Skip to content
AI Policy Generator

ESWhat applies

Selling software or services that include AI in Ecuador: related rules

Organizations that build and sell AI-enabled products or services to businesses or consumers. They take on provider duties and, above all, customer demands for evidence of governance, security and transparency before buying.

Risk classification

JurisdictionLevelDateNote
EcuadorData protectionMarch 10, 2026The vendor must inform the controller about the system's functioning, limitations and risks.

Obligations related to this use case

AI vendor duties toward its client

SPDP AI ruleRes. SPDP-SPD-2026-0037-R, arts. 1, 5, 8 y disposiciones generales, que reforma la SPDP-SPD-2026-0009-RIn force

Applies from September 14, 2026

When it relates
Companies that provide, develop or maintain AI systems that process their clients' data.
What the rule provides
  • Comply with the rule in the phases where you have access, visibility or effective control over the data.
  • If you claim no such access, keep evidence for the Superintendency.
  • Inform the client about how the system works, its relevant limitations, foreseeable risks and control measures, without revealing trade secrets.
Typical evidence
  • Report on operation, limitations and risks delivered to the client
  • Evidence of the scope of data access
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the text of Res. SPDP-SPD-2026-0037-R published by the SPDP: arts. 1 and 3-8 (processors with access, visibility or effective control), art. 5 (inform the controller) and general provisions one and two. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).

Related base documents

Related kits

Includes 6 documents

B2B Vendor Kit for Customer Questionnaires

Base documents on topics that procurement questionnaires from banks and US clients often cover: policy, inventory, impact assessment, incidents, vendors and security.

USD 169USD 274

Complete kit · available to buy

Includes 6 documents

AI Integrators Kit

Six base documents for integrating third-party models through APIs or RAG: due diligence, model provenance, architecture, integration map, adversarial security and service level agreement.

USD 119USD 194

Complete kit · available to buy

Includes 7 documents

Self-Hosted and Open-Weight Models Kit

Seven base documents for hosting in-house or open-weight models: provenance, security baseline, adversarial testing, architecture, model card, life cycle and rollback.

USD 149USD 233

Complete kit · available to buy

Find out what applies to you (free)Ecuador