LexLint.ioBeta

Know the law your code answers to.

Law / Peru

Reglamento de la Ley 31814, prohibited AI uses

Decreto Supremo 115-2025-PCM, arts. 22-23 (Reglamento de la Ley 31814, Clasificación de Riesgos: Uso Indebido)

In force since .

An AI prohibited practices rule binding public and private bodies.

Criminal exposure
No
Private right of action
No
Obligation class
Prohibition, Biometric
Audit expectation
continuous
Who audits it
Regulator

What it requires

  • Do not use an AI-based system to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter their behavior.
  • Do not deploy an autonomous lethal capability that decides without human supervision and can cause physical harm or affect life or physical integrity in a civilian setting.
  • Do not carry out mass surveillance using an AI-based system without a legal basis, or in a way that generates or may generate a disproportionate impact on fundamental rights.
  • Do not analyze, classify, or infer a person's racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation from their biometric data using an AI-based system, and do not evaluate or classify people in a way that produces discriminatory or disproportionate results violating fundamental rights.
  • Do not carry out real-time biometric identification to categorize people in public spaces, except for pure digital-identity authentication or the preliminary investigation of a defined list of serious crimes.
  • Do not use an AI-based system to predict that a person will commit a crime based on profiling or an assessment of their personality traits.
  • A system that supports a human evaluator's assessment of a person's involvement in an existing, verifiable criminal activity is not itself misuse under the real-time biometric identification prohibition, provided it carries human-oversight, transparency, and auditability mechanisms guaranteeing non-discrimination.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
NIST AI 600-1
MIT mitigations Draft
  • 1.5Safety Decision Frameworks
  • 3.3Access Management
NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
  • 5.1.4-5End-users told which uses of the system are prohibited.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

Who enforces it

Enforcement body

Secretaría de Gobierno y Transformación Digital (SGTD), which refers a suspected violation of intellectual-property, personal-data, or other fundamental rights to the competent supervisory or prosecuting authority

What it makes you log

Logging duty

Article 23.4's exception for a system that supports a human evaluator's assessment of a person's involvement in an existing criminal activity requires the system carry human-oversight, transparency, and auditability mechanisms; the clause never uses the words log or record, but a system cannot be shown to be auditable without something to audit, so the duty is implicit. The clause names no content list, no retention period, and no accessor of its own. A genuine record-keeping register for a high-risk AI system, an updated and accessible register on the system's operating principles, data sources, and algorithm logic, is article 31.1 of the same Decreto Supremo (Título VI), not articles 22-23, and the compliance-verification power sits at article 28.

Kind
Implicit
As of
Provision
Decreto Supremo 115-2025-PCM, art. 23.4
Trigger
automated_decisions

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 22 classifies AI risk into two named categories, uso indebido (misuse, deemed prohibited by definition) and high-risk use, and treats every other use as acceptable risk. Article 23 deems it misuse to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter behavior.

It is also misuse to generate an autonomous lethal capability that decides without human supervision and can cause physical harm or affect life or physical integrity in a civilian setting. Carrying out mass surveillance without a legal basis or where it generates or may generate a disproportionate impact on the exercise of fundamental rights is misuse as well.

So is analyzing, classifying, or inferring a person's sensitive data from their biometric data to deduce racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation, or evaluating or classifying natural persons or groups in a way that produces discriminatory or disproportionate results violating fundamental rights.

Carrying out real-time biometric identification to categorize natural persons in public spaces is misuse too, except for pure digital-identity authentication or the preliminary investigation of a defined list of serious crimes. Predicting that a natural person will commit a crime based on profiling or an assessment of personality traits is likewise misuse.

Article 23.4 excepts, specifically from the real-time biometric identification prohibition, a system that supports a human evaluator's assessment of a person's involvement in an existing criminal activity, provided the assessment rests on objective, verifiable facts and the system carries human-oversight, transparency, and auditability mechanisms guaranteeing non-discrimination.

The Regulation applies to public-administration entities and to private-sector organizations, civil society, citizens, and academia, and enters into force ninety business days after its publication. It creates no sanctioning regime of its own for a breach of these prohibitions distinct from referring suspected violations to the competent authority.

When LexLint raises it

When your app profile says your app processes biometric data or makes high-risk automated decisions.

Back to the example  ·  Lint your app

Page updated .