PeruReglamento de la Ley 31814, high-risk AI system duties
In force since .
An AI risk obligations rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Disclosure, Governance
- Audit expectation
- none
What it requires
- Before a high-risk AI system interacts with a user, tell them, clearly and simply, its purpose or use, its main functions, and the kind of decisions it can make.NIST AI RMFMEASURE 2.8
- Where a high-risk AI system's decision affects a person's human rights, explain the result to the affected user in accessible language, covering the criteria and factors the decision relied on.NIST AI RMFMEASURE 2.9
- Ask the Secretaría de Gobierno y Transformación Digital for a determination if you are unsure whether your system's use falls within the high-risk category.
- A private-sector developer or implementer's transparency duty applies by sector, counted from the day after the Decreto Supremo's publication: one year for health, education, justice, security, and economy-finance; two years for transport, commerce, and labor; three years for production, agriculture, energy, and mining; and four years for every other use, with its own two-year and three-year schedule for small businesses and microenterprises.
- A breach of the personal-data and privacy rules that apply to a high-risk system is sanctioned under Ley 29733's own regime, not under this Decreto Supremo.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Enforcement body
Secretaría de Gobierno y Transformación Digital (SGTD); a breach of the personal-data rules a high-risk system must follow is instead enforced by the Autoridad Nacional de Protección de Datos Personales under Ley 29733
What it makes you log
Logging duty
Article 24 classifies high-risk use and article 25 requires informing the user beforehand of the system's purpose and functions, and explaining a rights-affecting result afterward; neither states a duty to create, keep, or produce a log or record of that information or explanation. The record-keeping duty for a high-risk AI system, an updated and accessible register on the system's operating principles, data sources, and algorithm logic, is article 31.1 of the same Decreto Supremo (Título VI, Capítulo II), not articles 24-25.
- Kind
- None
- As of
What this law does
Article 24 classifies an AI-based system's use as high-risk where, among other criteria, it manages critical national assets supporting essential services (energy, telecommunications, health, transport, water, and banking, among others) or is used to evaluate a person in a selection process. A developer or implementer may ask the SGTD to determine whether a use falls within the high-risk category.
Article 25 requires the developer or implementer of a high-risk system to establish mechanisms guaranteeing algorithmic transparency, informing the user beforehand, clearly and simply, of the system's purpose or use, its main functions, and the kind of decisions it can make, and, where the system's decisions affect human rights, to explain its results to affected users in accessible language.
For a private-sector developer or implementer, article 25's transparency duty and a related Title VI chapter phase in gradually by sector, starting the day after the Decreto Supremo's publication: one year for AI uses in health, education, justice, security, and economy-finance; two years for transport, commerce, and labor; three years for production, agriculture, energy, and mining; and four years for every other use nationwide, with a further, longer schedule for small businesses and innovative start-ups.
Public-sector entities implement article 25 on their own graduated schedule, running from one to three years after the Decreto Supremo's publication depending on the type of entity; only for the smallest local governments (Tipo D, E, F, and G) is implementing article 25 described as facultative, according to their resources and capacities.
Article 26 requires compliance with the personal-data and privacy rules in force for any high-risk system's development, implementation, or use, and states that liability for a breach of those data-protection duties is determined under Ley No. 29733's own sanctioning regime rather than under this Decreto Supremo.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .