant effects, except where the law allows it.
  • If data feeds a decision without the person's involvement, tell them as soon as possible.
Typical evidence
  • Privacy notice that mentions automated decisions and profiling
  • Human review procedure and request log
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): art. 6.1(8) (disclose automated decisions and profiling) and art. 87 (right to objective processing, with the exceptions in art. 23 of the Law). The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Appoint a Personal Data Officer

Law 29733 and SD 016-2024-JUSDS 016-2024-JUS, arts. 37 a 39In force

Applies from March 30, 2025

Deadlines by profile

  • : Public bodies: from the regulation's effective date
  • : Annual sales above 2,300 UIT: 1 year from publication
  • : Annual sales of 1,700 to 2,300 UIT: 2 years from publication
  • : Annual sales of 150 to 1,700 UIT: 3 years from publication
  • : Annual sales up to 150 UIT: 4 years from publication
When it relates
Public bodies, from the regulation's effective date, and companies that process data at large scale, process sensitive data or may significantly affect people, with a deadline that depends on annual sales.
What the rule provides
  • Appoint a Data Officer (internal, external or shared within the group) and publish their contact details.
  • Notify the National Data Protection Authority within 15 days.
Typical evidence
  • Appointment record and proof of notice to the authority
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): arts. 37-39 (37.4: publish contact details; 37.5: notify the Authority within 15 days) and first final supplementary provision: for the cases in art. 37.1(2) and (3) the deadline is 1 to 4 years "after the publication date" depending on sales (Nov 30, 2025 to Nov 30, 2028); public bodies are not phased. The questionnaire approximates sales by headcount. The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Related base documents

Related kits

Includes 7 documents

Credit and Insurance Kit

Model risk with inventory and materiality, adverse-decision explanation letters, human review, a decision log, technical model documentation and the EU AI Act Art. 26 checklist for high-risk systems.

USD 139USD 253

Complete kit · available to buy

Find out what applies to you (free)Peru