AI regulation in Peru: Latin America Emerging AI Governance

Peru is emerging as a leading voice in Latin America's evolving AI governance landscape. Since the enactment of Law No. 31814 in July 2023, the country has taken concrete steps to build a regulatory framework that promotes innovation while safeguarding ethics, human rights, and digital trust. The subsequent 2024–2025 developments, including draft implementation rules and expanded criminal-liability provisions, reflect Peru's ambition to integrate AI oversight into its broader digital-transformation agenda. For organizations operating in or engaging with the Peruvian market, understanding this framework is essential to ensure compliance, manage risk, and identify new opportunities in one of the region's most forward-looking AI regulatory environments.

 

Key Legislative Milestones

Peru's AI regulatory framework has expanded steadily over the past three years, moving from high-level principles to detailed implementation rules and strengthened enforcement mechanisms. The most significant developments include:

• Law No. 31814 (July 2023): Establishes Peru's core principles for ethical and responsible AI use focused on economic and social development.
• Draft Regulation of Law 31814 (May 2024): Provides detailed requirements for AI risk classification, transparency, human oversight, accountability measures, and lifecycle documentation.
• Law No. 32314 (April 2025): Updates the Cybercrime Law and Criminal Code to include new aggravating factors and criminal liability for offences involving AI, such as deepfakes, AI-enabled fraud, and automated IP violations.

 

Together, these measures show Peru's growing commitment to promoting innovation while ensuring strong safeguards and enforcement in its digital ecosystem.

 

Peru's AI regime under Law 31814 and its 2024–2025 updates sets out a comprehensive structure for how artificial intelligence must be developed, deployed, governed, and monitored across the public and private sectors. The framework blends principles-driven oversight with risk-based regulation and evolving liability requirements, forming one of Latin America's most forward-looking AI governance models.

 

Principles and Scope

Peru's AI regulation is built around clear principles that guide all AI systems operated in the country. These include respect for human rights, proportionality, safety, transparency, and accountability. The rules apply broadly to:

• Public-sector bodies using or procuring AI
• Private companies performing public functions
• Private-sector organizations that fall within the national digital transformation system

This wide scope ensures that AI systems with societal impact are subject to consistent governance expectations.

 

Risk-Based Classification

Peru adopts a risk-tiered approach similar to global frameworks, ensuring stricter controls for systems that pose higher risks to individuals or society.

 

Unacceptable Risk

AI systems that pose inherent threats to rights or public safety, such as behaviour-manipulation techniques or harmful social scoring, are strictly prohibited.

 

High Risk

AI systems used in sensitive areas like biometric identification, employment decisions, credit scoring, or essential infrastructure are permitted only under strict governance, oversight, and documentation requirements.

 

Medium/Low Risk

AI systems with limited societal impact, including chatbots or entertainment applications, are subject to lighter obligations but must still follow core principles of safety, transparency, and accountability.

 

Governance, Oversight and Liability

The Secretariat of Government and Digital Transformation (SGTD), under the Presidency of the Council of Ministers, acts as the central authority responsible for coordinating AI governance in Peru. Key governance expectations include:

• Documenting the full AI lifecycle from design to deployment and monitoring
• Ensuring human oversight and the ability to intervene when necessary
• Maintaining traceability and clear accountability structures

Peru has also strengthened its enforcement posture. Under Law 32314 (2025), the use of AI in committing crimes, such as deepfakes, fraud, or automated IP violations, now attracts aggravated criminal liability, signalling a growing focus on digital safety.

 

Data and Transparency Obligations

AI developers and operators must follow strict requirements concerning:

• Data quality and minimisation
• Transparency of algorithmic processes where applicable
• User notification and the rights of individuals affected by AI
• Maintaining clear documentation on how data is collected and used

 

Organizations must also report security incidents involving AI systems to the National Digital Security Centre, reinforcing Peru's emphasis on resilience and trust. Peru's regulatory framework brings together principles, risk tiers, governance structures, and transparency obligations to create a balanced but robust environment for AI deployment. For organizations operating in or entering the Peruvian market, compliance now means going beyond functional performance: AI systems must be explainable, documented, supervised, and aligned with rights-preserving standards. With enforcement mechanisms strengthening in 2025, companies that adopt a governance-by-design approach will be better positioned to navigate Peru's evolving digital ecosystem and build trust with regulators, partners, and end users.

 

Business & Compliance Implications for Digital/AI-Driven Companies

For companies working with AI in Peru (whether deploying AI locally, providing AI services to Peruvian entities, or receiving Brazilian or multinational AI systems), the following are key considerations:

• Risk assessment: Identify which category your AI system falls into (unacceptable/high/medium/low). High-risk systems will require more onerous governance.
• Lifecycle governance: Ensure your AI development and deployment processes are documented: data sourcing, model design, bias mitigation, monitoring and withdrawal.
• Transparency & human oversight: Be able to explain the system's purpose, decision-making logic (where feasible), the persons responsible and how users can query or challenge outcomes.
• Data compliance: Where AI uses personal or sensitive data, ensure consent, minimisation and cross-border transfer controls are considered.
• Liability exposure: If your system is used in a regulated domain (e.g., employment, finance, infrastructure) or leads to misuse (e.g., deepfakes, fraud), Peru's regulatory framework signals criminal/administrative risk.
• Innovation opportunities: A clear regulatory regime can provide certainty and also signal market readiness for AI solutions in sectors such as education, health, public services and infrastructure.

 

Strategic Opportunities and Challenges in Peru's AI Landscape

 

Opportunities

• Peru's regulatory clarity (relative to many Latin-American peers) gives a competitive edge for companies able to partner locally or deploy responsibly.
• The digital transformation agenda (via the national digital transformation system) opens public-sector demand for AI + analytics solutions.
• Regional hub potential: Companies aligned early with Peru's regulation may leverage export opportunities in Latin America, similar to developments in Brazil, Mexico, and Costa Rica.

 

Challenges

• Institutional capacity: Some analyses point to a gap between ambitious regulation and effective enforcement/technical infrastructure in Peru.
• Implementation cost: Compliance burdens (documentation, audit capability, algorithm explainability) may raise entry-barriers for smaller firms.
• Evolving regulation: As the draft regulation is still evolving (and new laws/bills are in process) companies face regulatory uncertainty, making agile governance essential.

 

Alignment with Global Standards

Peru's approach shows significant alignment with global AI-governance frameworks (such as the Organisation for Economic Co‑operation and Development (OECD) AI Principles and the EU AI Act model) by emphasising human-centred AI, transparency, accountability and proportionality. For international companies, this means that compliance frameworks built for the EU or OECD may with adaptation be leveraged for Peru too.

 

What's Next / Key Trends for 2025

Peru's AI regulatory framework is continuing to evolve, and organizations operating in the country should be prepared for additional obligations, sector-specific rules, and a more active enforcement posture. Several developments are expected to shape the regulatory environment in the coming year:

• Finalisation of the regulation for Law 31814: Although the draft regulation was released in 2024, many obligations will enter into force gradually, making it essential for companies to monitor implementation timelines and compliance checkpoints.
• Expansion of sector-specific rules: Areas such as financial services, employment, critical infrastructure, and public-service delivery may soon receive targeted AI requirements tailored to their risk profiles.
• Enforcement and audit regime: The introduction of criminal liability for AI-related offences under Law 32314 indicates a shift toward stronger enforcement, including potential audits and investigations for high-risk systems.
• Regional harmonisation and cross-border considerations: As AI solutions increasingly operate across jurisdictions, alignment with other Latin American regulatory initiatives will become important for companies with regional footprints.
• Generative AI and synthetic media: In line with global trends, Peru is expected to issue further guidance or obligations related to deepfakes, generative AI models, and large-language systems.

Taken together, these trends signal a more mature, structured, and coordinated AI governance environment in Peru. Companies that stay ahead of these developments will be better positioned to maintain compliance, mitigate risk, and build trust in one of Latin America's most dynamic regulatory markets.

 

Frequently Asked Questions

 

What is Law 31814 and when did it take effect?

Law 31814 was published on 5 July 2023, promoting the use of AI for Peru's economic and social development and setting out foundational principles for AI governance.

 

Which AI uses are prohibited under Peru's framework?

The draft regulation identifies "unacceptable risk" systems, including those that manipulate behaviour subliminally, social scoring that harms individuals/groups, or biometric identification without safeguards.

 

What must businesses do to comply?

Businesses must perform risk assessments, establish governance structures for AI lifecycle management, ensure transparency and human oversight, guard personal data, and monitor regulatory updates.

 

How does Peru's regulation compare internationaly?

Peru's framework aligns strongly with global AI-governance themes (human-centrism, risk-based approach, transparency) and draws inspiration from frameworks such as the OECD AI Principles and EU AI Act, while adapting to local context.

 

Final Thoughts for Clients

For firms engaged in Peru whether deploying AI, partnering with local players or offering AI-enabled services it is now critical to adopt a compliance-by-design mindset: governance, transparency, risk-management and institutional accountability form the foundation of "regulation-ready" AI. The regulatory landscape in Peru is maturing rapidly, and companies with proactive governance will benefit both from regulatory certainty and market leadership.

If your organisation needs support for instance in performing an AI-system risk-classification, building a governance roadmap aligned with Peru's law or executing a transparency/oversight framework the right technical and regulatory support can smooth your entry into this dynamic market.