The Regulations to Law No. 31814 (Reglamento de la Ley N.° 31814) (Article 6) define “AI” as the scientific discipline oriented towards research and development of AI-based systems, and an “AI-based system” as a machine-based system that infers outputs (predictions, content, recommendations, decisions) from received input, with varying autonomy — closely tracking the OECD definition. Related roles (developer, implementer, user) are also defined.

Law No. 31814 (Ley N.° 31814) (Article 4) and its Regulations (Article 8) designate the Presidencia del Consejo de Ministros (“Office of the Prime Minister” or PCM) — through the Secretariat of Government and Digital Transformation (“Secretaría de Gobierno y Gestión Digital” or SGTD) — as the national technical-regulatory authority for AI. There is no separate, freestanding AI regulator comparable to a financial or telecoms regulator; oversight sits within the PCM/SGTD’s general digital-transformation mandate.

Ministerial Resolution No. 152-2026-PCM (Resolución Ministerial N.° 152-2026-PCM) approved the National Strategy for Artificial Intelligence (“Estrategia Nacional de Inteligencia Artificial” or ENIA 2026-2030) on 1 May 2026, under the previous administration. Its four pillars are talent/capability development, innovation/entrepreneurship, an ethical/regulatory framework, and citizen participation.

Progress is at a very early stage. The 90/120-working-day statutory deadlines (AI Officer guidelines; “Catálogo IA Perú”) fall within 2026, overlapping the change of government; no public confirmation of compliance has been enacted. No confirmed revision plans by incoming President Keiko Fujimori nor Prime Minister Galarreta government can be identified.  And this is logical, as they received their credentials very late and have just assumed their posts on 28 July 2026.  But the public at large expect changes, and so do AI companies already doing business in Peru and those wishing to enter into a secured, regulated, fair play market.

Law No. 31814 (Ley N.° 31814) (2023, principle-based framework law), its Regulations (Supreme Decree No. 115-2025-PCM, in force since 22 January 2026) and the ENIA form the core AI-specific framework, with a three-tier risk classification: unauthorised use (prohibited), high risk (permitted, conditional) and acceptable/general use.

Absent AI-specific rules, general law fills gaps:

• Personal Data Protection Law (Ley N.° 29733, Ley de Protección de Datos Personales), and its Regulations (Supreme Decree No. 016-2024-JUS, in force since 30 March 2025) — the most operative framework in practice.
• Civil Code (Código Civil) provisions on civil liability (Articles 1969 and 1970 — see Question 7).
• Consumer Protection Code (Ley N.° 29571, Código de Protección y Defensa del Consumidor) — applicable to AI-enabled products and services offered to consumers.
• Computer Crimes Law (Ley N.° 30096, Ley de Delitos Informáticos) and its Regulations — applicable to malicious uses of automated systems.
• Digital Government Law (Decreto Legislativo N.° 1412, Ley de Gobierno Digital), and the Cyberdefence Supreme Decree (Decreto Supremo N.° 017-2024-PCM)

Main interpretive challenges

• Overlapping competencies between the SGTD, the ANPD and sector regulators, with no single instrument resolving every conflict.
• The Regulations’ risk categories borrow from, but are not identical to, the EU AI Act’s structure, creating mapping uncertainty for multinational compliance teams.
• Open-textured terms (“unlawful mass surveillance”, “significant and irreversible impact”) lack further binding secondary guidance, leaving interpretive discretion largely with the SGTD.
• No independent AI penalty regime means enforcement depends on how sector regulators and the ANPD characterise AI-related breaches under their own, non-AI-specific frameworks.

Pending legislative initiatives

Law No. 31814 (Ley N.° 31814) has been the subject of congressional amendment bills (including a proposed National Registry of High-Risk AI Systems); none had been enacted at the time of this writing.

Transparency is a governing principle: AI systems must be clear, explainable and accessible. High-risk systems specifically must inform users of purpose, functionality and decisions, and explain outcomes affecting fundamental rights. Security audits and international standards adoption are expected obligations for institutional AI policies. There is no blanket duty to disclose AI interaction in every circumstance — this is concrete mainly for high-risk systems or where personal data is automatically processed.

Human oversight is a binding governing principle: systems must allow human correction, modification or shutdown, and human validation of training-data quality. This is mandatory for high-risk systems (alongside impact assessments); for other systems it functions more as a general expectation than an independently enforceable, system-by-system mandate.

“Algorithmic bias” is expressly defined in the Regulations as a systematic error producing unfair, biased or discriminatory decisions from training data, algorithm design, or biased human interaction. Non-discrimination is a governing principle, and AI-supported digital services must account for the differentiated needs of women, children, older persons, persons with disabilities and other vulnerable groups.

Gender bias is not addressed by a separate AI-specific statute but falls under this general principle plus Peru’s constitutional equality guarantee (Article 2.2 of the  (Constitución Política del Perú)) and the Equal Opportunities Law (Ley N.° 28983). No mandatory bias-audit methodology or published fairness-metrics requirement exists yet.

No AI-specific liability statute exists. General civil-liability rules apply by analogy:

• Civil Code, Article 1969 (Código Civil, artículo 1969) (fault-based liability): the victim proves harm and causation; the burden then shifts to the defendant to disprove fault.
• Civil Code, Article 1970 (Código Civil, artículo 1970) (strict/objective liability for risky goods or activities): the victim need only prove harm, the risky/hazardous nature of the good or activity, and causation — fault is not an element. This is the more claimant-friendly route increasingly discussed in Peruvian academic commentary for autonomous/high-risk AI systems.
• Joint and several liability is doctrinally supported where several actors (developer, implementer, user) contributed and shares cannot be disentangled, with rights of contribution between them.
• The Consumer Protection Code (Ley N.° 29571, Código de Protección y Defensa del Consumidor) imposes objective liability on providers for defective AI-enabled products/services, enforceable through INDECOPI.

Potentially liable parties include the developer, implementer/deployer, or an importer/distributor, depending on who contributed the defect or risk. No Peruvian case law squarely addressing AI-system liability exists yet.

No cybersecurity chapter is dedicated exclusively to AI; AI falls within Peru’s general framework:

• Digital Government Law (Decreto Legislativo N.° 1412, Ley de Gobierno Digital) — governs digital technologies, including AI, within public entities.
• Cyberdefence Supreme Decree (Decreto Supremo N.° 017-2024-PCM) — protects national interests against cyberspace threats.
• Computer Crimes Law (Ley N.° 30096, Ley de Delitos Informáticos) and its Regulations (Supreme Decree No. 017-2017-JUS) — criminalise malicious interference with computer systems, regardless of AI involvement.

Within the AI Regulations themselves, the CNSD (under the SGTD) conducts preventive monitoring of high-risk/prohibited AI systems, and a designated “Digital Security and Trust Officer” role supports AI-lifecycle risk management.

No AI-specific insurance product or mandate exists in Peru, and no Peru-specific AI-insurance market data can be identified. General third-party civil-liability policies (tied to Civil Code Articles 1969/1970, sold by insurers such as Rímac, Pacífico and MAPFRE Perú) could in principle respond to AI-caused harm, subject to wording and underwriting appetite. Cyber-risk cover is available, mainly through international broker/reinsurance capacity rather than dedicated domestic products.

Globally, insurers are grappling with “silent AI” risk — AI losses falling under policies never priced for that risk — with some carriers building dedicated AI errors-and-omissions cover and others seeking to exclude AI liability altogether. This bifurcation is likely to reach Peru through wording changes to existing liability/cyber policies rather than a near-term, bespoke local product.

No. Peru’s patent system runs on Decisiom 486 of the Andean Pact  (“Decisión 486 de la Comunidad Andina”), directly applicable domestically and supplemented by Legislative Decree No. 1075 (Decreto Legislativo N.° 1075). Decision 486 frames “inventor” around natural persons, and the Andean Manual for Patent Examination — applied by INDECOPI — expressly requires the inventor named in an application to be one or more natural persons. A 2026 International Bar Association analysis confirms there is no basis under Peruvian law for recognising an AI system as an inventor, consistent with UK, US and EU outcomes in DABUS-style test cases.

Peru’s Copyright Law (“Decreto Legislativo N.° 822, Ley sobre el Derecho de Autor”) protects original intellectual creations expressed in a tangible form, and INDECOPI’s own case law requires “la expresión creativa e individualizada de la obra” — a human, individualised creative act. A work generated entirely by AI, without meaningful human creative input, would not qualify for copyright protection; there is no basis in Peruvian law to attribute authorship to the AI system itself.

Where a human uses AI as a tool — providing genuine creative direction, selection or substantial editing — Peruvian commentary attributes authorship to that human user, on the same logic used for other tool-assisted works. The statute has not been amended to address AI specifically, and unauthorised use of copyrighted works to train AI models remains a distinct, unresolved infringement question.

No dedicated “AI at work” statute exists, but several strands converge:

• Discrimination in AI-driven hiring falls within existing labour-inspection rules treating direct/indirect employment discrimination as a very serious infraction; the emerging guidance is that the final selection decision must remain under human supervision, with periodic bias review.

Use of AI to score, rank or profile candidates or employees also triggers personal data protection rules, including the right to request human review of automated decisions with significant effects.

The Teleworking Law (“Ley N.° 31572, Ley del Teletrabajo”) (as amended by Ley N.° 32102) is the most concrete labour-specific instrument touching AI-adjacent monitoring: Article 24 addresses digital security in teleworking and Article 25 addresses supervision, read together with the Law’s express right to digital disconnection outside working hours.

Key issues include lawful basis for training-data processing, purpose limitation, data minimisation, automated decision-making/profiling, inference of sensitive data, and cross-border transfers.

Peru’s ANPD is a member of the Red Iberoamericana de Protección de Datos, (“Iberoamerican Data Protection Network”) – which approved recommendations for personal-data treatment in AI, published on the ANPD’s own portal — covering compliance with local rules, privacy-impact assessments before design, privacy-by-design, lawful data sourcing, proportionate security measures, and demonstrated accountability.

Domestically, the Regulations to Law No. 31814 (Reglamento de la Ley N.° 31814) (Article 26) require AI activity to comply with the data protection regime as determined by the ANPD, routing sanctions through Law No. 29733’s (Ley N.° 29733) own penalty regime, rather than a separate AI-specific one. No published ANPD sanctioning decision specifically targeting an AI system (as opposed to general data processing) exists at the time of this writing.

No Peru-specific court decision on scraping for AI training exist as of the time of this writing. Applicable frameworks by analogy:

• IP: the Copyright Law (Decreto Legislativo N.° 822) protects original works and databases (sui generis protection for substantial compiling investment); Peru has no general text-and-data-mining exception comparable to the EUs.
• Computer crimes: the (Ley N.° 30096, Ley de Delitos Informáticos) (Article 2) criminalises deliberate, illegitimate access to a computer system, with an aggravated penalty where technical security measures are bypassed — potentially relevant to scraping that circumvents access controls.
• Privacy: the Personal Data Protection Law (“Ley N.° 29733, Ley de Protección de Datos Personales”) treats collection of personal data as “processing” regardless of public availability.
• Unfair competition: Law Against Unfair Competition (“Decreto Legislativo N.° 1044, “) prohibits misappropriation of trade secrets obtained illegitimately, potentially relevant to scraping a competitor’s proprietary database.

No Peru-specific ruling exists. Under general (Código Civil) adhesion-contract principles (Articles 1390 et seq.), browsewrap/clickwrap terms can bind where there are adequate notice and genuine assent — weaker for an anonymous, unauthenticated scraping bot than for a registered user who affirmatively accepted the terms. Independently of Peruvian contract law, technical circumvention of access controls to scrape a site can trigger Computer Crimes Law liability (see Question 14), which applies regardless of the terms of use’s enforceability.

The PCM, through the SGTD, is the designated technical-regulatory authority, with powers to approve guidelines/standards, issue binding interpretive opinions, conduct preventive monitoring of high-risk/prohibited systems (via the CNSD), and report annually to Congress. Importantly, the SGTD has no independent sanctioning power — non-compliance is referred to whichever sectoral authority already has jurisdiction, principally INDECOPI (consumer protection, unfair competition, copyright), the ANPD (data protection), and the Contraloría General de la República (public official misconduct, that typically acts ex-post and with very long proceedings that rarely result in enforceable sanctions).

Peru ranks 7th of 19 countries in the 2025 Latin American AI Index. Surveys converge on 54-61% of Peruvian companies already using AI tools, with projected AI investment growth of 3.9x within total IT spend — the highest in Latin America. Financial services/banking, retail, telecommunications, manufacturing and government lead adoption; fintechs are the fastest adopters of generative AI in operational workflows.

Regarding VAS providers (Value-Added Services): registration of personal data banks with the RNPDP is triggered by holding/being the titular[owner] of a personal databank or database (“banco de datos personales” under  (Ley N.° 29733), article 29 — i.e., “the entity that organises data and determines processing purposes” (the controller). A VAS provider merely transmitting or relaying data for a third party, without compiling its own independent data set, functions as a processor rather than a controller and would not, on this reasoning, be required to register its own data bank. No ANPD guidance or ruling directly on point for VAS providers credible guidance at the time of this writing, so this should be treated as a reasoned interpretation, not settled authority.

Adoption is accelerating through homegrown legaltech: Juztina (Peru’s first major legal-AI platform, with a database exceeding three million documents), and newer entrants (DOXS.AI, Lexana) offering jurisprudence search, drafting assistance and judicial-notification automation. The Judiciary itself runs the CIVIL Electronic Judicial Case File (“Expediente Judicial Electrónico”) and a pilot AI project (IUDEX IA) in civil oral-hearing modules.  Criminal law cases are reserved and do not appear in databases created or managed by AI companies nor the Peruvian Government.

Corporate and transactional practices adopt AI fastest; litigation and criminal practice adopt it more cautiously because criminal matters under Peruvian law, as stated above, are reserved. Main regulatory concerns are client confidentiality when feeding case data into third-party AI tools, hallucination/citation-accuracy risk, and the professional-responsibility question of human review before AI-drafted work reaches a client or the courts. No INEI-specific statistics on legal-sector AI adoption exist nor have been published if they exist; available data comes from private surveys and legal tech providers.

Challenges

1. Regulatory fragmentation across AI law, data protection, consumer protection and sector rules, with no single consolidated code or enforcement authority.
2. Liability uncertainty, given the absence of an AI-specific statute and settled case law.
3. Confidentiality and privilege risk, with criminal law implications, in using third-party, often foreign-hosted, generative AI tools for case work.
4. An AI engineering training gap affecting the profession as much as the wider economy that is not ready for it.
5. Competitive pressure from low-cost legal tech democratising legal research and drafting available free of charge.

Opportunities

6. A new, fast-growing AI-governance and compliance advisory practice area. PCM should drop AI and create a highly specialized agency to deal with the critical aspects and challenges and opportunities AI presents. The Office of the Prime Minister is tasked with very important political decisions and should not be used as a dumpster for any matter, much less artificial intelligence.
7. Efficiency gains freeing lawyer time from non-billable administrative tasks.
8. First-mover regional advantage, given Peru’s early AI-regulation position in Latin America.
9. Access-to-justice expansion through AI-assisted legal-orientation platforms.
10. An institutional modernisation tailwind from the Judiciary’s own digitisation and AI pilots.

• Full operational bite of the Regulations to Law No. 31814, as phased transparency duties and monitoring obligations move from paper to practice.
• ENIA implementation deadlines and a possible strategy revision under the new Fujimori government.
• Possible institutional reform of AI governance. Peru has significant projections from gaining from AI. Peru itself is reputed from having World Class engineers who leave the country for splendid locations, like the UK.
• Likely first ANPD/INDECOPI enforcement actions naming AI specifically, given the absence of case law today. Peru is a Civil Law System based on Codes inherited from Roman Law. Thus, a spark, direct sanction regime against wrongdoers may work better than long lawsuits.
• Continued congressional activity on pending AI amendment bills, including a proposed high-risk systems registry. Peru can be an innovator in the first world in AI measured although necessary regulation. Right now, as developed above, it is an open system.  While laissez faire may be good for economics at certain times, AI is a high-complexity system that deserves, if not regulation, very careful observation.