Peru's National AI Law Regulation — Education Named a High-Risk Sector Requiring Human Oversight

Peru's Law No. 31814 (2023) promotes the use of artificial intelligence for the country's economic and social development. Its implementing regulation, Decreto Supremo No. 115-2025-PCM, was approved on 9 September 2025 by the Secretaría de Gobierno y Transformación Digital (SGTD) under the Presidencia del Consejo de Ministros, and explicitly classifies 'educational evaluation systems' as high-risk AI alongside health, justice, security and finance.

The regulation aims to protect fundamental rights against AI-driven harms in high-risk sectors, requiring clear prior information to users, comprehensible explanations of automated results, security audits, and data protection by design (minimisation, anonymisation) for systems like automated school evaluation.

High-risk systems must have trained staff able to stop, correct or invalidate automated decisions before they affect students, and SGTD must coordinate with the Ministry of Education to promote responsible AI use under the National Basic Education Curriculum. Complaints can be filed through INDECOPI, the Cybercrime Investigation Division, the national data-protection authority (ANPDP), and a public complaints portal.

Public-sector obligations begin in January 2026, with the education sector facing a compliance deadline of September 2026 — one year after the regulation's approval — and private-sector compliance phased over up to four years. As the September 2026 deadline had not yet passed at the time of this research, no implementation outcomes for schools are yet documented.

Independent reviewers have flagged weaknesses: Access Now calls the regulation's risk definitions 'too ambiguous' and notes that fundamental-rights impact assessments are mandatory only for government entities (optional for the private companies that build most EdTech tools), while Hiperderecho finds the 15-member oversight committee has only one civil-society seat and has remained largely inactive — so this is a binding legal mandate with real requirements on paper, but still untested and imperfectly overseen in practice.