AI LAW RADAR · Daily Last verified 31 Aug 2026

Jurisdiction dossier

El Salvador: AI regulation & deadlines

El Salvador has a comprehensive, AI-specific statute in force and an implementing regulation with binding duties, which makes it the second jurisdiction in the Americas after Peru to reach that state — and the only one on the tracker whose automated-decision rule lives entirely outside its data-protection law. The Ley de Fomento a Inteligencia Artificial y Tecnologías, Decreto Legislativo N.° 234 of 26 February 2025 (D.O. N.° 43, Tomo 446, 3 March 2025; in force 12 March 2025), is framed as a promotion statute: it creates the Agencia Nacional de Inteligencia Artificial (ANIA), guarantees free participation, and in art. 19 grants registered actors substantive safeguards — no liability for third-party misuse where reasonable efforts are shown, no liability for sandbox and research work, protection of open-domain data use against injunctions, and a bar on restrictive licence conditions over models, weights and outputs. Its one hard duty on the ordinary economy is art. 18, which requires anyone using AI commercially or for access to rights or services to disclose that the decision was taken or driven by AI, explain it, and provide a route to contest it before a competent natural person; compliance is the condition of enjoying the art. 19 safeguards. Decreto Legislativo N.° 363 of 16 July 2025 (D.O. N.° 134, Tomo 448, 18 July 2025) reformed only the institutional articles, converting ANIA into a decentralised body with its own legal personality, budget and Corte de Cuentas oversight. The operative detail is in ANIA Resolución N.° 0001/2025 (D.O. 25 August 2025, Tomo 448; in force 3 September 2025), which builds a registration regime around the concept of a Consequential Decision — AI acting as the controlling factor — in health, credit and insurance, public-space biometrics, public powers and government benefits, employment, and education and licensing. Operators in those six areas must register, run an algorithmic impact assessment (art. 15) and choose a compliance route (art. 16: annual self-certification, third-party certification for up to three years, or the supervised sandbox); ISO/IEC 42001, 23053, 23894 and 38507, the NIST AI RMF 1.0 and IEEE 7000, 7001 and 7010 create a rebuttable presumption of conformity. Art. 24 adds a notification duty owed by every entity, registered or not, for adverse automated decisions in seven areas, subject to a seven-item exemption list that expressly covers recommender systems and ad optimisation. Art. 29 gives systems that were already running before 3 September 2025 twelve months to comply with mandatory registration, which expires on 3 September 2026. The regime is unusually operator-friendly and carries no monetary penalty anywhere. Art. 28 confines ANIA to graduated action — guidance with at least sixty days to remediate, formal notice, compliance order, and referral only for serious and repeated violations — and art. 19 of the Resolución forbids ANIA from requiring source code, model architecture, weights or raw training data, or compelling third-party audits of them. General-purpose model, API and cloud providers are outside mandatory registration by art. 12 unless they themselves deploy. Alongside these sits the Ley de Tecnologías Robóticas, Decreto Legislativo N.° 340 of 3 July 2025 (D.O. 21 July 2025, in force 30 July 2025), also administered by ANIA; its art. 20 required ANIA to issue a minimum robotics regulatory framework within 180 business days of commencement, a period that has elapsed on any counting, and no such framework appears in the Centro de Documentación Judicial legislative corpus as of 31 August 2026, which on that date returned only three AI- or robotics-related fichas in total (D.L. 234, D.L. 340 and Resolución 0001/2025, all «Vigente»); control probes put the corpus index at 30 July 2026 or later, so that negative is firm through July 2026 and provisional for August. The Ley para la Protección de Datos Personales (D.L. N.° 144, D.O. 15 November 2024) contains no automated-decision article: its art. 12 opposition right covers profiling for commercial or direct-marketing purposes only, and its art. 57 fine bands (1–40 monthly commerce-sector minimum wages) are the only monetary exposure in the stack, reachable through art. 22 of the AI Law where personal data is involved. 3 obligations tracked — 2 in force. Next dated deadline: 3 Sep 2026.

Comprehensive — Comprehensive law Flagship law: Ley de Fomento a IA (D.L. 234/2025) + ANIA Resolución 0001/2025

El Salvador has a comprehensive, AI-specific statute in force and an implementing regulation with binding duties, which makes it the second jurisdiction in the Americas after Peru to reach that state — and the only one on the tracker whose automated-decision rule lives entirely outside its data-protection law. The Ley de Fomento a Inteligencia Artificial y Tecnologías, Decreto Legislativo N.° 234 of 26 February 2025 (D.O. N.° 43, Tomo 446, 3 March 2025; in force 12 March 2025), is framed as a promotion statute: it creates the Agencia Nacional de Inteligencia Artificial (ANIA), guarantees free participation, and in art. 19 grants registered actors substantive safeguards — no liability for third-party misuse where reasonable efforts are shown, no liability for sandbox and research work, protection of open-domain data use against injunctions, and a bar on restrictive licence conditions over models, weights and outputs. Its one hard duty on the ordinary economy is art. 18, which requires anyone using AI commercially or for access to rights or services to disclose that the decision was taken or driven by AI, explain it, and provide a route to contest it before a competent natural person; compliance is the condition of enjoying the art. 19 safeguards. Decreto Legislativo N.° 363 of 16 July 2025 (D.O. N.° 134, Tomo 448, 18 July 2025) reformed only the institutional articles, converting ANIA into a decentralised body with its own legal personality, budget and Corte de Cuentas oversight. The operative detail is in ANIA Resolución N.° 0001/2025 (D.O. 25 August 2025, Tomo 448; in force 3 September 2025), which builds a registration regime around the concept of a Consequential Decision — AI acting as the controlling factor — in health, credit and insurance, public-space biometrics, public powers and government benefits, employment, and education and licensing. Operators in those six areas must register, run an algorithmic impact assessment (art. 15) and choose a compliance route (art. 16: annual self-certification, third-party certification for up to three years, or the supervised sandbox); ISO/IEC 42001, 23053, 23894 and 38507, the NIST AI RMF 1.0 and IEEE 7000, 7001 and 7010 create a rebuttable presumption of conformity. Art. 24 adds a notification duty owed by every entity, registered or not, for adverse automated decisions in seven areas, subject to a seven-item exemption list that expressly covers recommender systems and ad optimisation. Art. 29 gives systems that were already running before 3 September 2025 twelve months to comply with mandatory registration, which expires on 3 September 2026. The regime is unusually operator-friendly and carries no monetary penalty anywhere. Art. 28 confines ANIA to graduated action — guidance with at least sixty days to remediate, formal notice, compliance order, and referral only for serious and repeated violations — and art. 19 of the Resolución forbids ANIA from requiring source code, model architecture, weights or raw training data, or compelling third-party audits of them. General-purpose model, API and cloud providers are outside mandatory registration by art. 12 unless they themselves deploy. Alongside these sits the Ley de Tecnologías Robóticas, Decreto Legislativo N.° 340 of 3 July 2025 (D.O. 21 July 2025, in force 30 July 2025), also administered by ANIA; its art. 20 required ANIA to issue a minimum robotics regulatory framework within 180 business days of commencement, a period that has elapsed on any counting, and no such framework appears in the Centro de Documentación Judicial legislative corpus as of 31 August 2026, which on that date returned only three AI- or robotics-related fichas in total (D.L. 234, D.L. 340 and Resolución 0001/2025, all «Vigente»); control probes put the corpus index at 30 July 2026 or later, so that negative is firm through July 2026 and provisional for August. The Ley para la Protección de Datos Personales (D.L. N.° 144, D.O. 15 November 2024) contains no automated-decision article: its art. 12 opposition right covers profiling for commercial or direct-marketing purposes only, and its art. 57 fine bands (1–40 monthly commerce-sector minimum wages) are the only monetary exposure in the stack, reachable through art. 22 of the AI Law where personal data is involved.

checked 31 Aug 2026 primary source ↗

Themes TransparencyHigh-risk AIHiringHealthcare

The Register

3 obligations
El Salvador Comprehensive

Ley de Fomento a Inteligencia Artificial y Tecnologías art. 18 — the ADM right sits in the AI statute, not in the data-protection law

Binds Any natural or legal person using AI commercially or to grant access to rights or services in El Salvador (art. 3 scope: development, research and application of AI, autonomous learning and generative models, and the collection, storage and processing of data for those activities). Anyone using AI commercially, or to give access to rights or services in El Salvador, must tell the user whether the decision was taken by the AI or driven by it, explain it comprehensibly, and provide a route to contest it before a competent natural person.

Decreto Legislativo N.° 234 of 26 February 2025, published in Diario Oficial N.° 43, Tomo 446, of 3 March 2025, reformed by Decreto Legislativo N.° 363 of 16 July 2025 (D.O. N.° 134, Tomo 448, 18 July 2025 — institutional only: ANIA becomes a decentralised body with its own budget). Art. 18 reads: «Cuando se utilice la IA comercialmente o para acceder a derechos o servicios dentro de la República, se estará en la obligación de informar al usuario de si la decisión fue adoptada directamente por la IA o fue impulsada por esta. La notificación de la decisión deberá contener las explicaciones comprensibles y transparentes del proceso para su adopción. Asimismo, deberán establecer mecanismos para impugnar dichas decisiones ante una persona natural competente para confirmar, modificar o revocar la misma.» Three things make this row unlike almost every other automated-decision rule in the atlas. First, the duty lives in an AI-promotion statute, not in the data-protection law: El Salvador's Ley para la Protección de Datos Personales (D.L. N.° 144, D.O. 15 November 2024) contains no GDPR art. 22 analogue at all — its only adjacent provision is the art. 12 right to oppose profiling for commercial or direct-marketing purposes — so art. 18 is the country's automated-decision rule. Second, there is no «solely» and no significant-effects threshold: the trigger is commercial use or access to rights or services, and it catches AI-driven as well as AI-taken decisions, which is wider than GDPR art. 22 on both limbs. Third, art. 18's own sanction is the loss of a benefit rather than a fine: its final sentence makes compliance «un requisito indispensable para gozar de las salvaguardas otorgadas por la presente Ley» — the art. 19 safeguards, which include the bar on liability for third-party misuse and the protection of open-domain training data. The Law creates no fine of its own; art. 8(a) has ANIA refer non-compliance to whichever regulator supervises the sector, and where personal data is involved art. 22 routes the matter to the Ley para la Protección de Datos Personales, whose art. 57 bands run from 1 to 40 monthly minimum wages of the commerce sector. Commencement chain, verified against the counting rule and not computed arithmetically: art. 29 of Decreto Legislativo N.° 234 reads «El presente decreto entrará en vigencia ocho días después de su publicación en el Diario Oficial», and art. 140 Cn. requires that «deberán transcurrir por lo menos ocho días después de su publicación», i.e. an elapsed term rather than a named day. Código Civil art. 46 makes every statutory plazo complete and runs it «hasta la medianoche del último día del plazo», and art. 47 provides that where a period must elapse for rights to arise, they «no nacen … sino después de la medianoche en que termine el último día». Publication 3 March 2025 therefore puts the eighth complete day at 11 March and force at 12 March 2025. The alternative reading, treating the clause as designating the eighth day itself, gives 11 March 2025; it is recorded here and does not change any duty.

Stated maximum penalty — No fine in the AI Law itself — breach forfeits the art. 19 safeguards; referral to the sector regulator (art. 8(a)), and via art. 22 the data-protection bands of 1–40 monthly commerce-sector minimum wages (LPDP art. 57)

In force · 12 Mar 2025 checked 31 Aug 2026 Ley de Fomento a IA art. 18 ↗ high confidence
El Salvador Comprehensive

ANIA Resolución 0001/2025 art. 24 — notification duty for adverse automated decisions, owed whether or not the entity is registered

Binds Any entity using an AI system to take decisions affecting people in El Salvador — expressly «independientemente de si la entidad está sujeta a registro». Where an AI system decides without meaningful human review and adversely affects a person's rights or economic situation in seven listed areas, the entity must notify them that AI was involved, explain its role and give them a way to challenge the decision.

Art. 24 of ANIA Resolución N.° 0001/2025 (D.O. 25 August 2025, Tomo 448) is the regulation-level counterpart of art. 18 of the Law and is deliberately wider in one respect: it binds every entity using AI to decide about people in El Salvador, registered or not. Notification is compulsory where the decision was taken by an AI system «sin una revisión humana significativa» and adversely affects the person's rights or economic situation in health and medical treatment; financial services including credit and insurance; employment opportunities; education services; government benefits and services; housing and accommodation; or transport and mobility — two areas, housing and transport, that the Law's own art. 18 does not name. The notice must be clear and comprehensible and must state at a minimum that an AI took part, explain the role it played, and give the person a mechanism to contest the decision; ANIA is to publish non-binding templates. Art. 25 carves out seven cases: fraud detection, prevention or investigation; cybersecurity and vulnerability assessment; law enforcement, regulatory compliance and national security support; circumvention of legitimate security controls; detection of terms-of-service violations, illegal content or harmful behaviour; content recommendation, search results and ad optimisation; and basic productivity features such as spelling and grammar assistance. Note the sixth: recommender and ad-ranking systems are exempt from notification here, which is the opposite of the direction the EU and several Latin American drafts have taken. Art. 26 is a deliberate non-obligation and is recorded so it is not misread as a right to human review: it lets ANIA issue sector guidance on designing meaningful human review «donde dicha revisión sea ofrecida o requerida por esta ley», and states that any service-level target or procedural recommendation is illustrative only and creates no duty under the Disposiciones. The enforceable route to a human is therefore the contest mechanism in art. 18 of the Law and in this article, not art. 26. Same commencement chain as the Law: art. 30 of the Resolución gives eight days after publication, publication was 25 August 2025, the eighth complete day is 2 September and force is 3 September 2025 (alternative reading 2 September 2025).

Stated maximum penalty — No fine — art. 28 escalation only; art. 18 of the Law additionally conditions the art. 19 safeguards on compliance

In force · 3 Sep 2025 checked 31 Aug 2026 ANIA Res. 0001/2025 art. 24 ↗ high confidence
El Salvador Comprehensive

ANIA Resolución 0001/2025 arts. 11–15 — mandatory registration and algorithmic impact assessment for consequential-decision AI; legacy systems must comply by 3 September 2026

Binds Operators (not developers, unless they deploy) whose AI system is the controlling factor in a consequential decision in health; finance and insurance; real-time biometrics in publicly accessible spaces; public powers or access to government services and benefits; employment; or education and professional licensing. Operators whose AI is the controlling factor in consequential decisions in six named sectors must register with ANIA, run an algorithmic impact assessment and pick a compliance route; systems already running when the rules took effect have twelve months, expiring 3 September 2026.

Resolución N.° 0001/2025 of the Agencia Nacional de Inteligencia Artificial, «Disposiciones relativas a la implementación de la Inteligencia Artificial y Tecnologías», published in the Diario Oficial of 25 August 2025, Tomo 448, issued under arts. 7, 8, 11, 16 and 17 of the Law. It is the implementing instrument the Law's art. 27 required within ninety days of commencement. Art. 11 splits registration in two: voluntary registration to obtain the art. 19 safeguards, and mandatory registration wherever an AI system meets the art. 4(e) definition of a Consequential Decision — the AI acting as «factor controlante», materially affecting a person's legal status, rights or access to essential goods, services or opportunities — in six deployments: primary diagnostic, treatment or emergency determinations in health; creditworthiness, loan approval or denial, and pricing and eligibility for credit or insurance products for natural persons; real-time or near-real-time biometric identification or categorisation in publicly accessible spaces (device unlocking excluded); the exercise of public powers or the grant, denial or revocation of government services or benefits; hiring, dismissal, promotion or compensation without meaningful human supervision; and admission, grading at scale, academic progression, or professional licensing and certification. The obligation falls on the operator; developers register only if they deploy. Foreign entities may register without incorporating locally by naming a Designated Representative. Art. 12 excludes general-purpose model, API and cloud providers as such, infrastructure and MLOps tooling, research and strictly personal use, the training phase where its outputs are not used to decide about individuals, and consumer productivity software with auxiliary AI features — but an excluded entity that later deploys for an art. 11 use must register before deployment. Art. 15 requires registered systems to run an algorithmic impact assessment covering risk identification, likelihood and severity, mitigation, monitoring and bias and fairness testing; art. 16 lets an operator demonstrate compliance by annual self-certification against ANIA-recognised standards, by third-party certification valid for up to three years, or by joining the supervised sandbox, which under art. 23 carries a twelve-month grace period from enforcement. Certification under ISO/IEC 42001, 23053, 23894 or 38507, the NIST AI RMF 1.0, or IEEE 7000, 7001 or 7010 raises a rebuttable presumption of conformity (arts. 21–22). The date on this row is the art. 29 transitional deadline, not the commencement date. The Disposiciones themselves took effect on 3 September 2025; art. 29 gives AI systems that were already operating lawfully before that date twelve months to meet the mandatory-registration requirements. Código Civil art. 46 ends a plazo of months on the same-numbered day, so the twelve months run out at midnight ending 3 September 2026; on the alternative commencement reading the deadline is 2 September 2026. Systems first deployed after 3 September 2025 have had no grace period at all. Same commencement chain as the Law: art. 30 of the Resolución gives eight days after publication, publication was 25 August 2025, the eighth complete day is 2 September and force is 3 September 2025 (alternative reading 2 September 2025). Enforcement carries no fine. Art. 28 makes ANIA proceed in steps — educational guidance with at least sixty days to remediate, then formal notice with technical assistance, then a compliance order with proportionate deadlines, and referral to other competent authorities only for serious and repeated violations — with emergency measures reserved for a clear and imminent risk of serious harm. Art. 19 forbids ANIA from demanding source code, model architecture, weights or raw training data. Re-polled 31 August 2026, three days before the art. 29 expiry, against the Centro de Documentación Judicial legislative corpus (jurisprudencia.gob.sv, baseDatos=2): no registry instrument, no art. 22 list of ANIA-recognised standards and no art. 24 notification templates have been gazetted, and no instrument extends, defers or amends the art. 29 transitional period. The corpus returns exactly three AI-related fichas — this Resolución, D.L. 340 «Ley de Tecnologías Robóticas» and D.L. 234 — under both «inteligencia artificial» and «Agencia Nacional de Inteligencia Artificial», all marked «Vigente». One caveat on the negative: control probes («reforma», «acuerdo ejecutivo») show the corpus indexed through at least 30 July 2026, so an instrument published in August 2026 may not yet be indexed; the absence is firm through July 2026 and provisional for August. The row therefore stands at «dateset» on 3 September 2026 and is to be re-examined immediately after that date — if the deadline passes with the regime live the row moves to «force» on the day it began to bite; if ANIA extends or defers it, the row moves with the instrument.

Stated maximum penalty — No fine — art. 28 escalation only (guidance with ≥60 days to remediate, formal notice, compliance order, referral to the competent sector authority for serious and repeated violations)

Applies 3 Sep 2026 checked 31 Aug 2026 ANIA Res. 0001/2025 arts. 11–15 ↗ high confidence

Questions & answers

From the data

When does Ley de Fomento a IA (D.L. 234/2025) + ANIA Resolución 0001/2025 take effect in El Salvador?

The next dated obligation under Ley de Fomento a IA (D.L. 234/2025) + ANIA Resolución 0001/2025 applies on September 3, 2026. 2 obligations are already in force.

Who must comply with AI rules in El Salvador?

Current obligations bind, among others, Any natural or legal person using AI commercially or to grant access to rights or services in El Salvador (art. 3 scope: development, research and application of AI, autonomous learning and generative models, and the collection, storage and processing of data for those activities); Operators (not developers, unless they deploy) whose AI system is the controlling factor in a consequential decision in health; finance and insurance; real-time biometrics in publicly accessible spaces; public powers or access to government services and benefits; employment; or education and professional licensing. Scope and thresholds vary per instrument — see each row's source for the legal text.

What are the penalties for AI non-compliance in El Salvador?

Stated statutory maxima include: Ley de Fomento a IA art. 18 — No fine in the AI Law itself — breach forfeits the art. 19 safeguards; referral to the sector regulator (art. 8(a)), and via art. 22 the data-protection bands of 1–40 monthly commerce-sector minimum wages (LPDP art. 57); ANIA Res. 0001/2025 arts. 11–15 — No fine — art. 28 escalation only (guidance with ≥60 days to remediate, formal notice, compliance order, referral to the competent sector authority for serious and repeated violations). These are the maximum amounts in the instruments; actual enforcement is at the regulator's discretion.

Not legal advice. Each obligation links to its primary source and carries the date it was last checked; verify the legal text before relying on it.

← All jurisdictions  ·  Back to the Radar