El SalvadorResolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales
Resolución No. 0001/2025, ANIA, art. 11
In force.
An AI risk obligations rule binding public and private bodies.
- Enforcement body
- Agencia Nacional de Inteligencia Artificial (ANIA)
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Place of effect
- Obligation class
- Governance, Biometric, DPIA
- Audit expectation
- none
What it requires
- If your AI system is the controlling factor in a decision that materially affects a person's legal status, rights, or access to essential goods, services or opportunities, and it operates in a registrable sector (primary health diagnosis or treatment, creditworthiness or insurance and loan decisions, real-time biometric identification in public spaces, the exercise of government authority or public benefits, unsupervised hiring or compensation decisions, or academic admission or grading), register with ANIA.
- You may demonstrate compliance through self-certification, third-party certification, or ANIA's supervised sandbox.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
Article 11 classifies registration as voluntary or mandatory and lists the sectors that trigger mandatory registration; it states no duty of its own to create, keep, or produce a record. The register's actual documentation and access apparatus sits elsewhere in the same Resolución, outside article 11: article 13 lists what a registration application must contain, article 15 requires documenting sector-appropriate mitigation measures as part of a mandatory algorithmic impact assessment, article 19 limits ANIA to specified categories of compliance evidence it may demand, and article 28 gives ANIA a document-review, remote-audit, or on-site-visit compliance-verification power.
- Kind
- None
- As of
What this law does
Article 4(e) defines a 'Decisión Consecuencial' as one where an AI system, as the controlling factor, materially affects a person's legal status, rights, or access to essential goods, services or opportunities, and Article 11 requires an operator to register with ANIA when its AI system meets that test and is deployed in specified sectors, including primary health diagnosis or treatment, creditworthiness or loan and insurance approval, real-time biometric identification in public spaces, the exercise of government authority or the grant or denial of public benefits, unsupervised hiring or compensation decisions, and academic admission or grading.
Article 23 offers a supervised twelve-month sandbox with a sanctions grace period, and articles 21 and 22 recognize ISO/IEC, National Institute of Standards and Technology (NIST) and IEEE standards as creating a rebuttable presumption of conformity. Article 30 provides the disposition takes effect eight days after publication in the Diario Oficial, and no official source stating the day it came into force has been located.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .