Access Alert: Peru’s congress introduces bill to regulate AI

On 12 February, lawmakers from the Podemos Peru party set forth BoL 07033/2023 to establish a legal framework for AI use and regulation in the country. The goal is to safeguard citizens’ fundamental rights while fostering transparent, ethical, and pioneering advancements in Peru’s AI development.

Modelled on the European Union’s (EU) AI Act, the draft text establishes that AI development efforts must consider the principles of unrestricted respect for humans and fundamental rights, including the right to privacy and data protection.

Peru continues to stand out as one of the leading countries in Latin America in terms of Artificial Intelligence (AI) regulation and legislation. Notably, this new legislation follows the enactment of Law 31814 in July 2023 to foster the use of AI for the country’s economic and social development. Notwithstanding, the bill presents a more comprehensive vision for an AI regulatory framework.

The law at a glance

The bill contains nearly 30 provisions divided into nine sections. Key elements include:

• Scope: The law will apply to natural or legal persons who develop, research, innovate, or apply AI in Peruvian territory, no matter where they are physically located.
• Definitions: Key terms include AI-based systems, their life cycle, risk, and automated decisions, among others.
• Responsibility and accountability: Developers, providers, and users will be held responsible for decisions and actions related to the use of AI, including errors and proper use of AI systems. AI developers must document and disclose algorithms used in AI systems. More importantly, digital distribution platforms (e.g., app stores) enabling users to browse and download AI apps that fail to comply with the law and lack authorisation from the national enforcement authority could face administrative and criminal penalties.
• Risk classification: The draft bill categorises potential risks into four buckets: (1) unacceptable; (2) high risk; (3) limited risk; and (4) insignificant or minimal.
• Verification and certification: Before launching their AI systems, companies must undergo a verification and certification process to ensure their quality and safety.
• Prohibitions and restrictions: The bill prohibits various practices concerning the use of AI, including:
  • AI systems that manipulate or exert undue influence, including on electoral processes or public opinion.
  • Biometric categorisation systems that use sensitive characteristics.
  • Untargeted scraping of facial images from the internet or audiovisual recordings to create facial recognition databases.
  • Emotion recognition in the workplace and education.
• Enforcement authority: The Secretariat of Government and Digital Transformation – attached to the Presidency of the Council of Ministers – will serve as the enforcement and regulatory authority for AI systems.
• Sanctions: The bill includes a framework for fines but does not specify the amount or classification for such sanctions.
• Civil liability insurance: AI developers, providers, and users must have civil liability insurance in case of any damage caused using AI systems.
• Usage error reporting: The framework will establish a confidential mechanism to report usage errors of AI systems and enforce corresponding sanctions.

Moving forward, the bill has been referred to Congress’ Budget and Science, Technology, and Innovation (STI) Commissions for further analysis. It will likely undergo various modifications over the coming months before it passes into law.

Promoting regulation based on local context

Peru’s draft AI bill details a risk-based approach to AI regulation similar to the EU AI Act, including the same categorisation of potential risks and overlapping prohibitions on AI systems. This demonstrates the ‘Brussels effect’ that EU regulations have on global markets and regulatory policies around the world. Spillover effects of EU regulations on privacy and data protection – namely, GDPR – are already present in Latin America.

However, AI regulation in the region must be tailored to its unique socioeconomic, cultural, and political characteristics, rather than offering a simple import from regulatory frameworks in Europe or the United States. Peru and other Latin American countries must develop strategic approaches and legal frameworks that align with international standards while responding to local challenges and opportunities. By doing so, regional policymakers can ensure that AI technologies contribute positively to the region’s development while minimising potential risks.

It will be important to analyse how EU legislation on AI could potentially impact other national frameworks, particularly promoting secure, transparent, and human rights in the AI ecosystem. For its part, Peru has sought to promote an approach that privileges individuals and human rights.

Impact on companies

Companies that develop and deploy AI systems will need to ensure they have robust governance structures and management systems in place to mitigate risk.

Regulatory measures and initiatives that either target specific aspects of AI or advocate for its integration within distinct socioeconomic sectors are likely to emerge. Such developments could potentially stimulate investment in technologies such as cloud infrastructure and data centres within the country over the medium term.

If you would like to learn what risks and opportunities Peru’s new AI bill could present for your company, or more specific details on the proposed governance framework, please contact Rodrigo Serrallonga at [email protected]