El Salvador

Article 3 applies the law to any natural or legal person, regardless of nationality, autonomy or form of incorporation, that develops or provides services relating to the development, research or application of AI or similar technologies in El Salvador.

Article 7 creates the Agencia Nacional de Inteligencia Artificial (ANIA), an autonomous institution attached to the Presidency, and article 16 conditions the safeguards of article 19 (protection from injunctions against open-domain-data uses, liability limits for good-faith research and sandbox activity, and non-restrictive licensing for AI models) on registering in the Registro Nacional de Desarrollo, Innovación y Aplicación de IA.

Article 17 requires ANIA to set a comprehensive risk-evaluation framework, but makes compliance mandatory only for systems that handle data classified as confidential, reserved or personal. Article 27 required ANIA to issue the technical security criteria and the registration procedure within ninety days of the law's entry into force.

Article 22 requires that any use of personal data in AI development, research or application follow the Ley para la Protección de Datos Personales, under ANIA and ACE supervision.

Article 11 defines a 'Decisión Consecuencial' as one where an AI system, as the controlling factor, materially affects a person's legal status, rights, or access to essential goods, services or opportunities, and requires an operator to register with ANIA when its AI system meets that test and is deployed in specified sectors, including primary health diagnosis or treatment, creditworthiness or loan and insurance approval, real-time biometric identification in public spaces, the exercise of government authority or the grant or denial of public benefits, unsupervised hiring or compensation decisions, and academic admission or grading.

Article 23 offers a supervised twelve-month sandbox with a sanctions grace period, and articles 20 to 22 recognize ISO/IEC, NIST and IEEE standards as creating a rebuttable presumption of conformity. Article 30 provides the disposition takes effect eight days after publication in the Diario Oficial, but the located text of the resolution does not state that publication date.

Article 18 requires that when AI is used commercially, or to access rights or services within the Republic, the user must be told whether the decision was adopted directly by the AI or was AI-driven, with a notification that gives a comprehensible and transparent explanation of the process.

The same article requires establishing a mechanism to challenge the decision before a competent natural person who can confirm, modify or revoke it, and makes compliance with the article a precondition for the safeguards Decreto Legislativo No. 234 otherwise grants a registered developer or operator.

Article 24 requires any entity using an AI system to make a decision affecting a person in El Salvador to notify them, independent of whether the entity is subject to registration, whenever the decision was made without meaningful human review and negatively affects the person's rights or economic situation in health, financial services, employment, education, government benefits, housing, or transportation.

The notification must be clear and understandable and must at minimum confirm that AI was involved, explain the role it played, and provide a mechanism to challenge the decision. Article 25 exempts the duty where disclosure would undermine fraud detection or cybersecurity, support law enforcement or national-security functions, or where the AI's role is limited to content recommendation, search results, advertising optimization, or basic spellcheck and grammar assistance.

Article 1 sets the law's object as regulating the lawful and informed treatment of personal data, and article 2 binds any natural or legal person, public or private, that processes personal data manually, partially or fully automated, or through a third party.

Article 4(g) defines sensitive personal data to expressly include biometric and genetic information alongside religious belief, ethnic origin, political and union affiliation, sexual preference, and physical and mental health, and article 37 conditions any processing of it on the data subject's express and unequivocal consent.

Articles 18 to 23 give data subjects ARCO-POL rights (access, rectification, cancellation, opposition, portability and limitation), exercised through a delegate the responsible party must designate, at no cost beyond reproduction and delivery. Article 28(a) excuses the consent requirement where personal data comes from a publicly accessible source, but only where the data is not sensitive; the data remains personal data under the law either way.

Article 44 permits an international transfer only where the receiving country or organization meets at minimum the protection principles this law defines or the applicable international standards.

Article 56 classifies infractions as minor, serious or very serious, and article 57 fines them at one to ten, eleven to twenty-five, and twenty-six to forty monthly minimum wages of the commercial sector respectively, imposed by the Agencia de Ciberseguridad del Estado (ACE), the body Decreto Legislativo No. 143 of 2024 creates and which article 53 also makes the enforcer of this law's sanctioning procedure. The law does not contain a standalone article on purely automated consequential decisions.

Article 4 punishes with one to four years' imprisonment anyone who intentionally and without authorization, or exceeding the authorization granted, accesses, intercepts or uses in whole or in part a computer system using information and communication technologies.

The article carries no requirement that the offender defeat a security measure to reach the system, unlike a statute conditioning the offence on infringing a technical control, so whether reading a public, unauthenticated page falls inside or outside 'sin autorización' turns on a reading no reported Salvadoran decision has settled.

The decree has since been amended twice, by Decreto Legislativo No. 236 (2021) and Decreto Legislativo No. 332 (2019); the text consulted is the consolidated version carrying both reform notes. It was sanctioned by the President on 26 February 2016; the located text does not state the Official Gazette publication date needed to compute the exact eight-day commencement date its own vigencia article sets.

Article 308 prohibits evading, without authorization, an effective technological measure that controls access to a protected work, performance, execution or phonogram, and prohibits manufacturing, importing, distributing, offering or providing to the public a technology, product, service or device designed for that purpose. The article carries listed exceptions, including good-faith activity by a computer, system or network owner testing or correcting its own security.

This provision reaches circumventing a technical access control placed on copyrighted material, a narrower question than the general unauthorized-access offence in the Ley Especial contra los Delitos Informáticos y Conexos.

The Intellectual Property Law contains no text-and-data-mining exception and no machine-readable opt-out mechanism of the kind the European Union's 2019 Digital Single Market Directive creates; no occurrence of that concept appears in the Act's text.

The closest analogues are narrower: article 45 permits, without authorization or remuneration, a single personal copy of an already-divulged work made by the user with their own means, and a reprographic copy for teaching or examinations at a non-profit educational institution, in the measure the purpose justifies and in accordance with fair practice; article 46 permits including brief fragments of a lawfully divulged protected work in another work, without remuneration or authorization, for quotation, criticism, illustration, teaching or research, provided the source, title and author are named.

Neither exception is scoped to, or large enough to cover, systematic reproduction of copyrighted text for training a model.

Article 17 protects, without prejudice to rights in an underlying work, anthologies or compilations of diverse works or of data or other materials, including databases in machine-readable form, where the selection or arrangement of the materials constitutes an original creation.

The article confers no sui generis right in the data or contents themselves; protection turns on the originality of the selection or arrangement, the same standard the copyright chapter applies to any other compiled work.

The Intellectual Property Law (Decreto Legislativo No. 66) replaced the 1993 Ley de Propiedad Intelectual (Decreto Legislativo No. 604, as amended) and entered into force six months after its 15 August 2024 publication in the Diario Oficial, per its own article 340 and WIPO Lex's record of that law.

Article 47(a) permits, without the author's authorization or remuneration, provided the author's name and the source are indicated, the reproduction and distribution by the press, or transmission by any medium, of current-events articles on economic, social, artistic, political or religious matters published in the media, unless the reproduction or transmission has been expressly reserved.

Article 47(b) and (c) extend the same treatment to images or sounds of a current event captured in the course of reporting it, and to speeches, addresses and similar public remarks reported as news, in each case only to the extent the informational purpose justifies.

Article 46 separately permits including brief fragments of an already lawfully divulged protected work in another work, without remuneration or the rightholder's authorization, where the inclusion is by way of quotation or for criticism, illustration, teaching or research, and the source, title and author are named.

Neither provision carries a headline-length or short-extract cap distinct from these purpose-bound tests, and no reported Salvadoran decision applies either to a systematic news aggregator rather than an individual press outlet or writer quoting a published work.