Skip to content
AI Policy Generator

ESWhat applies

Customer service chatbot or assistant in Ecuador: related rules

Text or voice conversational assistants that serve customers on websites, apps, WhatsApp or call centers. They are already regulated: users must be told they are talking to AI and, in several countries, offered the option of reaching a person.

Risk classification

Obligations related to this use case

Sign contracts with vendors that process data

LOPDPLOPDP, arts. 34 y 47, num. 10; Reglamento LOPDP, arts. 40 y 41In force

Already applicable

When it relates
Organizations using AI vendors that access personal data (generative AI tools, chatbots, AI-enabled software).
What the rule provides
  • Choose vendors that offer sufficient guarantees and sign contracts with confidentiality and data processing clauses.
Typical evidence
  • Signed processing agreements with each AI vendor
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 34 (processing by a processor is governed by a contract) and art. 47(10) (confidentiality contracts); Regulation, art. 40 (processor's sufficient guarantees) and art. 41 (written contract and its contents). Failing to sign them is a serious violation (LOPDP, art. 68).

Get information about the AI system from the vendor

SPDP AI ruleRes. SPDP-SPD-2026-0037-R, arts. 5 y 8, que reforma la SPDP-SPD-2026-0009-RIn force

Applies from September 14, 2026

When it relates
Organizations that use third-party AI systems with personal data.
What the rule provides
  • Request and keep the vendor's report on operation, limitations, risks and controls, and set out in the contract what access it has to the data.
Typical evidence
  • Vendor report and assessment questionnaire
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the 0037-R text published by the SPDP: art. 5 requires the processor to give the controller information on operation, limitations, risks and controls; requesting it, keeping it and setting data access in the contract helps document this. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).

Related base documents

Related kits

Includes 4 documents

Generative AI Starter Kit

Four base documents to start with from day one: usage rules, intellectual property, a tool inventory and staff training.

USD 109USD 176

Complete kit · available to buy

Includes 5 documents

Customer Service Chatbot Kit

AI interaction notice, right to reach a human, explanations, complaints and incidents for a customer-facing chatbot or voice assistant.

USD 109USD 175

Complete kit · available to buy

Includes 6 documents

AI Integrators Kit

Six base documents for integrating third-party models through APIs or RAG: due diligence, model provenance, architecture, integration map, adversarial security and service level agreement.

USD 119USD 194

Complete kit · available to buy

Find out what applies to you (free)Ecuador