Skip to main content

    AI by country · South America

    AI in Ecuador: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Ecuador know before starting with AI?

    Ecuador has no dedicated AI law as of 29 October 2026, but its data protection authority has made specific rules for AI. The Organic Law on Personal Data Protection (LOPDP) of 2021 gives people rights over automated decisions, and a 2026 Superintendency resolution requires impact assessments, transparency and audits for AI that processes personal data. Further resolutions in September 2026 cover biometrics and security breaches.

    At a glance

    Ecuador at a glance

    Key facts about Ecuador
    Data protection lawLey Orgánica de Protección de Datos Personales (LOPDP), May 2021; sanctions apply since May 2023
    RegulatorSuperintendencia de Protección de Datos Personales (SPDP)
    AI policyNo dedicated AI law as of 29 October 2026. SPDP rules on personal data in AI systems (Resolution SPDP-SPD-2026-0009-R, 2026)
    Time zoneUTC-5 on the mainland, UTC-6 in Galápagos; no daylight saving
    CurrencyUSD (US dollar)
    Business languageSpanish

    Why now

    Why Ecuador is worth watching

    Each point links to the document it comes from.

    • The SPDP issued a general rule on personal data in AI systems, Resolution SPDP-SPD-2026-0009-R, signed on 12 February 2026 and published in the Registro Oficial on 10 March 2026.[3]

    • The rule applies to AI that processes data of people in Ecuador wherever the system or provider is located, and covers developers, deployers and distributors.[2]

    • On 9 September 2026 the SPDP issued four more resolutions: updated AI rules that also bind processors, rules on biometric data and rules on notifying security breaches.[4]

    • The Organic Law for Strengthening Cybersecurity was published on 22 May 2026 and sets mechanisms for managing and notifying cyber incidents.[5]

    • The LOPDP's sanctions regime has applied since May 2023, two years after the law was published.[1]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Organic Law on Personal Data Protection (LOPDP)

    In force2021People have the right not to be subject to decisions based solely or partly on automated assessments, including profiling, that have legal effects. They can ask for a reasoned explanation, the criteria and the data used, and challenge the decision (article 20). An impact assessment is mandatory before profiling that leads to legal effects, large-scale processing of special data or large-scale monitoring of public areas (article 42).[1]

    LOPDP: breaches, transfers and fines

    In force2021The original text requires breach notice to the authority within five days (article 43); the 2026 cybersecurity law and an SPDP resolution reportedly changed the details, so check the current text. Transfers abroad need a country declared adequate or binding safeguards (articles 56 and 57). Serious infringements by private firms can cost 0.7% to 1% of turnover (article 72).[1]

    SPDP Resolution SPDP-SPD-2026-0009-R on AI systems

    In force2026Anyone developing, deploying or using AI on personal data must tell people their data is processed by AI, run risk management and impact assessments, keep the processing in the record of processing activities, and audit the system according to its risk. The SPDP can audit AI systems and order corrective measures.[2]

    SPDP resolutions 0037-R to 0040-R of 9 September 2026

    In force2026They extend the AI rules to processors, set rules for biometric data, including impact assessments before biometric systems and limits on mass identification in public spaces, and set rules on breach notification. We know them from a law firm summary and did not read the texts.[4]

    Where AI fits first

    Where AI fits first

    Banking and finance

    Fraud detection and Spanish-language customer service, with staff reviewing credit decisions.

    Credit profiling that has legal effects needs an impact assessment under LOPDP article 42 and the SPDP AI rule.[1]

    Retail and security

    Stock forecasting and store analytics without identifying people.

    Face recognition and other biometrics fall under the SPDP's September 2026 biometric rules, which require an impact assessment first.[4]

    Health care

    Summarising clinical notes, with clinicians making decisions.

    Large-scale processing of special categories of data, such as health data, needs an impact assessment before it starts.[1]

    Exports and agribusiness

    Document processing for shipments and crop forecasting, using mostly non-personal data.

    We found no AI rule specific to agriculture. The LOPDP applies only where personal data is used.

    Your first steps

    Your first steps

    1. Read SPDP Resolution SPDP-SPD-2026-0009-R and the September 2026 updates before you deploy AI on personal data.
    2. Tell people clearly when their data is processed by an AI system.
    3. Run an impact assessment before any AI that profiles people with legal effects, uses biometrics or works at large scale.
    4. Add each AI use to your record of processing activities, noting any automated decisions with legal effects.
    5. Set up a way to explain automated decisions and let people challenge them, under LOPDP article 20.
    6. Check the current breach notification rules, since the 2026 cybersecurity law and an SPDP resolution changed them.
    7. Map transfers to AI and cloud providers abroad and put a binding transfer instrument in place where the country is not declared adequate.

    AI services for Ecuador

    AI consulting and development for teams in Ecuador

    We work remotely with companies in Ecuador, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Mainland Ecuador is on UTC-5 and India on UTC+5:30, so India is 10.5 hours ahead. A 9:00 to 18:00 day in Ecuador and 9:30 to 18:30 in India do not overlap at all: 18:30 in India is 08:00 in Quito. So we agree a short early-morning (Ecuador) and evening (India) call window, for example 07:30 to 08:30 in Quito, and send written updates at the end of each Indian day so work is ready when your morning starts.

    Questions

    Common questions about AI in Ecuador

    Does Ecuador have an AI law?

    Not a dedicated one as of 29 October 2026. The SPDP has issued binding rules on personal data in AI systems under the LOPDP, so most business AI that touches personal data is already regulated.

    Does the AI rule apply to foreign AI providers?

    Yes, according to the SPDP rule as reported. It applies when AI systems process data of people in Ecuador, whatever the location of the system or provider.

    What are the fines?

    For private firms, minor infringements carry 0.1% to 0.7% of the previous year's turnover and serious ones 0.7% to 1%. Public officials face fines in basic salaries.

    Can customers challenge an AI decision?

    Yes. LOPDP article 20 lets them ask for an explanation, the criteria and the data used, and challenge the decision. Exceptions include contract necessity, explicit consent and decisions with no serious impact.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Asamblea Nacional del Ecuador (Lexis Finder copy hosted by UTPL), 2021-05-26. Ley Orgánica de Protección de Datos Personales, Registro Oficial Suplem…(procuraduria.utpl.edu.ec)
      Full title and what we used it for

      Ley Orgánica de Protección de Datos Personales, Registro Oficial Suplemento 459 de 26 de mayo de 2021. Full law text in its original form. Used for articles 20, 42, 43, 48, 56, 57, 71, 72 and the first transitional provision. The official gob.ec page did not load. Later amendments, such as the 2026 cybersecurity law's change to article 43, are not in this copy.

    2. [2] LEXIS, 2026-02-19. Superintendencia de Protección de Datos Personales expide norma general…(lexis.com.ec)
      Full title and what we used it for

      Superintendencia de Protección de Datos Personales expide norma general para la protección de datos personales en el uso de inteligencia artificial. Legal publisher's report of the resolution. Used for scope, extraterritorial reach and main duties. An Allende & Brea summary (https://allende.com/privacidad-y-ciberseguridad/ecuador-nuevas-pautas-para-la-proteccion-de-datos-personales-en-el-desarrollo-y-operacion-de-ia-03-20-2026/) gives the same duties. We did not read the resolution itself.

    3. [3] LEXIS, 2026-03-10. Registro Oficial del día: Superintendencia de Protección de Datos expid…(lexis.com.ec)
      Full title and what we used it for

      Registro Oficial del día: Superintendencia de Protección de Datos expide norma para el uso de Inteligencia Artificial. Used for publication in Registro Oficial No. 240 on 10 March 2026.

    4. [4] Olarte Moure, 2026-09-18. Protección de datos ante IA, biometría y brecha de seguridad(olartemoure.com)
      Full title and what we used it for

      Protección de datos ante IA, biometría y brecha de seguridad. Law firm summary, used for interpretation of SPDP resolutions 0037-R to 0040-R of 9 September 2026. It gives no breach notification deadlines.

    5. [5] LEXIS, 2026-05-22. Registro Oficial del día: Ley Orgánica para el Fortalecimiento de la Ci…(lexis.com.ec)
      Full title and what we used it for

      Registro Oficial del día: Ley Orgánica para el Fortalecimiento de la Ciberseguridad. Used for publication in Quinto Suplemento No. 290 on 22 May 2026 and the law's aims. Press reports say it amends LOPDP article 43; we could not confirm the new wording.

    6. [6] Allende & Brea, 2026-03-20. Ecuador: nuevas pautas para la protección de datos personales en el des…(allende.com)
      Full title and what we used it for

      Ecuador: nuevas pautas para la protección de datos personales en el desarrollo y operación de IA. Law firm summary, used for interpretation: impact assessments, transparency, records and audits under Resolution SPDP-SPD-2026-0009-R.

    This is general information, not legal advice. Ecuador's AI and breach rules changed several times in 2026, and some details here come from law firm summaries. Check with a qualified Ecuadorian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Ecuador?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score