Peru reached the first private-sector implementation milestone under Supreme Decree No. 115-2025-PCM, which approved the Regulation of Law No. 31814. The First Final Complementary Provision gives private developers and implementers one year, counted from the day after publication, to implement Article 25 and Chapter II of Title VI for AI uses in health, education, justice, security, economy and finance.

Relevant obligations include algorithmic-transparency mechanisms for high-risk AI, an updated and accessible register for high-risk systems, policies and procedures addressing security, privacy, transparency, explainability and accountability, internal awareness, and human oversight for specified high-impact decisions. High-risk impact assessment under Article 32 is voluntary for private entities.

Separate two- and three-year schedules apply to qualifying small and micro enterprises.

Impact

Impact assessment: High.

Key reasons: the one-year implementation period has elapsed for the first group of private-sector AI uses, making the staged obligations operational for covered non-MYPE developers and implementers.

Who is affected?

Private organizations developing or implementing AI in health, education, justice, security, economy and finance, subject to the Regulation's scope and risk rules.

Conclusion:

covered organizations should confirm system inventories, risk classification, Article 25 transparency, high-risk registers, governance policies, staff awareness and applicable human-oversight controls, while correctly applying special MYPE timelines.