top of page
Search

AI Compliance for Latin America and the Caribbean

  • Writer: F CQ
    F CQ
  • 1 day ago
  • 6 min read
AI Compliance for Latin America: What's Actually Required in 2026

AI compliance Latin America and the Caribbean

What's Actually Required in 2026


If you are deploying AI anywhere in Latin America right now, the honest answer to "what do we need to comply with" is: it depends which country, which sector, and which week you ask. AI compliance for Latin America is not a single rulebook the way the EU AI Act is for Europe. It is a patchwork of laws already in force, bills moving through legislatures at very different speeds, and existing privacy and labor rules that already apply to AI whether or not a country has passed an AI specific law yet.


This guide breaks down where the region actually stands, what is enforceable today regardless of pending legislation, and what a practical compliance starting point looks like for an organization operating across more than one country in the hemisphere.

A quick note before we go further: AI legislation in this region is moving fast, and bills can advance, stall, or change shape between when this is written and when you read it. Treat the country summaries below as a starting map, not a final legal opinion, and confirm current status with local counsel before making compliance decisions.


Why "wait for the law" is not a real strategy

A common assumption is that AI compliance can wait until a country passes a dedicated AI statute. That assumption does not hold up in Latin America for two reasons.

First, every major jurisdiction in the region already has a general data protection law, and most of those laws already give individuals rights around automated decision making, things like the right not to be subject to a decision based solely on automated processing when it carries a meaningful effect on someone's life. That means an AI system making credit, hiring, or eligibility decisions can already trigger legal obligations today, with no AI specific law required.


Second, AI used in employment contexts, recruitment screening, performance scoring, workplace monitoring, and termination decisions, is widely treated as high risk across the region, even in countries where a comprehensive AI law has not yet passed. Existing labor law, anti discrimination law, and data protection law already reach these uses.

In other words, the absence of an AI specific statute in a given country does not mean the absence of AI compliance obligations.


Country by country snapshot (2026)

This is a snapshot, not a static fact. Several of these bills are actively moving through legislative chambers and the status below can shift.


Country

Where things stand

What this means operationally

Peru

Has an AI law already in effect, with implementing regulations following, built around a three tier risk model: prohibited, high risk, and low risk uses.

The clearest, most mature framework in the region right now. Other countries are watching how Peru's implementation plays out.

Brazil

A comprehensive, risk based AI bill cleared the Senate in late 2024 and is under review in the Chamber of Deputies. The data protection authority is expected to act as lead AI regulator alongside sector regulators.

The most detailed framework in the region, closely modeled on the EU's risk tiers. Treat Brazil as the bellwether: if you can satisfy Brazil's emerging requirements, you are likely ahead of most of the region.

Chile

A government sponsored, risk based AI bill is moving through its first constitutional stage, building on a National AI Policy that dates back to 2021.

A maturing framework tied to Chile's forthcoming data protection authority. Documentation built for EU style requirements tends to translate reasonably well here once localized.

Mexico

No comprehensive AI law yet. A National AI Agenda was presented to the Senate, and several narrower bills are pending. The country's recent data protection update added an opt out right for automated decision making.

Compliance currently runs through existing data protection law and sector regulators (financial AI through one body, health AI through another) rather than a single AI statute.

Colombia

A draft AI bill inspired by the EU model is under review, including risk classifications and regulatory sandboxes.

Still developing. Existing data protection and consumer protection law already apply to AI deployed today.

Argentina

No formal AI law. The country has deliberately favored a lighter touch approach to encourage AI investment, though a data protection reform is in progress.

Lowest near term regulatory burden in the region, but this is actively under discussion and could shift.

Uruguay

No comprehensive AI law yet, but Uruguay became the first country in the region to sign the Council of Europe's binding framework treaty on AI and human rights in 2025.

A signal that Uruguay's eventual framework will likely align closely with European style obligations.


Argentina, Brazil, Chile, Colombia, Costa Rica, Mexico, and Peru have also all formally adopted the OECD's AI Principles, which gives the region a shared baseline even where national legislation has not caught up yet.


What this means if you operate in more than one country

The practical problem for any multi country operator is that a compliance posture built for one jurisdiction does not automatically satisfy another. Documentation that works for Brazil's emerging risk tiers will not necessarily satisfy Mexico's sector specific regulators, and a system that is low risk under Peru's three tier model might still trigger automated decision making rights under Colombia's data protection law.


This is the gap a single, regionally aware compliance framework is meant to close, rather than rebuilding your AI governance documentation from scratch in every market you enter.


A practical starting checklist

Regardless of which countries you operate in, these steps hold up across the region:


  1. Inventory your AI systems. You cannot assess risk on something you have not catalogued. List every AI system in production or development, what it does, and what data it touches.

  2. Classify by risk, not by country. Map each system against a simple high, medium, low framework based on what happens if it gets the decision wrong, who it affects, and whether the decision is fully automated. Most regional frameworks converge on some version of this structure.

  3. Check for automated decision making triggers. If a system makes or materially influences a decision about credit, employment, insurance, or access to a service without meaningful human review, assume regional data protection rights apply today, even without an AI specific law.

  4. Treat employment AI as high risk by default. Recruitment screening, performance scoring, and monitoring tools draw labor law and anti discrimination scrutiny across the region regardless of a country's AI legislative status.

  5. Document human oversight. Every framework in the region, passed or pending, places weight on whether a human can meaningfully review and override an automated outcome. Build that oversight in, and document it.

  6. Localize, don't just translate. A risk assessment built for the EU AI Act needs to be adapted to local definitions and triggers, not simply translated into Spanish or Portuguese.

  7. Revisit quarterly. Given how quickly bills are moving in Brazil, Chile, Mexico, and Colombia, a compliance posture that was current six months ago may already be out of date.


How RaceFor.AI approaches this

This is the exact gap RaceFor.AI was built to close. Rather than treating each country as a separate compliance project, our regulatory work maps AI governance requirements across the hemisphere into a single operating framework, so a system that is compliant in one market does not have to be rebuilt from zero in the next one. Our policy work also includes direct engagement on regional AI development through formal channels in the U.S. Congress, which keeps our compliance guidance grounded in where the policy conversation is actually heading, not just where it stands today.


If your organization is scaling AI across more than one country in the Americas, this is exactly the kind of fragmentation the AI Corridor of the Americas is designed to remove. Get in touch to talk through where your current systems stand.


Frequently asked questions

Is there a single AI law that covers all of Latin America? No. There is no regional equivalent to the EU AI Act. Each country is legislating separately, at different speeds, though most proposals share a similar risk based structure influenced by the EU model.

Which country has the most advanced AI regulation right now? Peru is the only country with a dedicated AI law already in force, including implementing regulations. Brazil has the most detailed pending framework, having cleared its Senate, with Chile close behind.


Do I need to wait for a country to pass an AI law before worrying about compliance? No. Every major jurisdiction in the region already has data protection law that applies to automated decision making, and labor and consumer protection law already reach many AI use cases today.


What AI use case draws the most regulatory attention across the region? Employment related AI, recruitment screening, performance scoring, and workplace monitoring, is treated as high risk in most current and pending frameworks, even where no comprehensive AI law exists yet.


How often does this picture change? Frequently. Several of the bills referenced above are actively moving through committee or chamber votes. Confirm current status before relying on any country summary, including this one.


This article is for general informational purposes and reflects the regulatory landscape as understood at the time of writing. It is not legal advice. Consult qualified local counsel before making compliance decisions for your organization.

 
 
 

Comments


bottom of page