TerraLex AI Guide

Uruguay does not yet have a comprehensive AI-specific law in force. There is no binding AI statute regulating AI systems end-to-end.

Article 74 of Law No. 20.212 mandates the development of a national AI and data strategy and allows AGESIC to issue recommendations and criteria for AI systems . AGESIC is the governmental agency under the Presidency responsible for digital government and data governance policies in Uruguay. It leads the national AI strategy and issues guidance on the responsible use of AI, especially in public administration.

There are draft proposals on topics like misinformation and criminalization of AI-generated sexual content (deepfakes), but these are in legislative process.

The government has publicly discussed an AI regulation initiative, potentially to be developed around 2026.

In line with this initiative, on September 2, 2025, Uruguay adhered to the Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law, which seeks to ensure that the development and use of AI systems respect fundamental rights, democratic values, and the rule of law.

Uruguay does not currently have a statutory definition of “artificial intelligence” in binding legislation.

The main conceptual reference comes from a public policy document issued by AGESIC titled “Estrategia de Inteligencia Artificial para el Gobierno Digital”.

This document is not a law, but a governmental strategy applicable primarily to the public sector.

In that strategy, AI is described in broad, policy-oriented terms, generally consistent with international definitions: systems or technologies capable of performing tasks that typically require human intelligence, such as prediction, classification, pattern recognition, or decision support.

The current approach is horizontal and principles-based, relying on public policy (e.g., AI strategy, ethical guidelines) rather than a formal risk-based legal regime.

AI practice is indirectly regulated through general laws (data protection, consumer law, criminal law) as applied to AI-related activities.

Because there’s no specific AI law yet, actors are covered via general legal roles:

• Data controllers/processors under data protection law;

• Public entities using automated systems (as per AGESIC guidance);

• Companies subject to existing regulation (e.g., financial, consumer).

Relevant existing laws include:

• Personal Data Protection Law (Law N° 18.331) applies to automated processing of personal data and informs responsible use of data in AI systems.

• Consumer Protection Law (Law N° 17.250) and criminal law provisions (e.g., proposed deepfakes penalization).

• Law on Access to Public Information (Law 18.381)

There’s no AI law with its own territorial scope. Existing applicable laws (e.g., data protection) generally apply to activities within Uruguay and, in some cases, extraterritorially if they affect Uruguayan data subjects or services.

No sector-specific AI law exists. AI impacts are regulated across sectors through horizontal laws, including: public administration, finance, health, consumer markets.

AGESIC is tasked with national AI strategy and may issue recommendations or criteria for AI systems’ development and implementation.

URCDP (Unidad Reguladora y de Control de Datos Personales) enforces data protection law, which is a core legal framework affecting data-intensive AI systems .

The URCDP serves as the competent authority for data protection matters in Uruguay. It is empowered to supervise compliance with applicable legislation, manage the registration of databases, oversee processing activities, authorize specific international transfers of personal data, and apply administrative sanctions where violations occur.

Additional authorities may participate depending on context:

• Sectoral regulators (e.g., telecommunications, financial authority) for regulated entities.

• Consumer protection bodies, competition authority, and judiciary for enforcement via existing laws.

Because there’s no AI-specific regime yet, enforcement and sanctions derive from applicable laws, for example:

• Data protection sanctions (monetary fines, corrective orders) via the URCDP.

• Consumer protection penalties and possible criminal sanctions for certain offenses (e.g., deepfakes, depending on legislative outcomes).