What is AI regulation in Cuba?
AI regulation: countries and regions
Cuba has no dedicated artificial intelligence law, bill, or binding AI-specific regulation. AI is governed indirectly through Law 149/2022 on Personal Data Protection (in force since February 2023) and a policy-level national AI strategy approved by the Council of Ministers on 29 May 2024 as part of the Policy for Digital Transformation, led by the Ministry of Communications (MINCOM). There is no independent regulator and no statutory AI duties for developers or deployers.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
Cuba does not regulate artificial intelligence directly. There is no AI statute, no AI bill before the National Assembly, and no binding rule that targets AI systems specifically. What exists is a general personal data protection law and a set of government policy documents that mention AI as a goal rather than a regulated activity.
The binding legal anchor is Law 149/2022 "De Proteccion de Datos Personales" (the Personal Data Protection Law, or LPDP), approved on 14 May 2022, published in the Gaceta Oficial No. 90 on 25 August 2022, and in force 180 days later, around 21 February 2023. It gives effect to privacy rights in the 2019 Constitution and applies to anyone processing personal data, including automated processing. It is supported by MINCOM Resolution 58/2022, which regulates the security and protection of personal data held in electronic form.
Separately, on 29 May 2024 the Council of Ministers approved a Policy for Digital Transformation, a Cuban Digital Agenda, and a Strategy for the Development and Use of Artificial Intelligence. These are state planning instruments, not enforceable AI law. They set ethical aims and priority sectors and assign coordination to MINCOM, but they do not create AI-specific legal duties or penalties.
Why it matters
For any organisation deploying or governing AI that touches Cuban residents, the practical compliance surface is data protection, not AI law. If your AI system collects, stores, profiles, or makes decisions about identifiable people in Cuba, Law 149/2022 applies regardless of the technology used. That includes a right for individuals to object to automated individual decision-making, which is the closest thing in Cuban law to an AI-specific control.
It also matters that Cuba is a heavily state-led environment. The data law binds public and private bodies alike, but its enforcement runs through existing state organs rather than an independent regulator, and it contains broad public-interest, public-order, and national-security exceptions. Foreign operators should treat the AI strategy as a signal of government direction and procurement priorities, not as a rulebook that creates rights or obligations they can rely on.
How it works
No dedicated AI statute
There is no Cuban law, decree-law, or decree that regulates artificial intelligence as such. AI is addressed only at policy level and indirectly through data protection and broader information and communication technology (ICT) rules. Any claim that Cuba has an "AI Act" or an AI regulator is incorrect as of mid-2026.
The binding anchor: Law 149/2022 on Personal Data Protection
Law 149/2022 is Cuba's first comprehensive data protection law. It rests on Articles 40, 48, and 97 of the 2019 Constitution, which recognise human dignity, privacy of personal and family life, image and voice, and the right to access and correct one's personal data. The law applies to natural persons regarding their data and to natural and legal persons that process personal data, in both the public and private sectors, in physical or digital form.
The law sets out a list of data protection principles, including collection limitation, data quality, purpose specification, use limitation, legitimacy, security safeguards, transparency, individual participation, accountability, legality, grades of reserve, and consent. Notably, Cuban law accepts tacit consent (treating a failure to object as consent) for non-sensitive data, while sensitive data requires express consent. Sensitive categories include health, religious belief, and sexual orientation, but the statutory list does not clearly include political opinions or biometric data.
Data subject rights, including objection to automated decisions
Individuals have rights of access, rectification, cancellation (deletion), and non-disclosure, plus a right to object. Article 23 includes a right to object to processing, whether automated or not, that significantly affects the person's rights and interests or that evaluates personal aspects such as professional performance, economic situation, health, reliability, or behaviour. This profiling-style provision is the single most AI-relevant clause in Cuban law.
Enforcement: no independent data protection authority
Cuba did not create an independent supervisory authority. The Ministry of Justice (MINJUS) is charged with controlling compliance and oversees a national registry of databases. The "accion de proteccion de datos personales" (data protection action) is heard, in first instance, by the hierarchical superior of the controller when that controller sits within a central state administration body or national entity, and otherwise before the competent court. Administrative fines are imposed by authorised officials of the central state administration and national entities within their competence. Sanctions include a warning, a fine of up to 20,000 Cuban pesos (CUP), suspension of the relevant database for up to five days, and closure of the file or database. Because Cuba does not have separation of powers in the Western sense, independent legal analysts have described this hierarchical, in-house enforcement model as too convoluted and insufficiently independent to give citizens adequate guarantees that their data are secure.
The implementing regulation: MINCOM Resolution 58/2022
The implementing instrument is Resolution 58/2022 of the Ministry of Communications, the "Reglamento para la Seguridad y Proteccion de los Datos Personales en Soporte Electronico" (Regulation for the Security and Protection of Personal Data in Electronic Form), published in the same Gaceta No. 90 and in force on the same 180-day timetable. It applies to telecommunications and ICT operators and service providers and addresses technical and organisational security of electronic personal data. There is no instrument numbered "Decreto 64/2022" on personal data protection; the relevant implementing text is Resolution 58/2022.
The policy layer: national AI strategy and digital transformation
On 29 May 2024 the Council of Ministers approved three linked instruments: the Policy for Digital Transformation, the Cuban Digital Agenda, and the Strategy for the Development and Use of Artificial Intelligence. The digital transformation policy is organised around eight strategic axes, including a normative framework, infrastructure and connectivity, digital economy, digital government, innovation, cybersecurity, and digital content. It builds on the earlier 2017 "Politica Integral para el Perfeccionamiento de la Informatizacion de la Sociedad."
The AI strategy, led by MINCOM, sets six axes: ethics and the legal framework; human capital; applications and services; public administration; science and innovation; and social communication. It states aims that AI systems respect fundamental rights and be safe, transparent, explainable, non-discriminatory, and protective of data and privacy, and it prioritises sectors such as agriculture, health, education, transport, water, tourism, industry, and public administration. Governance is coordinated by MINCOM with an advisory council, with monitoring through the digital transformation framework. These are aspirational planning aims; they do not create enforceable legal duties.
Examples
A bank or fintech operating in Cuba that uses an automated model to score or screen customers is processing personal data under Law 149/2022. It must satisfy the law's principles and honour data subject rights, and individuals may invoke the Article 23 right to object to automated processing that significantly affects them. There is no separate AI conformity assessment to complete, because no AI law exists.
A public administration body digitising a service under the Cuban Digital Agenda, for example tax administration or digital health, is acting on the policy goals of the 2024 Policy for Digital Transformation. Its data processing remains governed by Law 149/2022 and, where data is held electronically, by MINCOM Resolution 58/2022, including the requirement to keep personal data secure.
A foreign software vendor selling an AI tool into Cuba should map obligations to the data protection law and the electronic-data security regulation, and treat the national AI strategy as a guide to government priorities and procurement, not as a source of binding AI compliance requirements.
Common misunderstandings
"Cuba has an AI law." It does not. As of mid-2026 there is no AI statute, bill, or binding AI-specific rule; AI is covered only by policy and by general data protection law.
"The 2024 AI strategy regulates AI." The strategy is a government planning document approved by the Council of Ministers. It sets aims and priorities but creates no enforceable duties, rights, or penalties.
"Cuba has an independent data protection regulator." It does not. The Ministry of Justice controls compliance, complaints are heard by the controller's hierarchical superior or the competent court, and fines are imposed by state officials, not by a stand-alone authority.
"Consent in Cuba works like the EU GDPR." It does not. Cuban law permits tacit consent (silence treated as consent) for non-sensitive data, which the EU rejected in 2018; only sensitive data requires express consent.
"The data law fully protects citizens against the state." Broad exceptions for public order, general welfare, defence, and national security, plus the lack of an independent regulator, significantly limit protection against state processing.
Risks and boundaries
This article describes governance architecture, not legal advice. The key boundary is that Cuba's AI governance is policy-led, not law-led: the only binding rules that reach AI are the general data protection law and ICT security regulations.
Legal status to keep in view: Law 149/2022 is in force and enforceable, but enforcement runs through hierarchical state organs and courts rather than an independent regulator, and the statute contains broad discretionary exceptions. The 2024 AI strategy and Digital Agenda are adopted policy, not legislation, and could change as implementation proceeds; the strategy itself flags a future legal and technical normative framework for AI, which had not been enacted as separate AI law at the time of writing. Independent assessments and government communications diverge sharply on how far rights are protected in practice, so the gap between text and enforcement is real and should be assumed.
What to do next
Treat data protection as your compliance baseline. If your AI processes personal data of people in Cuba, map your processing to Law 149/2022: lawful basis and consent, the principles, data subject rights, security duties, and the electronic-data security rules in MINCOM Resolution 58/2022.
Build automated-decision controls now. Because Article 23 lets individuals object to significant automated or profiling-based processing, document where your AI makes or supports decisions about people, and provide a route to human review and objection.
Watch the policy layer for signals, not rules. Track MINCOM and the Council of Ministers for any move from strategy to binding AI law, and treat the national AI strategy as guidance on government priorities and procurement.
Do not assume EU-style protections transfer. Account for tacit consent, the absence of an independent regulator, and broad public-interest and national-security exceptions when assessing risk and advising stakeholders.
Re-evaluate if any of these thresholds are crossed: publication of a dedicated AI decree-law or bill; creation of an AI or data protection authority; or a new implementing decree expanding obligations for automated processing.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Cuba have an AI law?
No. As of mid-2026 Cuba has no dedicated AI law, bill, or binding AI-specific regulation. AI is addressed through a policy-level strategy and indirectly through the personal data protection law.
What is the main law that affects AI in Cuba?
Law 149/2022 on Personal Data Protection, in force since around 21 February 2023, which governs any processing of personal data, including automated processing, by public and private bodies.
Is there an AI regulator or a data protection authority in Cuba?
No independent authority exists. The Ministry of Justice controls compliance with the data law, complaints go to the controller's hierarchical superior or the competent court, and fines are imposed by state officials.
Does Cuban law restrict automated decision-making?
Yes, indirectly. Article 23 of Law 149/2022 lets individuals object to automated or non-automated processing that significantly affects their rights or evaluates personal aspects such as performance, health, or behaviour.
What is Cuba's national AI strategy?
The Strategy for the Development and Use of Artificial Intelligence, approved by the Council of Ministers on 29 May 2024 as part of the Policy for Digital Transformation, led by MINCOM, with six axes including ethics and legal framework, human capital, and applications.
What are the penalties under the data protection law?
Sanctions include a warning, a fine of up to 20,000 Cuban pesos, suspension of the relevant database for up to five days, and closure of the file or database.
Is the AI strategy legally binding?
No. It is an adopted government policy and planning instrument. It sets aims and priorities but does not create enforceable legal duties, rights, or penalties.
How does Cuba compare with the rest of the Caribbean and Latin America?
Cuba enacted comprehensive data protection later than several neighbours and, unlike some, did not create an independent regulator. It placed in the lowest tier of the 2024 Latin American Artificial Intelligence Index, ranking 15th of 19 countries assessed. Regional AI governance is being shaped at policy level through bodies such as CARICOM, of which Cuba is not a member.