Skip to main content

    AI by country · South America

    AI in Uruguay: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Uruguay know before starting with AI?

    Uruguay has no AI law as of 29 October 2026. Law 18.331 on personal data already gives people rights over automated decisions, and Decree 64/020 requires an impact assessment for profiling and large-scale processing and breach notice within 72 hours. The National AI Strategy 2024 to 2030 plans risk-based rules, and a 2025 decree set up controlled test environments for AI projects.

    At a glance

    Uruguay at a glance

    Key facts about Uruguay
    Data protection lawPersonal Data Protection Law, Law 18.331 (2008), in force, with Decree 64/020
    RegulatorUnidad Reguladora y de Control de Datos Personales (URCDP), part of AGESIC
    AI policyNational AI Strategy 2024 to 2030 (AGESIC), under Law 20.212. No AI law as of 29 October 2026
    Time zoneUTC-3, no daylight saving (India is 8.5 hours ahead)
    CurrencyUYU (Uruguayan peso)
    Business languageSpanish

    Why now

    Why Uruguay is worth watching

    Each point links to the document it comes from.

    • Article 74 of Law 20.212 (November 2023) told AGESIC to design a national data and AI strategy for the public and private sectors, acting with the URCDP where personal data is involved.[3]

    • The National AI Strategy 2024 to 2030 plans risk-based rules, decisions on unacceptable AI uses and sector rules for areas such as health, insurance and finance.[5]

    • Decree 276/025, published on 10 December 2025, set up controlled test environments for innovative data and AI projects, lasting up to two years.[4]

    • Uruguay is on the European Commission's list of countries with adequate data protection, which makes data flows with the EU simpler.[6]

    • Uruguay signed the Council of Europe Framework Convention on AI and Human Rights in September 2025.[7]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Data Protection Law, Law 18.331

    In force2008People have the right not to be subject to decisions with significant legal effects based on automated evaluation of their personality, such as work performance or credit, and can ask for the criteria and program used (article 16). Processing generally needs free, prior, express and informed consent (article 9). Fines reach 500,000 indexed units (UI) (article 35).[1]

    Law 18.331: international transfers

    In force2008Transfers to countries without adequate protection are prohibited unless an exception applies, such as unequivocal consent or a contract need. The URCDP can authorise other transfers where contract clauses give sufficient guarantees (article 23).[1]

    Decree 64/020 on breaches, impact assessments and delegates

    In force2020A data protection impact assessment is needed before profiling people, large-scale processing, processing data of minors or transfers to countries without adequate protection. Breaches go to the URCDP within 72 hours. Companies processing data on more than 35,000 people need a data protection delegate. Foreign firms that profile people in Uruguay are covered.[2]

    Decree 276/025 on controlled test environments

    In force2025AI projects can be tested in an approved environment for up to two years. Projects must state who is affected, run a data protection impact assessment where it applies, and publish their documentation. The URCDP must approve the use of personal data in data spaces.[4]

    Where AI fits first

    Where AI fits first

    Banking and insurance

    Fraud detection and Spanish-language customer service, with staff reviewing credit decisions.

    Creditworthiness profiling triggers an impact assessment under Decree 64/020, and the AI strategy names insurance and finance for future sector rules.[2]

    Health care

    Summarising clinical notes and appointment handling, with clinicians deciding.

    Health is one of the areas the AI strategy names for sector rules. Health data is especially protected, which can trigger an impact assessment.[5]

    Software and services exports

    Building AI features for foreign clients, such as document processing or support tools.

    EU adequacy status helps when handling European data. Transfers to other countries still need a ground under article 23 of Law 18.331.[6]

    Public sector

    Handling citizen requests and searching case files.

    Public bodies must appoint a data protection delegate under Decree 64/020, and the AI strategy covers public procurement of AI.[2]

    Your first steps

    Your first steps

    1. List the decisions your AI makes about people and set up a way to explain the criteria and let them challenge the result, under article 16 of Law 18.331.
    2. Run a data protection impact assessment before any AI that profiles people, handles data of minors or works at large scale.
    3. Check whether you need a data protection delegate, for example if you hold data on more than 35,000 people.
    4. Prepare a breach process that can notify the URCDP within 72 hours.
    5. Map transfers to AI and cloud providers abroad, and use consent, a listed exception or URCDP-approved contract clauses.
    6. If your project needs a regulatory exception to test, look at the controlled test environments under Decree 276/025.
    7. Follow AGESIC's work under the AI strategy, as risk-based rules are planned.

    AI services for Uruguay

    AI consulting and development for teams in Uruguay

    We work remotely with companies in Uruguay, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Uruguay is on UTC-3 and India on UTC+5:30, so India is 8.5 hours ahead. With a 9:00 to 18:00 day in Uruguay and 9:30 to 18:30 in India, the overlap is only 1 hour: 09:00 to 10:00 in Montevideo, which is 17:30 to 18:30 in India. So we agree a fixed early-morning (Uruguay) and evening (India) call window, and send written updates at the end of each Indian day so work is ready when your morning starts.

    Questions

    Common questions about AI in Uruguay

    Does Uruguay have an AI law?

    Not as of 29 October 2026. Law 20.212 set up the national AI strategy and test environments, and the strategy plans risk-based rules. Law 18.331 and Decree 64/020 apply to AI that uses personal data.

    Do we need an impact assessment for AI?

    Often, yes. Decree 64/020 requires one before profiling people, for example on work performance, credit or behaviour, and before large-scale processing or processing of minors' data.

    Does Uruguayan law apply to a foreign AI provider?

    It can. Decree 64/020 covers foreign firms that offer goods or services to people in Uruguay, analyse their behaviour or use infrastructure in Uruguay.

    What are the penalties?

    The URCDP can issue an observation or warning, fine up to 500,000 indexed units, suspend a database for five days or seek its closure in court.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] IMPO (Centro de Información Oficial), 2008-08-18. Ley 18.331, Ley de Protección de Datos Personales(impo.com.uy)
      Full title and what we used it for

      Ley 18.331, Ley de Protección de Datos Personales. Primary law text with amendments. Used for articles 9, 16, 23, 31 and 35, and the 2022 changes by Law 20.075.

    2. [2] IMPO (Centro de Información Oficial), 2020-02-21. Decreto 64/020(impo.com.uy)
      Full title and what we used it for

      Decreto 64/020. Primary. Used for territorial scope (article 1), breach notice (article 4), impact assessments (article 6) and delegates (article 10).

    3. [3] IMPO (Centro de Información Oficial), 2023-11-17. Ley 20.212, artículo 74(impo.com.uy)
      Full title and what we used it for

      Ley 20.212, artículo 74. Primary. Used for AGESIC's mandate on the data and AI strategy and joint action with the URCDP.

    4. [4] IMPO (Centro de Información Oficial), 2025-12-10. Decreto 276/025(impo.com.uy)
      Full title and what we used it for

      Decreto 276/025. Primary. Used for controlled test environments, their two-year limit and project duties.

    5. [5] AGESIC, 2026-10-29. Estrategia Nacional de Inteligencia Artificial del Uruguay 2024 a 2030:…(gub.uy)
      Full title and what we used it for

      Estrategia Nacional de Inteligencia Artificial del Uruguay 2024 a 2030: ejes. Primary, accessed on this date. Used for the three axes and the planned risk-based and sector rules.

    6. [6] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary, accessed on this date. Used to confirm Uruguay is on the EU adequacy list.

    7. [7] MercoPress, 2025-09-02. Uruguay signs Council of Europe's global AI treaty(en.mercopress.com)
      Full title and what we used it for

      Uruguay signs Council of Europe's global AI treaty. Press report. Used for the signature of the Framework Convention on AI. We did not find news of ratification.

    This is general information, not legal advice. Uruguay plans new AI rules under its strategy, so this may change. Check with a qualified Uruguayan lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Uruguay?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score