Summary
- Law 31814 (2023) is promotional: it declares AI development a national interest, sets six principles (including risk-based safety standards and privacy) and names PCM-SGTD as the national authority. It has no penalties of its own.
- The Regulation (DS 115-2025-PCM) adds the substance: 6 titles, 36 articles and 6 final provisions.
- Risk classes (Art. 22): prohibited "improper use", high risk, and acceptable risk (everything else).
- Prohibited uses (Art. 23) include manipulative or deceptive AI, lethal autonomous capability in civil settings, mass surveillance without legal basis, biometric inference of sensitive traits, real-time biometric categorisation in public spaces (with listed exceptions), and predicting crime from personality profiling.
- High-risk uses (Art. 24) include critical infrastructure, education assessments of minors, hiring and firing, social programme eligibility, credit scoring (fraud detection excepted), and health access or diagnosis.
- High-risk duties: prior transparency to users (Art. 25), impact assessment before development or deployment (Arts. 30 and 32), an up-to-date record of system logic and data sources, AI policies, staff awareness, and human oversight able to stop or override decisions (Art. 31).
Who it applies to
- Public entities, state companies, and private sector organisations, civil society, citizens and academia within the National Digital Transformation System (Reg. Art. 3).
- Exempt: purely personal use, and defence and national security uses that respect listed principles (Art. 4).
- Defines developer (designs, programs or trains) and implementer (integrates or deploys) (Art. 6).
- Not extraterritorial on its face; foreign vendors are caught when their systems are deployed by Peruvian entities.
Key dates
- Law 31814 signed by the President
- Law 31814 published in El Peruano
- Supreme Decree 115-2025-PCM signed, approving the Regulation
- Decree and Regulation published in El Peruano
- Year 1 deadline: private sector high-risk duties for health, education, justice, security, economy and finance; central government entities
Full date record
| Date | Event |
|---|---|
| 2023-07-05 | Law 31814 published |
| 2025-09-09 | Regulation published (DS 115-2025-PCM, signed 2025-09-08) |
| 90 business days after publication | Decree enters into force; Final Provisions 1, 2, 4 and 5 applied from the day after publication. Exact calendar date not stated in the source; our count gives about 2026-01-20 |
| 2026-09-09 | Year 1: private high-risk duties for health, education, justice, security, economy and finance |
| 2027-09-09 | Year 2: transport, commerce and labour sectors; small enterprises |
| 2028-09-09 | Year 3: production, agriculture, energy and mining; micro enterprises |
| 2029-09-09 | Year 4: all other private uses |
Penalties and enforcement
- No new fines. Personal data failures are sanctioned under Law 29733 (Art. 26.2).
- SGTD monitors prohibited and high-risk use (Arts. 23.2, 35), runs a citizen alert channel (Art. 36 and the gob.pe/iaperu digital channel), and refers suspected violations to the competent authorities (Art. 34.2).
- Developers and implementers can ask SGTD whether a system is prohibited or high risk (Arts. 23.3, 24.2).
What it means for an Indian company
- If you sell AI into Peru's banks, insurers, hospitals, schools or justice sector, your client's high-risk duties have applied since 2026-09-09. Expect requests for impact assessments, logic and data source records, and human override features.
- HR tech sold to Peruvian employers falls under the labour sector deadline (2027-09-09).
- Map to SC-AI-004 AI risk classification and use-case tiering, SC-AI-006 AI impact assessment (people and society), SC-AI-014 Model documentation (model cards, system cards), SC-AI-022 Disclose AI interaction to users and SC-AI-026 Human oversight and override.
- Public entities developing AI must use NTP-ISO/IEC 42001:2025, Peru's national adoption of ISO/IEC 42001 (Art. 28.2), and SGTD promotes international standards for everyone (Art. 33.1). An ISO/IEC 42001 programme is a strong selling point to Peruvian public buyers.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when Peru AI Law 31814 and Regulation is done.
Glossary
- PCM-SGTD: the Prime Minister's Office digital transformation secretariat, Peru's AI authority.
- Decreto Supremo: an executive regulation issued by the President and ministers.
- Uso indebido: "improper use", the Regulation's term for prohibited AI.
- Implementer (implementador): the organisation that deploys an AI system in its operations.
- MYPE: micro and small enterprises, which get longer deadlines.
- UIT: Peru's tax unit, used to set the small and micro enterprise thresholds.
Key takeaways
- Peru now has a binding, EU-like AI regime via the 2025 Regulation, with prohibited and high-risk categories.
- Private sector duties phase in by sector from 2026-09-09 to 2029-09-09; finance, health and education are already live.
- No AI-specific fines; enforcement leans on data protection law and referrals.
Official sources
- Decreto Supremo N.° 115-2025-PCM (gob.pe, PCM), accessed 2026-10-19
- DS 115-2025-PCM full text PDF (El Peruano edition, via gob.pe), accessed 2026-10-19
- El Peruano entry for the Decree, accessed 2026-10-19
- Ley N.° 31814 consolidated text (Congreso de la República), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.