✦ AI consulting · Updated 2026-10-26
AI use policy: clear rules before problems.
An AI use policy tells your team which tools it can use, which data never to upload and who reviews what AI produces. It is short, easy to understand and protects the company without slowing anyone down. We also review what Uruguayan regulation requires today.
At a glance
- AI law in Uruguay?
- No specific law in force (as of October 2026)
- What does apply
- Law 18,331 on personal data protection
- Public framework
- Law 20,212, art. 74 and National AI Strategy 2024-2030
- Test environments
- Decree 276/025 for innovative projects with data and AI
- First step
- A one- or two-page use policy
What an AI use policy should include
- Approved tools and which account to use them with (always the company's).
- Data never to upload: personal data of customers or employees, health data, passwords and credentials, non-public financial information, confidential contracts and proprietary code.
- Mandatory human review before sending, publishing or deciding based on AI output.
- Transparency: when to tell a customer that content or a reply used AI.
- Intellectual property: care when using AI-generated text, images or code.
- Who to ask when in doubt and how to report a mistake or a leak.
- How a new tool gets approved before anyone starts using it.
What Uruguayan regulation says
As of October 2026, Uruguay has no specific artificial intelligence law. Article 74 of Law 20,212 tasked AGESIC with a national data and AI strategy for the public and private sectors, working jointly with the personal data regulator (URCDP) on anything involving personal data, and with a report of recommendations to regulate AI.
The National AI Strategy 2024-2030 includes a line to boost AI adoption in the private sector, with a focus on small and medium businesses. Decree 276/025 regulates controlled test environments for innovative projects, especially with data and AI.
What does apply today to any company is Law 18,331: if AI processes personal data, the principles of purpose, consent and security apply, along with the international transfer rules when the vendor processes data abroad. If your company sells to the European Union, the EU AI Act may apply too.
Shadow AI
According to the Udelar survey, 66% of people who use generative AI at work in Uruguay started on their own initiative. Banning it does not work: people keep using it, just out of sight. What works is offering an approved tool, simple rules and training.
→ How I help
Related terms
- A tailored AI use policy, short and enforceable.
- An inventory of the AI already used in the company.
- Review of AI vendors against Law 18,331.
- AI governance for companies that build or integrate their own systems.
? FAQ
Is there an artificial intelligence law in Uruguay?
As of October 2026 there is no specific law. What applies is Law 18,331 on personal data protection, article 74 of Law 20,212, which tasked AGESIC with the national data and AI strategy, and Decree 276/025 on test environments.
Can I upload customer data to ChatGPT?
Only if the company uses a business plan that does not train on your data, the purpose is compatible with what you told the customer and the international transfer rules of Law 18,331 are respected. With personal or free accounts, no.
Should a company ban AI?
Usually not: people keep using it on their own and the company loses visibility. An approved tool, a clear policy and training work better.
Sources
- Law 20,212, art. 74 (IMPO, in Spanish) ↗
- National Artificial Intelligence Strategy 2024-2030 (AGESIC, in Spanish) ↗
- Decree 276/025 (IMPO, in Spanish) ↗
- Law 18,331 on personal data protection (IMPO, in Spanish) ↗
- National Survey on Advanced Digital Systems and Work (FCS, Udelar / ANII, 2026, in Spanish) ↗