Skip to content
AI Policy Generator

ESWhat applies

Diagnosis, triage or clinical support in Peru: related rules

AI that helps diagnose, prioritize patients, recommend treatments, read medical images or draft clinical notes. Errors affect health, so clinical validation, medical oversight, patient transparency and, if it is a medical device, sanitary registration are required.

Risk classification

JurisdictionLevelDateNote
PeruHigh riskSeptember 10, 2026Access to health is high-risk and the health-sector deadline has passed: records, human oversight, transparency and training.

Obligations related to this use case

Keep a record for each high-risk AI system

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.1In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies that develop or use high-risk AI (employment, credit, healthcare, education, social programs, biometrics). The deadline depends on sector and size.
What the rule provides
  • Keep an up-to-date, accessible record describing how the system works, its data sources, the logic of the algorithm and its expected social and ethical impacts.
  • Update the record when the model, data or use changes.
Typical evidence
  • System sheet covering operation, data sources, logic and impacts
  • Version history of the record
Related base documents
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Adopt an internal AI policy

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.2In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies in Peru that develop or use AI. The deadline depends on sector and size.
What the rule provides
  • Adopt clear policies and procedures on security, privacy, transparency, explainability and accountability for AI use.
  • Base them on international technical standards; the regulation promotes NTP-ISO/IEC 42001, 27002 and 27005.
Typical evidence
  • AI policy approved by management, dated and with an owner
  • Security and privacy procedures that cover AI
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Train staff on AI risks and responsible use

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.3In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Private companies in Peru that develop or use AI. The deadline depends on sector and size.
What the rule provides
  • Train internal staff on AI risks and on safe, responsible and ethical use, in line with the internal policy.
Typical evidence
  • Training plan and attendance or completion records
Related base documents
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Tell people before using high-risk AI

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 25.1 y 25.2In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Companies that develop or use high-risk AI that affects people. The deadline depends on sector and size.
What the rule provides
  • Tell the person, before use and in plain language, the system's purpose, its main functions and the kinds of decisions it can make, without revealing trade secrets.
  • Label AI content or interactions visibly where relevant; this is not needed when AI only supports internal administrative processes with no direct impact on people.
Typical evidence
  • Notice text and screenshots of where it appears
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Art. 25.1 targets high-risk systems; labeling under 25.2 applies where relevant. The SGTD will issue transparency guidelines. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Explain AI decisions that affect people's rights

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 25.3In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance: 1-year deadline (passed on Sep 10, 2026)
  • : Healthcare, education or finance uses in any company: 1-year deadline (passed on Sep 10, 2026)
  • : Small business (annual sales above 150 and up to 1,700 UIT): 2-year deadline
  • : Commerce, transport and labor: 2-year deadline
  • : Employment uses (hiring, evaluation or staff management): 2-year deadline
  • : Microbusiness (annual sales up to 150 UIT): 3-year deadline
  • : Production, agriculture, energy and mining: 3-year deadline
  • : All other sectors and uses: 4-year deadline
When it relates
Companies whose high-risk AI systems make or support decisions that affect people's rights. The deadline depends on sector and size.
What the rule provides
  • Let the affected person get, in accessible language, an explanation of the main criteria and factors behind the result.
Typical evidence
  • Explanation request procedure and response templates
  • Log of explanations provided
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Dates are counted from Sep 10, 2025, the day after publication. The decree does not say how the micro and small business deadline combines with the sector deadline; we apply the earliest date that fits. The decree measures size by annual sales in UIT; the questionnaire approximates it by headcount.

Ensure human oversight that can stop or correct the AI

Law 31814 and SD 115-2025-PCMDS 115-2025-PCM, art. 31.4In force

Applies from September 10, 2026

Deadlines by profile

  • : Healthcare, education, justice, security, economy and finance
  • : Small businesses; transport, commerce and labor
  • : Microbusinesses; production, agriculture, energy and mining
  • : All other sectors
When it relates
High-risk AI systems in healthcare, education, justice, finance or access to essential programs. The deadline follows the company's sector: healthcare, education and finance passed on Sep 10, 2026; a company in another sector running a system for access to social programs has a later deadline.
What the rule provides
  • Assign trained staff to oversee the system who can stop, correct or override its decisions.
  • Define when a person must step in and record each intervention.
Typical evidence
  • Human oversight procedure with named owners
  • Logs of interventions and overrides
Verification
Verified in the official source on November 2, 2026Official text of Supreme Decree 115-2025-PCM checked in El Peruano. Art. 31.4 limits human oversight to high-risk systems in healthcare, education, justice, finance and access to essential programs; all of those sectors have the 1-year deadline. Review Nov 2, 2026: Art. 31 sits in the Title VI chapter subject to gradual implementation, so it now follows the same sector deadlines as the rest of Art. 31.

Appoint a Personal Data Officer

Law 29733 and SD 016-2024-JUSDS 016-2024-JUS, arts. 37 a 39In force

Applies from March 30, 2025

Deadlines by profile

  • : Public bodies: from the regulation's effective date
  • : Annual sales above 2,300 UIT: 1 year from publication
  • : Annual sales of 1,700 to 2,300 UIT: 2 years from publication
  • : Annual sales of 150 to 1,700 UIT: 3 years from publication
  • : Annual sales up to 150 UIT: 4 years from publication
When it relates
Public bodies, from the regulation's effective date, and companies that process data at large scale, process sensitive data or may significantly affect people, with a deadline that depends on annual sales.
What the rule provides
  • Appoint a Data Officer (internal, external or shared within the group) and publish their contact details.
  • Notify the National Data Protection Authority within 15 days.
Typical evidence
  • Appointment record and proof of notice to the authority
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): arts. 37-39 (37.4: publish contact details; 37.5: notify the Authority within 15 days) and first final supplementary provision: for the cases in art. 37.1(2) and (3) the deadline is 1 to 4 years "after the publication date" depending on sales (Nov 30, 2025 to Nov 30, 2028); public bodies are not phased. The questionnaire approximates sales by headcount. The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Related base documents

Related kits

Includes 5 documents

Healthcare Kit

Technical and clinical validation, DPIA for health data, clinician oversight, in-use monitoring and a model card for clinical AI tools.

USD 139USD 215

Complete kit · available to buy

Find out what applies to you (free)Peru