AI features inside vendor software in Ecuador: related rules
AI features built into software the organization already buys, such as CRM, ERP, office suites or HR tools. The customer remains responsible for how they are used and must control contracts, data, training on its information and subprocessors.
The amended general rule on AI requires vendors to report on functioning, limitations and risks; transfers have a transition period until January 2027.
Obligations related to this use case
Sign contracts with vendors that process data
LOPDPLOPDP, arts. 34 y 47, num. 10; Reglamento LOPDP, arts. 40 y 41In force
Already applicable
When it relates
Organizations using AI vendors that access personal data (generative AI tools, chatbots, AI-enabled software).
What the rule provides
Choose vendors that offer sufficient guarantees and sign contracts with confidentiality and data processing clauses.
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 34 (processing by a processor is governed by a contract) and art. 47(10) (confidentiality contracts); Regulation, art. 40 (processor's sufficient guarantees) and art. 41 (written contract and its contents). Failing to sign them is a serious violation (LOPDP, art. 68).
Get information about the AI system from the vendor
SPDP AI ruleRes. SPDP-SPD-2026-0037-R, arts. 5 y 8, que reforma la SPDP-SPD-2026-0009-RIn force
Applies from September 14, 2026
When it relates
Organizations that use third-party AI systems with personal data.
What the rule provides
Request and keep the vendor's report on operation, limitations, risks and controls, and set out in the contract what access it has to the data.
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the 0037-R text published by the SPDP: art. 5 requires the processor to give the controller information on operation, limitations, risks and controls; requesting it, keeping it and setting data access in the contract helps document this. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).
Six base documents for integrating third-party models through APIs or RAG: due diligence, model provenance, architecture, integration map, adversarial security and service level agreement.