El SalvadorLey de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos
Decreto Legislativo No. 234, arts. 7, 16, 17 y 27
In force.
An AI governance rule binding public and private bodies.
- Enforcement body
- Agencia Nacional de Inteligencia Artificial (ANIA)
- Obligation class
- Governance, Licensing, DPIA
- Audit expectation
- none
What it requires
- If your AI system handles data classified as confidential, reserved or personal, comply with the risk-evaluation framework the Agencia Nacional de Inteligencia Artificial (ANIA) sets.
- Register in the Registro Nacional de Desarrollo, Innovación y Aplicación de IA to obtain this law's safeguards for open-domain-data use, good-faith research and sandbox activity, and non-restrictive AI-model licensing.
- When you use personal data to develop, research or apply AI, comply with the Ley para la Protección de Datos Personales, under ANIA and ACE supervision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- NIST AI 200-2 Draft
- 2.4Synthesize & Interrogate
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
Articles 7, 16, 17, and 27 create ANIA, define the national AI registry's enrollment classes, delegate a risk-evaluation framework to ANIA, and set ANIA's own deadline to issue technical criteria; none states a duty for a registered subject to itself create, keep, or produce a log or record of its AI system's operation. 'Registro' in these articles names the national enrollment register a subject signs up in, not an operational log.
- Kind
- None
- As of
What this law does
Article 3 applies the law to any natural or legal person, regardless of nationality, autonomy or form of incorporation, that develops or provides services relating to the development, research or application of AI or similar technologies in El Salvador.
Article 7 creates the Agencia Nacional de Inteligencia Artificial (ANIA), an autonomous institution attached to the Presidency, and article 16 conditions the safeguards of article 19 (protection from injunctions against open-domain-data uses, liability limits for good-faith research and sandbox activity, and non-restrictive licensing for AI models) on registering in the Registro Nacional de Desarrollo, Innovación y Aplicación de IA.
Article 17 requires ANIA to set a comprehensive risk-evaluation framework, but makes compliance mandatory only for systems that handle data classified as confidential, reserved or personal. Article 27 required ANIA to issue the technical security criteria and the registration procedure within ninety days of the law's entry into force.
Article 22 requires that any use of personal data in AI development, research or application follow the Ley para la Protección de Datos Personales, under ANIA and ACE supervision. Article 29 brings the decree into force eight days after its publication in the Diario Oficial. Resolución 0001/2025 records that publication in Diario Oficial number 43, Tomo 446, of , and no source stating the resulting day of entry into force has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .