Employees use generative AI (ChatGPT, Copilot, Gemini…) in Ecuador: related rules
Staff use of generative AI assistants to draft, summarize, translate, analyze or research in daily work, with approved or unapproved tools (shadow AI). The risk lies in the data entered, reliance on wrong outputs and ownership of what is generated.
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 34 (processing by a processor is governed by a contract) and art. 47(10) (confidentiality contracts); Regulation, art. 40 (processor's sufficient guarantees) and art. 41 (written contract and its contents). Failing to sign them is a serious violation (LOPDP, art. 68).
Get information about the AI system from the vendor
SPDP AI ruleRes. SPDP-SPD-2026-0037-R, arts. 5 y 8, que reforma la SPDP-SPD-2026-0009-RIn force
Applies from September 14, 2026
When it relates
Organizations that use third-party AI systems with personal data.
What the rule provides
Request and keep the vendor's report on operation, limitations, risks and controls, and set out in the contract what access it has to the data.
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the 0037-R text published by the SPDP: art. 5 requires the processor to give the controller information on operation, limitations, risks and controls; requesting it, keeping it and setting data access in the contract helps document this. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).
Five base documents to roll out copilots and assistants in order: rollout guide, unauthorized AI regularization, usage rules, tool adoption and training.