El Salvador
●Comprehensive
Binds Any natural or legal person using AI commercially or to grant access to rights or services in El Salvador (art. 3 scope: development, research and application of AI, autonomous learning and generative models, and the collection, storage and processing of data for those activities). Anyone using AI commercially, or to give access to rights or services in El Salvador, must tell the user whether the decision was taken by the AI or driven by it, explain it comprehensibly, and provide a route to contest it before a competent natural person.
Decreto Legislativo N.° 234 of 26 February 2025, published in Diario Oficial N.° 43, Tomo 446, of 3 March 2025, reformed by Decreto Legislativo N.° 363 of 16 July 2025 (D.O. N.° 134, Tomo 448, 18 July 2025 — institutional only: ANIA becomes a decentralised body with its own budget). Art. 18 reads: «Cuando se utilice la IA comercialmente o para acceder a derechos o servicios dentro de la República, se estará en la obligación de informar al usuario de si la decisión fue adoptada directamente por la IA o fue impulsada por esta. La notificación de la decisión deberá contener las explicaciones comprensibles y transparentes del proceso para su adopción. Asimismo, deberán establecer mecanismos para impugnar dichas decisiones ante una persona natural competente para confirmar, modificar o revocar la misma.»
Three things make this row unlike almost every other automated-decision rule in the atlas. First, the duty lives in an AI-promotion statute, not in the data-protection law: El Salvador's Ley para la Protección de Datos Personales (D.L. N.° 144, D.O. 15 November 2024) contains no GDPR art. 22 analogue at all — its only adjacent provision is the art. 12 right to oppose profiling for commercial or direct-marketing purposes — so art. 18 is the country's automated-decision rule. Second, there is no «solely» and no significant-effects threshold: the trigger is commercial use or access to rights or services, and it catches AI-driven as well as AI-taken decisions, which is wider than GDPR art. 22 on both limbs. Third, art. 18's own sanction is the loss of a benefit rather than a fine: its final sentence makes compliance «un requisito indispensable para gozar de las salvaguardas otorgadas por la presente Ley» — the art. 19 safeguards, which include the bar on liability for third-party misuse and the protection of open-domain training data. The Law creates no fine of its own; art. 8(a) has ANIA refer non-compliance to whichever regulator supervises the sector, and where personal data is involved art. 22 routes the matter to the Ley para la Protección de Datos Personales, whose art. 57 bands run from 1 to 40 monthly minimum wages of the commerce sector.
Commencement chain, verified against the counting rule and not computed arithmetically: art. 29 of Decreto Legislativo N.° 234 reads «El presente decreto entrará en vigencia ocho días después de su publicación en el Diario Oficial», and art. 140 Cn. requires that «deberán transcurrir por lo menos ocho días después de su publicación», i.e. an elapsed term rather than a named day. Código Civil art. 46 makes every statutory plazo complete and runs it «hasta la medianoche del último día del plazo», and art. 47 provides that where a period must elapse for rights to arise, they «no nacen … sino después de la medianoche en que termine el último día». Publication 3 March 2025 therefore puts the eighth complete day at 11 March and force at 12 March 2025. The alternative reading, treating the clause as designating the eighth day itself, gives 11 March 2025; it is recorded here and does not change any duty.
Stated maximum penalty — No fine in the AI Law itself — breach forfeits the art. 19 safeguards; referral to the sector regulator (art. 8(a)), and via art. 22 the data-protection bands of 1–40 monthly commerce-sector minimum wages (LPDP art. 57)
El Salvador
●Comprehensive
Binds Any entity using an AI system to take decisions affecting people in El Salvador — expressly «independientemente de si la entidad está sujeta a registro». Where an AI system decides without meaningful human review and adversely affects a person's rights or economic situation in seven listed areas, the entity must notify them that AI was involved, explain its role and give them a way to challenge the decision.
Art. 24 of ANIA Resolución N.° 0001/2025 (D.O. 25 August 2025, Tomo 448, N.° 158, pp. 59–73, Registro No. F34829) is the regulation-level counterpart of art. 18 of the Law and is deliberately wider in one respect: it binds every entity using AI to decide about people in El Salvador, registered or not. Notification is compulsory where the decision was taken by an AI system «sin una revisión humana significativa» and adversely affects the person's rights or economic situation in health and medical treatment; financial services including credit and insurance; employment opportunities; education services; government benefits and services; housing and accommodation; or transport and mobility — two areas, housing and transport, that the Law's own art. 18 does not name. The notice must be clear and comprehensible and must state at a minimum that an AI took part, explain the role it played, and give the person a mechanism to contest the decision; ANIA is to publish non-binding templates.
Art. 25 carves out seven cases: fraud detection, prevention or investigation; cybersecurity and vulnerability assessment; law enforcement, regulatory compliance and national security support; circumvention of legitimate security controls; detection of terms-of-service violations, illegal content or harmful behaviour; content recommendation, search results and ad optimisation; and basic productivity features such as spelling and grammar assistance. Note the sixth: recommender and ad-ranking systems are exempt from notification here, which is the opposite of the direction the EU and several Latin American drafts have taken.
Art. 26 is a deliberate non-obligation and is recorded so it is not misread as a right to human review: it lets ANIA issue sector guidance on designing meaningful human review «donde dicha revisión sea ofrecida o requerida por esta ley», and states that any service-level target or procedural recommendation is illustrative only and creates no duty under the Disposiciones. The enforceable route to a human is therefore the contest mechanism in art. 18 of the Law and in this article, not art. 26. Same commencement chain as the Law: art. 30 of the Resolución gives eight days after publication, publication was 25 August 2025, the eighth complete day is 2 September and force is 3 September 2025 (alternative reading 2 September 2025).
Stated maximum penalty — No fine — art. 28 escalation only; art. 18 of the Law additionally conditions the art. 19 safeguards on compliance
El Salvador
●Comprehensive
Binds Operators (not developers, unless they deploy) whose AI system is the controlling factor in a consequential decision in health; finance and insurance; real-time biometrics in publicly accessible spaces; public powers or access to government services and benefits; employment; or education and professional licensing. Operators whose AI is the controlling factor in consequential decisions in six named sectors must register with ANIA, run an algorithmic impact assessment and pick a compliance route; systems already running when the rules took effect have twelve months, expiring 3 September 2026.
Resolución N.° 0001/2025 of the Agencia Nacional de Inteligencia Artificial, «Disposiciones relativas a la implementación de la Inteligencia Artificial y Tecnologías», published in the Diario Oficial of 25 August 2025, Tomo 448, N.° 158, at pp. 59–73 (Registro No. F34829), issued under arts. 7, 8, 11, 16 and 17 of the Law. It is the implementing instrument the Law's art. 27 required within ninety days of commencement.
Art. 11 splits registration in two: voluntary registration to obtain the art. 19 safeguards, and mandatory registration wherever an AI system meets the art. 4(e) definition of a Consequential Decision — the AI acting as «factor controlante», materially affecting a person's legal status, rights or access to essential goods, services or opportunities — in six deployments: primary diagnostic, treatment or emergency determinations in health; creditworthiness, loan approval or denial, and pricing and eligibility for credit or insurance products for natural persons; real-time or near-real-time biometric identification or categorisation in publicly accessible spaces (device unlocking excluded); the exercise of public powers or the grant, denial or revocation of government services or benefits; hiring, dismissal, promotion or compensation without meaningful human supervision; and admission, grading at scale, academic progression, or professional licensing and certification. The obligation falls on the operator; developers register only if they deploy. Foreign entities may register without incorporating locally by naming a Designated Representative.
Art. 12 excludes general-purpose model, API and cloud providers as such, infrastructure and MLOps tooling, research and strictly personal use, the training phase where its outputs are not used to decide about individuals, and consumer productivity software with auxiliary AI features — but an excluded entity that later deploys for an art. 11 use must register before deployment. Art. 15 requires registered systems to run an algorithmic impact assessment covering risk identification, likelihood and severity, mitigation, monitoring and bias and fairness testing; art. 16 lets an operator demonstrate compliance by annual self-certification against ANIA-recognised standards, by third-party certification valid for up to three years, or by joining the supervised sandbox, which under art. 23 carries a twelve-month grace period from enforcement. Certification under ISO/IEC 42001, 23053, 23894 or 38507, the NIST AI RMF 1.0, or IEEE 7000, 7001 or 7010 raises a rebuttable presumption of conformity (arts. 21–22).
The date on this row is the art. 29 transitional deadline, not the commencement date. The Disposiciones themselves took effect on 3 September 2025; art. 29 gives AI systems that were already operating lawfully before that date twelve months to meet the mandatory-registration requirements. Código Civil art. 46 ends a plazo of months on the same-numbered day, so the twelve months run out at midnight ending 3 September 2026; on the alternative commencement reading the deadline is 2 September 2026. Systems first deployed after 3 September 2025 have had no grace period at all. Same commencement chain as the Law: art. 30 of the Resolución gives eight days after publication, publication was 25 August 2025, the eighth complete day is 2 September and force is 3 September 2025 (alternative reading 2 September 2025).
Enforcement carries no fine. Art. 28 makes ANIA proceed in steps — educational guidance with at least sixty days to remediate, then formal notice with technical assistance, then a compliance order with proportionate deadlines, and referral to other competent authorities only for serious and repeated violations — with emergency measures reserved for a clear and imminent risk of serious harm. Art. 19 forbids ANIA from demanding source code, model architecture, weights or raw training data.
Re-polled 3 September 2026, the art. 29 expiry day itself, twice: against the Centro de Documentación Judicial legislative corpus (jurisprudencia.gob.sv) and, independently, against the Diario Oficial itself via the Imprenta Nacional download API (POST https://www.diariooficial.gob.sv/api/v1/diarios-disponibles, form fields year and month; issues fetched at https://www.diariooficial.gob.sv/seleccion/{Id}). No instrument extends, defers, suspends or amends the art. 29 transitional period.
The gazette sweep is the firmer of the two. Every Diario Oficial issue from 12 to 21 August 2026 was downloaded and read in full — eight issues, 1,240 pages, 5.86 million characters of extracted text — and contains no occurrence of «inteligencia artificial», «ANIA», «robótica» or «algoritm-» anywhere, in either the sumario or the body; the only hits for «automatizad-» are land-registry «folio real automatizado» boilerplate. Extraction was validated against controls («diario oficial» 253–516 hits per issue, «decreto», «ministerio», «órgano ejecutivo» all present; a nonsense control string returns zero), so the negative is a real absence and not a silent extraction failure. This firms the previous CDJ-corpus negative, which was indexed only through 11 August 2026, forward to 21 August 2026 and narrows the provisional window from twenty-three days to thirteen.
That window was closed only in part, and the ceiling that appeared to block it has since moved. Re-polled 6 September 2026: the Diario Oficial availability API now returns fifteen August issues, the highest being issue id 31829 of 27 August 2026, where on 3–4 September the highest that existed was id 31825 of 21 August 2026. The ceiling is therefore LAGGING rather than frozen — ids that returned HTTP 307 on the expiry-day poll later returned documents — but it does NOT advance on a steady daily cadence; see the 7 September 2026 note below, which withdraws the «roughly one publication day per calendar day» rate stated here. The four issues published since the last poll — 24, 25, 26 and 27 August 2026 (ids 31826–31829) — were downloaded and read, and none extends, defers, suspends or amends the art. 29 transitional period. The unverifiable window is thereby narrowed from thirteen days to seven, 28 August – 3 September 2026, and it is closable on a later poll rather than permanently unfalsifiable.
Method note for the next poller, learned this heartbeat: ANIA instruments are published in the Diario Oficial as JPEG-2000 scanned inserts with no text layer. Pages 59–73 of Tomo 448 N.° 158 extract as running headers only (91–197 characters per page) and do not render even with a full pdf.js and canvas pipeline. The sumario, however, is real text and does name «AGENCIA NACIONAL DE INTELIGENCIA ARTIFICIAL / Resolución No. 1/2025» — which is how this publication was located. Grep the sumario, not the body; a body-only grep will produce a false negative on any ANIA instrument.
Two presentational discrepancies, both recorded rather than escalated because the article structure is identical and nothing substantive turns on either. The gazette sumario styles the instrument «Resolución No. 1/2025 — Disposiciones Relativas a la Implementación de la Inteligencia Artificial y Tecnologías», whereas ANIA's own site serves the same fifteen-article text as the «Reglamento para la Aplicación de la Ley de Fomento a Inteligencia Artificial y Tecnologías» (https://ania.gob.sv/wp-content/themes/ania/assets/docs/reglamento-ley-ia.pdf); the page count, the art. 29 twelve-month grace, the art. 11 registration trigger, the arts. 21–22 standards regime and the art. 30 eight-day commencement clause all match. The atlas uid says 0001/2025 and the gazette says 1/2025.
On the two open implementing gaps: the art. 21 list of recognised standards is not in fact outstanding — it was gazetted with the Resolución itself and names ISO/IEC 42001, 23053, 23894 and 38507, the NIST AI RMF 1.0 and IEEE 7000, 7001 and 7010, with art. 22 supplying only the process for ANIA to add further standards. The art. 24 notification templates remain unpublished, as does the overdue Ley de Tecnologías Robóticas art. 20 framework. The registry is no longer purely notional: ania.gob.sv now runs a live «Registro Nacional de IA» intake, though the site itself cautions that «esta recepción no sustituye la constancia oficial cuando el proceso esté formalizado» and no registry instrument has been gazetted.
Código Civil art. 46 runs the twelve months to midnight ending 3 September 2026, so on the primary reading the row is still «dateset» today and begins to bite on 4 September 2026; on the alternative 2 September reading it is already biting. It moves to «force» on the first check after 3 September 2026, absent any extension.
Flipped to «force» on 4 September 2026, El Salvador local time (04:13 CST), the first check after the art. 29 twelve-month transitional period ran out at midnight ending 3 September 2026. No extension, deferral, suspension or amendment was found in any source. The flip is confirmed and strengthened on the 6 September 2026 re-poll described above, which read four further gazette issues to 27 August 2026; the earlier statement that the corpus ceiling was frozen and that no further source attempt was warranted was wrong and is withdrawn — the ceiling merely lags publication by about ten days. The row rests on a firm no-extension negative through 27 August 2026, with only 28 August – 3 September 2026 outstanding. Legacy AI systems in the six art. 11 sectors that were already operating before 3 September 2025 are now subject to the mandatory registration, algorithmic-impact-assessment and compliance-route requirements in full, with no grace period remaining for any operator; art. 28 escalation, not a fine, is the enforcement route. Still outstanding and unaffected by this flip: the art. 24 notification templates and the overdue Ley de Tecnologías Robóticas art. 20 framework.
Method note added 6 September 2026, and the reason an earlier poll wrongly called the corpus ceiling frozen: every Diario Oficial PDF is encrypted with the PDF standard security handler (V4, R4, AESV2 — AES-128-CBC) under an EMPTY user password, so a naive text extractor returns about one character per page across every issue and every control string comes back zero. That is a broken read, not an absence, and on this corpus it is indistinguishable from a clean negative unless controls are checked. The file key is derived by Algorithm 2 from /O, /P and the first /ID string and must be validated against the stored /U by Algorithm 5 before any negative is trusted; each stream then takes a per-object key of MD5(key + objnum[3 LE] + gen[2 LE] + 'sAlT') and is AES-CBC decrypted with its own first sixteen bytes as the IV. Two further traps: the object-number regex must be anchored on whitespace or it captures the tail of a preceding number and derives the wrong per-object key; and the gazette's typesetting injects spaces between the letters of headline words, so «Decreto» occurs as «D e c r e t o» and a stem search must be run against an accent-stripped, fully DE-SPACED copy of the text, not merely a punctuation-collapsed one. Read this way, issues 31826, 31828 and 31829 extract at 1.0–1.8 million characters with healthy controls («republica» 174/53/48, «ministerio» 87/42/30) and issue 31827 decodes cleanly in the sumario, which is the part that indexes ANIA instruments. Across all four: zero occurrences of «inteligencia artificial», «agencia nacional», «algoritm-», «robotic-», «tecnologias roboticas», «datos personales» or «biometr-»; the only «automatizad-» hits are land-registry «folio real automatizado» boilerplate, and every apparent «ania» hit is a substring of Betania, Estefanía or compañía.
Still outstanding on the 6 September 2026 check, both re-verified against ania.gob.sv, which serves exactly three documents (ley-fomento-ia.pdf, reglamento-ley-ia.pdf, estrategia-nacional-ia-2026.pdf) and no others: the art. 24 notification templates, and the overdue Ley de Tecnologías Robóticas art. 20 minimum-regulations framework.
Re-polled 7 September 2026. The Diario Oficial availability API (POST /api/v1/diarios-disponibles, year=2026 month=8) returns the same fifteen August issues as on 6 September, the highest still being id 31829 of 27 August 2026; year=2026 month=9 returns HTTP 200 with an empty body, i.e. no September issue exists. Ids 31830–31834 were probed directly and every one redirects to the site landing page rather than serving a PDF, whereas 31829 serves a 1.97 MB encrypted PDF — so the ceiling is a real absence, not an access failure. The ceiling therefore did NOT advance at all across a full calendar day. The rate stated on 6 September, that the corpus advances by about one publication day per calendar day, is withdrawn: on this evidence the ceiling moves in irregular bursts, and no date can be predicted for when the outstanding window will close. The unverifiable window accordingly remains 28 August – 3 September 2026, unchanged and NOT narrowed this heartbeat.
Two independent corroborating checks were run instead. First, ANIA's own site was re-inventoried and still serves exactly three documents (ley-fomento-ia.pdf, reglamento-ley-ia.pdf, estrategia-nacional-ia-2026.pdf) with no occurrence of «plantilla», «notificaci-», «acuerdo» or «resoluci-» anywhere on the page: no registry acuerdo, no art. 24 templates, no robotics framework. Second, the Centro de Documentación Judicial bóveda was probed by month directory, which turns out to be a one-request existence test: a populated month returns HTTP 403 (directory listing forbidden) and an absent month returns HTTP 404. Calibrated against 2025/08, 2026/06, 2026/07 and 2026/08, all 403, and against 2026/10 as a future-month negative control, 404 — the directory for 2026/09 returns 404, so no instrument dated September 2026 has been deposited to the corpus at all. That is a corroborating negative and not a proof, because the CDJ corpus lags publication just as the gazette does; it is recorded as consistent with, not as independent confirmation of, the no-extension finding.
Net effect on the row: none. The «force» lifecycle and the 3 September 2026 date stand on the firm no-extension negative through 27 August 2026. Nothing found on 7 September 2026 extends, defers, suspends or amends the art. 29 transitional period, and the art. 24 notification templates and the overdue Ley de Tecnologías Robóticas art. 20 framework both remain unpublished.
Re-polled 11 September 2026. Nothing has moved on any of the three open Salvadoran items, and the significant finding this heartbeat is about the SOURCES rather than the law: both primary corpora are now stalled, so the outstanding 28 August – 3 September 2026 window is not closable on any predictable schedule and daily polling has no yield.
First, the Diario Oficial availability API (POST /api/v1/diarios-disponibles) returns for year=2026 month=8 the same fifteen August issues as on 6 and 7 September, the highest still being id 31829 of 27 August 2026; year=2026 month=9 returns HTTP 200 with an empty body. Ids 31830–31835 were probed directly and every one 307-redirects to the site landing page, while 31829 still serves a 1.97 MB PDF — a real absence, not an access failure. The ceiling has therefore been frozen at 27 August 2026 for five consecutive calendar days (6–11 September). Second, the Centro de Documentación Judicial legislative corpus (baseDatos=2) has a watermark of 11 August 2026 on generic control terms («Ministerio» newest hit 11/08/2026; «Presidente de la República» 07/08/2026), unchanged since the early-September polls — roughly a 31-day lag. Third, the bóveda month-directory existence test was re-run and is unchanged: 2025/08, 2026/06, 2026/07 and 2026/08 all return HTTP 403 (populated, listing forbidden), 2026/09 returns 404 and the 2026/10 future-month control also returns 404 — so no instrument dated September 2026 has been deposited.
Substantively the subject search is unchanged and confirms the row. The CDJ corpus returns exactly three AI/robotics instruments — Resolución 0001/2025 (D.O. 25 August 2025, Tomo 448), the Ley de Tecnologías Robóticas D.L. 340 (D.O. 21 July 2025, Tomo 448) and the Ley de Fomento a Inteligencia Artificial y Tecnologías D.L. 234 (D.O. 3 March 2025, Tomo 446) — and each is flagged «Vigencia: Vigente». Resolución 0001/2025 is therefore still in force and unamended as indexed; nothing extends, defers, suspends or amends the art. 29 transitional period. The «force» lifecycle and the 3 September 2026 date stand unchanged on the firm no-extension negative through 27 August 2026. The art. 24 notification templates and the overdue Ley de Tecnologías Robóticas art. 20 minimum-regulations framework both remain unpublished.
Polling guidance revised for the next poller: with both corpora static, the cheap check is the two-request pair — the availability API for a ceiling past id 31829 / 27 August 2026, and the bóveda 2026/09 directory for a 403 — and it is worth running weekly rather than per-heartbeat. Only a ceiling advance past 27 August 2026 can close the outstanding window.
Re-polled 13 September 2026, and the finding reverses the source verdict recorded on 11 September. Both corpora have MOVED. The Diario Oficial availability API (POST /api/v1/diarios-disponibles, year=2026 month=8) now returns seventeen August issues, the highest being id 31832 of 31 August 2026, where on 6, 7 and 11 September the highest that existed was id 31829 of 27 August 2026; and the Centro de Documentación Judicial legislative corpus (baseDatos=2) now indexes to 18 August 2026, against the 11 August 2026 watermark recorded on 11 September. The statement that the ceiling was «frozen at 27 August 2026» and that the outstanding window was «not closable on any predictable schedule» was therefore wrong and is withdrawn; this is the second time a frozen verdict has been written into this row and then disproved by simply re-polling, and the correct reading of this corpus remains that it lags publication in irregular bursts rather than that it stops. The two newly available issues, id 31830 of 28 August 2026 and id 31832 of 31 August 2026, were downloaded and read in full under the AES-128 decryption path described above: 1.99 million and 1.41 million characters of extracted text respectively, with healthy controls («diario oficial» 211 and 158 hits, «republica» 162 and 57, «ministerio» 96 and 22), so the reads are real. Across both issues there are zero occurrences of «inteligencia artificial», «agencia nacional», «robotic-», «tecnologias roboticas» or «registro de sistemas». Id 31831 does not exist as a served issue — it, and ids 31833 and 31834, redirect to the site landing page while 31830 and 31832 serve PDFs — and 29 and 30 August 2026 were a Saturday and Sunday, so 28 and 31 August 2026 complete the business-day coverage of that stretch. The outstanding unverifiable window accordingly narrows from seven calendar days (28 August – 3 September 2026) to the three business days 1–3 September 2026. Nothing found extends, defers, suspends or amends the art. 29 transitional period, so the «force» lifecycle and the 3 September 2026 date stand unchanged. The art. 24 notification templates and the overdue Ley de Tecnologías Robóticas art. 20 minimum-regulations framework both remain unpublished; the subject search still returns exactly three AI/robotics instruments (D.L. 234, D.L. 340, Resolución 0001/2025), each «Vigencia: Vigente». The bóveda month-directory existence test is unchanged — 2025/08, 2026/06, 2026/07 and 2026/08 all return HTTP 403 (populated), 2026/09 returns 404 and the 2026/10 future-month control also returns 404 — so no instrument dated September 2026 has been deposited. Polling guidance for the next poller, superseding the «both corpora static» guidance below it: the ceiling DOES advance, so keep the weekly cadence but expect it to move roughly four publication days per week. The cheap two-request pair is unchanged — the availability API for a ceiling past id 31832 / 31 August 2026, and the bóveda 2026/09 directory for a 403. Only a ceiling advance past 3 September 2026 can close the outstanding window.
Stated maximum penalty — No fine — art. 28 escalation only (guidance with ≥60 days to remediate, formal notice, compliance order, referral to the competent sector authority for serious and repeated violations)