In Peru, the use of artificial intelligence is governed by Law No. 31814, which promotes AI for economic and social development, and by its regulation, Supreme Decree No. 115-2025-PCM, published in the official gazette El Peruano on 9 September 2025. The regulation classifies AI systems by risk level and sets staggered compliance deadlines by sector. This article summarises what a company using AI agents in Peru should keep in mind.
This is general information, not legal advice. For your specific case, check the official text and consult your adviser.
Which rules apply today
- Law No. 31814: a general framework that promotes AI with principles such as transparency, human oversight, data protection and non-discrimination.
- Regulation (Supreme Decree 115-2025-PCM): develops those principles, classifies uses by risk and sets obligations and deadlines.
- Personal Data Protection Law No. 29733 and its regulation: apply whenever the agent processes personal data.
The Presidency of the Council of Ministers, through its Digital Government and Transformation Secretariat, is the technical and regulatory authority.
How the regulation classifies risk
- Improper use: uses that are prohibited because they violate fundamental rights.
- High risk: uses that may affect life, dignity, freedom, physical safety or other fundamental rights. According to published analyses, this includes uses such as staff selection and evaluation.
- Acceptable risk: all other uses, like most customer service or back-office agents, which must still respect the law’s principles.
Deadlines for the private sector
Compliance is gradual and counted from the regulation’s publication. According to El Peruano, the health, education, justice, security, and economy and finance sectors had one year, a deadline that passed in September 2026; other sectors have successive deadlines of up to four years.
Practical obligations for companies using AI agents
- Transparency: tell people when they are interacting with an AI system and explain, in essence, how it is used.
- Human oversight: in high-risk uses, a person must be able to review and correct decisions.
- Assessment and records: identify which AI systems the company uses, assess their risk and document it.
- Personal data: a legal basis for processing, data minimisation and security measures under Law 29733.
Checklist for an AI agent project
- Inventory: which agents you use, for what and with which data.
- Risk classification of each use.
- A visible notice that the user is talking to an AI.
- Human approval for decisions that affect people.
- Action logs and record retention.
- Security controls (see 8 controls for AI agents).
How we apply it in our projects
We design every agent with an AI notice, least-privilege access, action logs and hand-over to a person in sensitive cases, so compliance is part of the design rather than a patch. See our AI agent development service or chat with our agent and try it.
Sources (in Spanish): Supreme Decree No. 115-2025-PCM (gob.pe) and El Peruano: obligations already enforceable in priority sectors.