EveryAILaw.comDoes Law for the Promotion of Artificial Intelligence and Technologies require Risk Assessment?
El Salvador • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 5 specific requirements for Risk Assessment across 1 provision:
- Algorithmic impact assessment — Systems subject to mandatory registration must identify risks to affected people, assess likelihood and severity, document sector-appropriate mitigation and monitoring, and include bias testing and an equity assessment (Resolution Arts. 10(e), 15)
- Sector controls — Covered operators must use proportionate security measures, incident-response procedures, and regular performance and impact review (Resolution Art. 14)
- Compliance paths — Operators may use annual self-certification against ANIA-recognized standards, approved third-party certification, or participation in the ANIA sandbox (Resolution Art. 16)
- Verification approach — ANIA may request evidence of implemented controls and prioritizes education and assistance over punitive action (Resolution Art. 17)
- Data-triggered risk framework — The Law's Article 17 requirements are mandatory for systems handling confidential, reserved, or personal data
High-Risk AI Impact Assessment #
Law Article 17 makes the ANIA risk-framework requirements mandatory only for systems handling data classified as confidential, reserved, or personal. Resolution Articles 10 and 15 additionally require an algorithmic impact assessment for systems subject to mandatory registration because of a covered consequential-decision deployment.
Requirements
| Requirement | Details |
|---|---|
| Algorithmic impact assessment | Systems subject to mandatory registration must identify risks to affected people, assess likelihood and severity, document sector-appropriate mitigation and monitoring, and include bias testing and an equity assessment (Resolution Arts. 10(e), 15) |
| Sector controls | Covered operators must use proportionate security measures, incident-response procedures, and regular performance and impact review (Resolution Art. 14) |
| Compliance paths | Operators may use annual self-certification against ANIA-recognized standards, approved third-party certification, or participation in the ANIA sandbox (Resolution Art. 16) |
| Verification approach | ANIA may request evidence of implemented controls and prioritizes education and assistance over punitive action (Resolution Art. 17) |
| Data-triggered risk framework | The Law's Article 17 requirements are mandatory for systems handling confidential, reserved, or personal data |