What is AI regulation in Panama?
AI regulation: countries and regions
As of June 2026, Panama has no AI-specific statute in force. Artificial intelligence is governed by existing law: the Personal Data Protection Law (Law 81 of 2019) supervised by ANTAI, the government digital transformation regime (Law 144 of 2020) led by the AIG, the 2025 cybercrime law, sector rules, and constitutional privacy rights. Several AI bills are before the National Assembly, and a national AI strategy is being finalised, but nothing dedicated has been enacted.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
AI regulation in Panama refers to the mix of laws, policies and institutions that currently govern how artificial intelligence is built and used in the country, even though Panama has not passed a dedicated AI law. The honest summary is that Panama is in a pre-statute phase: it relies on general legal instruments that were not written for AI but apply to it, plus high-level policy work and a set of pending legislative proposals.
In practice, the load-bearing rules are about data, not AI as such. The Personal Data Protection Law (Law 81 of 2019) and its implementing Executive Decree 285 of 2021 govern how personal data is processed, including by automated means, and are enforced by the National Authority for Transparency and Access to Information (ANTAI). Government use of digital technology, including AI in public services, sits under Law 144 of 2020 and the National Authority for Government Innovation (AIG). Criminal misuse of technology is addressed through the Criminal Code as amended by Law 478 of 2025.
Alongside this, Panama is developing a National AI Strategy with academic partners and is debating several AI bills. None of these has become binding law yet, so the strategy and bills are best understood as direction-setting rather than enforceable duties.
Why it matters
For anyone deploying or governing AI in Panama, the key practical point is that the absence of a dedicated AI law does not mean an absence of legal exposure. Personal data rules already bite on most real AI systems, because training, profiling and automated decision-making typically involve personal data. ANTAI can investigate complaints, audit databases and impose administrative fines, so AI projects that touch Panamanian personal data face concrete compliance duties today.
It also matters because the legal position is moving. Panama has positioned itself as a prospective regional digital and logistics hub, and its government has signalled a deliberately light, innovation-friendly posture rather than an EU-style prescriptive regime. That creates opportunity but also uncertainty: organisations that build governance only to today's data law may need to adapt quickly if an AI bill passes or the national strategy hardens into binding requirements. Watching the legislative pipeline is therefore a planning issue, not just a legal curiosity.
Finally, Panama's cross-border role means international and regional commitments shape expectations. Alignment with instruments such as the UNESCO Recommendation on the Ethics of AI and the Inter-American work of the Organisation of American States influences the direction of travel, even where they are not directly binding.
How it works
The current model: govern AI through existing law
Panama follows what officials describe as a policy-first, innovation-led approach. Rather than enacting an AI-specific framework, it applies general and sectoral law to AI and is building a national strategy before committing to a dedicated statute. This places Panama among the many Latin American jurisdictions that, as of mid-2026, regulate AI mainly through data protection law, constitutional rights and sector rules while AI bills remain in debate.
Data protection: Law 81 of 2019 and Decree 285 of 2021
The cornerstone is the Personal Data Protection Law (Law 81 of 26 March 2019), in force since 29 March 2021, with its implementing regulation, Executive Decree 285 of 28 May 2021. The law is partly modelled on the EU GDPR. It sets out principles (including loyalty, purpose, proportionality, accuracy, security, transparency, confidentiality, lawfulness and portability), defines controller, processor and data subject roles, regulates cross-border transfers to jurisdictions with adequate protection, and grants individuals rights of access, rectification, cancellation, opposition and portability. Sensitive data, including biometric and genetic data, attracts stricter requirements. Under Article 36, ANTAI, acting through its Personal Data Protection Directorate, can impose administrative fines from 1,000 to 10,000 US dollars depending on severity, classified as minor, serious or very serious; very serious breaches are not subject to limitation and can lead to closure of the database. For AI, the relevant levers are the rules on automated processing, transparency duties and data security, which apply whenever a system processes personal data of people in Panama.
Responsible institutions
Two bodies dominate. ANTAI (the National Authority for Transparency and Access to Information), through its Personal Data Protection Directorate, supervises and enforces data protection law. The AIG (the National Authority for Government Innovation), established by Law 65 of 2009, leads digital government, the national digital agenda and public-sector technology adoption, and supports ANTAI on data security. The Senacyt (National Secretariat of Science, Technology and Innovation) leads AI strategy development and frames AI as a critical and emerging technology. There is, as yet, no dedicated AI regulator.
Government digital transformation: Law 144 of 2020
Law 144 of 15 April 2020 modernises and makes mandatory the use of electronic means for government procedures, amending Law 83 of 2012, and obliges public entities to run digital agendas under AIG coordination. It provides the legal basis for the state to deploy digital tools, including AI, in public services, while requiring respect for personal data rules and limiting public servants' access to sensitive information.
Criminal and sectoral law
Law 478 of 4 August 2025 reformed the Criminal Code and Criminal Procedure Code to strengthen the cybercrime regime and international cooperation. It does not regulate AI as such, but it is relevant to AI-enabled offences such as fraud and identity crimes. Sector regulators apply their own rules; for example, the insurance regulator issued tailored data rules in 2025, and banking, securities and health information are governed by special laws that pre-date and sit alongside Law 81.
The National AI Strategy
Panama has been formulating a National AI Strategy through Senacyt in partnership with the Georgia Institute of Technology and Georgia Tech Panama. The work has run through an ecosystem assessment, multi-sector workshops (co-led on 7 and 8 July 2025 by Georgia Tech's Tech AI hub, including Dr Pascal Van Hentenryck), and a National AI Survey that drew more than 6,000 respondents, of whom 84 per cent expressed interest in learning more about AI. Senacyt's secretary, Dr Eduardo Ortega Barria, has framed the strategy around four pillars: citizens (training, opportunity and social development); economy (workforce and business); government and governance (ethics, privacy, democracy and leadership); and partnerships (international cooperation and projection). A companion action plan was expected to launch around mid-2026. The strategy is a policy document, not binding law, and its detailed content should be verified against the final published version.
The pending bills
Several AI bills have moved through the National Assembly without being enacted. The first, Anteproyecto 014 of 2023, came via citizen participation and did not reach first debate; it was re-presented as Anteproyecto 162 of 2024. Anteproyecto 149 of 2023, an investment-promotion bill, lapsed at the close of the prior legislature. Anteproyecto 339 of 2025 continued the regulatory line and became Proyecto de Ley 413 of 2025, which committee records describe as rejected at committee stage. The most advanced is Proyecto de Ley 588, sponsored by deputy Jorge Bloise (chair of the Education, Culture and Sport Committee) and unifying proposals by deputies Manuel Cheng and Ernesto Cedeno, which establishes an "adaptive governance" framework for AI. It was approved in first debate on 15 April 2026; there is no confirmed advancement to second or third debate, full plenary approval, or presidential sanction as of 8 June 2026. Status should always be re-checked against the Assembly's own records, as numbering and stages shift.
Regional and international alignment
Panama is a UNESCO member and the UNESCO Recommendation on the Ethics of AI (2021) applies to all member states as a voluntary instrument. At the inter-American level, the Organisation of American States has advanced an AI agenda, including the Inter-American Framework on Data Governance and AI (MIGDIA) and a Declaration and Plan of Action on safe, secure and trustworthy AI, adopted by science and technology ministers in Washington, D.C. on 13 December 2024 and paired with a US-funded project to develop an AI policy framework for the Americas. Within Central America, Panama is a member of the SICA integration system, whose Regional Digital Strategy (ERDI) has been developing a charter of ethical AI principles; Panama's AIG participated in ERDI working group meetings into 2026. Panama also takes part in the Ibero-American Data Protection Network (RIPD). On the OECD AI Principles (2019, updated 2024), Panama is not currently among the adherents, though it is influenced by them and by the EU AI Act as reference points.
Examples
A bank or fintech in Panama City deploying an automated credit-scoring or fraud-detection model is regulated today not by an AI law but by Law 81 of 2019 and banking-sector data rules. It must have a lawful basis for processing, maintain a database registry available to ANTAI, secure the data, and respect data-subject rights, including in relation to automated decisions.
A public agency rolling out an AI chatbot or document-processing tool operates under Law 144 of 2020 and AIG coordination, within the national digital agenda. During the pandemic, the AIG deployed a health chatbot called Rosa to support Covid-19 patients, an example of public-sector automation under the digital transformation regime rather than under any AI-specific statute.
A company producing or distributing AI-generated deepfakes or voice clones for fraud or defamation can be pursued under the Criminal Code as amended by Law 478 of 2025 and related provisions, rather than under a bespoke AI law. The pending AI bills explicitly target malicious deepfakes, videofakes and audiofakes, but those prohibitions are not yet enacted.
Common misunderstandings
"Panama has an AI law." It does not, as of June 2026. It has data protection, digital government and cybercrime law that apply to AI, plus pending bills and a strategy in progress.
"Because there is no AI law, AI is unregulated." Incorrect. Personal data processing by AI is squarely within Law 81 of 2019, enforced by ANTAI, with real fines and audit powers.
"The National AI Strategy creates binding duties." It is policy and direction-setting. It can shape future law and public-sector practice, but it is not an enforceable statute.
"A bill that passed first debate is now law." No. Panamanian bills require multiple debates, plenary approval and presidential sanction. Proyecto de Ley 588 cleared only first debate and has no confirmed further progress.
"Panama follows the EU AI Act." It references European and OECD standards, but it has chosen a lighter, innovation-led, adaptive-governance direction rather than the EU's prescriptive risk tiers, and it is not an OECD AI Principles adherent.
Risks and boundaries
The central boundary is that Panama has no dedicated, enforceable AI statute, so anyone relying on a single "Panama AI law" is mistaken. The governing duties come from data protection, digital government and criminal law, plus sector rules, and these do not cover every AI harm (for example, model transparency or algorithmic fairness obligations beyond what data law implies).
Legal status is genuinely uncertain and fast-moving. Multiple bills have been introduced, renumbered, lapsed or rejected at committee. The most advanced, Proyecto de Ley 588 on adaptive governance, has only passed first debate, and there is no confirmed sign it has advanced further as of mid-2026. Any of these could change, be merged, or stall. Sources sometimes conflict on bill stages and even on whether a 2021 national AI strategy exists; the durable position is that a comprehensive national strategy is being finalised with Georgia Tech and that no AI-specific statute is in force.
This page is not legal advice and does not design firm-specific compliance. It is also not a data protection guide: the detailed mechanics of Law 81 belong on dedicated privacy pages. Treat the linked navigation pages as adjacent context, not as Panama-specific rules.
What to do next
Start from data protection. If your AI touches personal data of people in Panama, build to Law 81 of 2019 and Decree 285 of 2021 now: lawful basis, database registry, security measures, transparency, handling of automated decisions, and cross-border transfer controls. This is the enforceable layer today.
Map your institutional touchpoints. Identify whether you interact with ANTAI (data protection), the AIG (public-sector or digital-government projects) or a sector regulator (for example banking, securities, insurance or health), and align to the rules that actually apply to your use.
Track the legislative pipeline deliberately. Assign someone to monitor the National Assembly's records for Proyecto de Ley 588 and any successor AI bill, and the publication of the National AI Strategy and its action plan. Set a trigger: if a bill reaches second debate or the strategy publishes binding commitments, revisit your governance.
Adopt durable, framework-neutral governance now. Use recognised reference points (UNESCO ethics principles, OECD AI Principles, and international standards) to put in place documentation, human oversight, risk assessment and transparency practices. These travel well across whatever Panama enacts and reduce rework.
Watch deepfake and criminal-misuse exposure. Given Law 478 of 2025 and the bills' focus on malicious synthetic media, ensure your use of generative tools cannot be characterised as facilitating fraud, impersonation or defamation.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Panama have a dedicated AI law?
No. As of June 2026 there is no AI-specific statute in force. AI is governed by existing data protection, digital government and criminal law, alongside sector rules and constitutional privacy protections, while AI bills are debated.
Which law matters most for AI in Panama right now?
The Personal Data Protection Law (Law 81 of 2019) and its Executive Decree 285 of 2021, enforced by ANTAI. Most real AI systems process personal data, so these rules apply directly, including to automated decision-making.
Who regulates AI in Panama?
There is no dedicated AI regulator. ANTAI enforces data protection; the AIG leads digital government and the national digital agenda; Senacyt leads AI strategy. Sector regulators apply their own rules.
What is the status of the AI bills?
Several have lapsed, been rejected at committee or been renumbered. The most advanced, Proyecto de Ley 588 on adaptive governance, passed first debate on 15 April 2026 with no confirmed further progress as of 8 June 2026.
Does Panama have a national AI strategy?
A National AI Strategy is being finalised by Senacyt with Georgia Tech, structured around four pillars (citizens, economy, government and governance, and partnerships), with an action plan expected around mid-2026. It is policy, not binding law.
Is Panama aligned with the EU AI Act or the OECD AI Principles?
Panama references both as benchmarks but has chosen a lighter, innovation-led approach. It is not currently an adherent to the OECD AI Principles. It is a UNESCO member, so the UNESCO AI ethics recommendation applies as a voluntary instrument.
What regional commitments affect Panama?
Panama engages with the Organisation of American States AI agenda (including the MIGDIA data and AI governance framework), the SICA Regional Digital Strategy's ethical AI work, and the Ibero-American Data Protection Network.
What should businesses do while there is no AI law?
Comply with data protection rules now, map your regulator touchpoints, monitor the bills and strategy, and adopt framework-neutral governance (documentation, human oversight, transparency, risk assessment) so you can adapt quickly when law changes.