EveryAILaw.comDoes Law Promoting the Use of Artificial Intelligence (Ley 31814) and Implementing Regulation require Risk Assessment?
Peru • phased enforcement
Yes — 1 provision
Requirements at a glance
This regulation imposes 3 specific requirements for Risk Assessment across 1 provision:
- Voluntary pre-deployment assessment — Art. 32.1: before developing or implementing a high-risk system, an impact analysis may be performed voluntarily to identify and minimise potential risks, avoid harm to fundamental rights, and prevent perpetuation of inequality or bias
- Proactive mitigation — Art. 32.2: where risks to human rights or erroneous automated decisions are detected, the developer or deployer adopts proactive mitigation measures before final implementation — model adjustments, data-quality improvement, human oversight mechanisms
- Three-year documentation retention — Art. 32.3: those who perform an assessment must document findings and corrective measures and retain the documentation for at least three years from issuance, as traceability and as evidence if required by a judicial or administrative authority
High-Risk Impact Assessment (Voluntary, Documented) #
The private-sector assessment is explicitly voluntary ("de manera voluntaria", Art. 32.1) — a deliberate asymmetry with the mandatory public-sector assessment of Art. 30.1. The binding edge is documentary: whoever performs one must retain the findings for three years as evidence producible to judicial or administrative authorities. SGTD recognition incentives (Art. 32.4) and reference guidance (Art. 32.5) frame it as promoted practice.
Requirements
| Requirement | Details |
|---|---|
| Voluntary pre-deployment assessment | Art. 32.1: before developing or implementing a high-risk system, an impact analysis may be performed voluntarily to identify and minimise potential risks, avoid harm to fundamental rights, and prevent perpetuation of inequality or bias |
| Proactive mitigation | Art. 32.2: where risks to human rights or erroneous automated decisions are detected, the developer or deployer adopts proactive mitigation measures before final implementation — model adjustments, data-quality improvement, human oversight mechanisms |
| Three-year documentation retention | Art. 32.3: those who perform an assessment must document findings and corrective measures and retain the documentation for at least three years from issuance, as traceability and as evidence if required by a judicial or administrative authority |
Penalties
| Violation | Fine |
|---|---|
| No administrative fines | Referral-based enforcement only (Reglamento Arts. 34, 36.2); no AI-specific sanctions regime |