Skip to main content

    AI by country · Central America and Caribbean

    AI in Costa Rica: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Costa Rica know before starting with AI?

    Costa Rica has no AI law as of 29 October 2026. Law No. 8968 on the protection of personal data, enforced by Prodhab, is the law that applies to AI today, and it is strict on consent, sensitive data and transfers abroad. Several AI bills are before the Legislative Assembly, and the government has a National AI Strategy for 2024 to 2027.

    At a glance

    Costa Rica at a glance

    Key facts about Costa Rica
    Data protection lawLey No. 8968, Protección de la Persona frente al Tratamiento de sus Datos Personales (2011), in force
    RegulatorAgencia de Protección de Datos de los Habitantes (Prodhab)
    AI policyEstrategia Nacional de Inteligencia Artificial 2024 to 2027 (MICITT, October 2024). No AI law as of 29 October 2026
    Time zoneUTC-6 all year, no daylight saving (India is 11.5 hours ahead)
    CurrencyCRC (Costa Rican colón)
    Business languageSpanish

    Why now

    Why Costa Rica is worth watching

    Each point links to the document it comes from.

    • The Ministry of Science, Innovation, Technology and Telecommunications launched the National AI Strategy 2024 to 2027 on 24 October 2024, with seven axes including ethical and safe AI, talent and smart government.[2]

    • The strategy includes work on a regulatory framework with technical and ethical guidelines for AI.[2]

    • Bill 23.771 on regulating AI was placed on the plenary agenda on 23 October 2024 with a majority favourable committee report, and bill 23.919 received its committee report on 6 March 2025.[3]

    • Business chambers asked in March 2025 for the AI bills to be rewritten, citing burdens on startups and small firms.[3]

    • Prodhab issued a general directive on personal data in debt collection in July 2026, showing it is active on everyday data uses.[5]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Ley No. 8968, Protección de la Persona frente al Tratamiento de sus Datos Personales

    In force2011Before collecting personal data you must tell people expressly about the database, its purposes, the recipients and how the data will be processed (article 5). Sensitive data such as health, ethnic origin or sexual orientation may only be processed under narrow exceptions (article 9). Databases kept for distribution, disclosure or sale must be registered with Prodhab (article 21).[1]

    Ley No. 8968: transfers and sanctions

    In force2011Personal data may only be transferred with the person's express and valid authorisation (article 14). Sending personal data of people in Costa Rica to databases in other countries without consent is a very serious offence (article 31). Very serious offences carry fines of 15 to 30 base salaries and suspension of the database for one to six months (article 28).[1]

    Bill 23.771, Ley de Regulación de la Inteligencia Artificial en Costa Rica

    Draft2023Filed on 30 May 2023. A legal commentary describes ethical principles, informed consent for personal data and a new AI regulator called ARIA. OECD.AI still listed it as proposed in May 2026, and we found no record of a final vote.[4]

    Where AI fits first

    Where AI fits first

    Banking and collections

    Drafting collection messages and routing customer queries, with staff checking who is contacted.

    Prodhab's 2026 directive bans collection messages to unrelated third parties without their authorisation and requires the database controller to be named in every message.[5]

    Health care

    Summarising records and answering appointment questions, with clinicians making decisions.

    Health data is sensitive data under article 9 of Law 8968 and can only be processed under its exceptions. Check this before any AI touches patient records.[1]

    Services and support centres

    Call summaries, quality review and knowledge search in Spanish and English.

    If the AI provider is abroad, Law 8968 requires express consent for the transfer of personal data.[1]

    Public sector

    Document search and drafting replies to citizens, with officials signing off.

    Smart government is one of the seven axes of the National AI Strategy, and bill 24.484 on AI in public administration was in committee in March 2025.[3]

    Your first steps

    Your first steps

    1. Check whether your databases must be registered with Prodhab under article 21 of Law 8968.
    2. Rewrite your data collection notices so they name AI processing, the purposes and the recipients.
    3. Get express consent before sending personal data to an AI tool hosted outside Costa Rica.
    4. Keep health and other sensitive data out of AI tools unless a clear exception in article 9 applies.
    5. Set up a way for people to exercise their data rights, and keep a human in the loop for decisions about them.
    6. If you collect debts, check AI-written messages against Prodhab's 2026 directive.
    7. Follow bills 23.771 and 23.919 in the Legislative Assembly.

    AI services for Costa Rica

    AI consulting and development for teams in Costa Rica

    We work remotely with companies in Costa Rica, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Costa Rica is on UTC-6 all year and India on UTC+5:30, so India is 11.5 hours ahead. An Indian day of 9:30 to 18:30 ends at 07:00 in San José, so there is no overlap in normal office hours. We agree a short call early in your morning, which is evening in India, and send written updates so you start each day with progress to review.

    Questions

    Common questions about AI in Costa Rica

    Does Costa Rica have an AI law?

    No, not as of 29 October 2026. Bills 23.771, 23.919 and 24.484 have been filed, and two reached the plenary stage, but we found no record that any has passed.

    Which law covers AI that uses personal data?

    Law No. 8968 of 2011, enforced by Prodhab. It covers automated and manual databases, consent, sensitive data, transfers and registration.

    Can we use an AI service hosted in another country?

    Only with care. Law 8968 requires express authorisation for transfers, and moving personal data of people in Costa Rica abroad without consent is a very serious offence.

    What are the fines?

    Fines are set in base salaries of a judicial assistant post: up to 5 for minor offences, 5 to 20 for serious ones, and 15 to 30 for very serious ones, which can also bring a suspension of the database.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Asamblea Legislativa, text from SCIJ (Sistema Costarricense de Información Jurídica), via the Municipalidad de Goicoechea, 2011-07-07. Ley No. 8968, Protección de la Persona frente al Tratamiento de sus Dat…(transparencia.munigoicoechea.go.cr)
      Full title and what we used it for

      Ley No. 8968, Protección de la Persona frente al Tratamiento de sus Datos Personales. Primary text, read in full in Spanish. This SCIJ print was generated on 20 July 2021, so later amendments, if any, were not checked. Used for articles 5, 9, 14, 21, 28 and 31. The SCIJ page itself did not load for us.

    2. [2] Delfino.cr, 2024-10-24. Micitt lanza primera política pública sobre uso y desarrollo de Intelig…(delfino.cr)
      Full title and what we used it for

      Micitt lanza primera política pública sobre uso y desarrollo de Inteligencia Artificial. Press report. Used for the launch date, the seven axes and the plan for a regulatory framework. The MICITT strategy PDF returned an access error, so we could not read it directly.

    3. [3] El Financiero (Costa Rica), 2025-03-19. ¿Qué plantean tres proyectos de ley sobre inteligencia artificial que g…(elfinancierocr.com)
      Full title and what we used it for

      ¿Qué plantean tres proyectos de ley sobre inteligencia artificial que generan alarmas en los sectores tecnológico y de comercio en Costa Rica?. Press report. Used for the three bills, their filing dates and stages, and the business chambers' criticism.

    4. [4] OECD.AI Policy Navigator, 2026-05-17. Law on the regulation of artificial intelligence in Costa Rica (23771)(oecd.ai)
      Full title and what we used it for

      Law on the regulation of artificial intelligence in Costa Rica (23771). Intergovernmental tracker, last updated on this date. Used for the status 'proposed or under development'. Bill content from an IAPP commentary by María del Pilar López (Eproint), 5 July 2023, used for interpretation only.

    5. [5] Delfino.cr, 2026-07-23. Prodhab prohíbe contactar a terceros para cobrar deudas(delfino.cr)
      Full title and what we used it for

      Prodhab prohíbe contactar a terceros para cobrar deudas. Press report of Prodhab general directive PRODHAB-DIR-DN-001-2026. Used for the debt collection rules.

    6. [6] IAPP, 2023-07-05. Análisis del proyecto de ley de regulación de la inteligencia artificia…(iapp.org)
      Full title and what we used it for

      Análisis del proyecto de ley de regulación de la inteligencia artificial en Costa Rica. Legal commentary by a practising lawyer, used for interpretation only: the proposed ARIA regulator and principles in bill 23.771.

    This is general information, not legal advice. Several official Costa Rican sites could not be opened when we checked, so the AI strategy and bill stages rest on press reports and trackers, as noted in the sources. Check with a qualified Costa Rican lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Costa Rica?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score