AI Governance Law: Adaptative Governance of Artificial Intelligence in Panama
By Teresa Carballo on 04 September, 2026
Key takeaways
Bill 588 has passed the legislature procedure and awaits president sanction. If promulgated, it would enter into force immediately, without a transition period.
Companies would need effective human oversight, traceability, explanations and mechanisms to challenge significant decisions.
The framework promotes controlled experimentation but leaves clear enforcement gaps.
The first Panama’s AI law introduces an immediate, decision-focused governance, while leaving key implementation questions unanswered.
One-Step away from a Panamanian AI rulebook
The National Assembly approved Bill 588 of 2026, which establishes adaptive governance of artificial intelligence in Panama, during the third debate on 19 August 2026. The bill has not been sanctioned. It now sits with the Executive, and the Constitution allows the President up to 30 working days to return it with objections. If the President sanctions it instead, Panama will have its first general artificial intelligence statute, and Article 31 provides that the law begins to govern from its promulgation. There is no vacatio legis, no phased compliance calendar, and no grandfathering of systems already in production.
Boards that have been waiting for a Panamanian AI rulebook before formalizing internal controls should treat the coming weeks as the planning window rather than the observation window.
Where the bill stands and what happens next?
Deputy Jorge Bloise presented the initiative on 26 March 2026 as Anteproyecto 419, with Deputies Manuel Cheng and Ernesto Cedeño as co-sponsors, and the Commission on Education, Culture and Sports unified it with two similar proposals. It became Bill 588 and was approved in the first debate on 15 April 2026, the second on 18 August 2026, and the third the following day.
A bill approved in the third debate passes to the Executive for sanction and promulgation. The President may object to it as inconvenient or as unconstitutional, and holds that power alone under Article 183, numeral 6 of the Constitution, within the maximum term of thirty working days set by Article 169. Based on the transmission in late August 2026, a decision should be expected in late September or early October 2026. If the President objects to the bill in full, it returns to third debate and requires a two-thirds majority; if the objection is partial, it returns to second debate. Until the text appears in the Official Gazette (in Spanish, Gaceta Oficial), it creates no obligations, and no organization should be treating it as current law.
What does Panama’s AI law apply to?
Article 2 applies the law to artificial intelligence systems that significantly influence decisions affecting the rights, opportunities, access to services, treatment, or well-being of persons across the public, private, and academic sectors, with implementation differentiated by proportionality according to the impact level, context of use, and magnitude of the associated risks.
The drafting choice that matters commercially is the anchor. Bill 588 attaches to the decision rather than to the model. Article 3 defines an artificial intelligence system as an automated system that processes data or information to assist, influence, recommend, predict, or adopt decisions, or to affect behaviours, interactions, or outcomes relevant to persons or institutions. That definition is broad enough to capture credit scoring, insurance underwriting, tenant and employment screening, transaction monitoring, and a good deal of ordinary process automation that no one in the business would describe as artificial intelligence. In our experience, the exposed party under a text drafted this way is the Panamanian entity that takes the decision, not the foreign vendor that trained the model, and the first question in any assessment should therefore be which entity in the group actually decides.
How would the bill classify AI systems?
Article 5 adopts an impact-based, risk-informed and learning-oriented approach. Under this supervision, obligations and safeguards are set according to the nature, magnitude and gravity of a system’s real or potential effects. Competent authorities must assess impact against five criteria: the degree to which the system affects fundamental rights, liberties and legitimate interests; the level of persuasion over human behaviour, decision-making or access to essential services; the scale, reversibility and duration of the effects; the vulnerability of the affected groups and the systemic implications; and the system’s level of autonomy together with the degree of human supervision, intervention and control.
Article 6 then instructs the National Secretariat of Science, Technology and Innovation (in Spanish, Secretaría Nacional de Ciencia, Tecnología e Innovación or SENACYT) to issue guidelines on impact typologies and supervision criteria and sets four levels.
The bill does not itself enumerate which uses are critical. It delegates that to SENACYT guidelines and sets no deadline for issuing them. Whether the framework is workable will be determined by those guidelines rather than by the statute, which is the single most consequential open item for anyone planning a Panamanian deployment.
The three obligations that bite immediately
Chapter II converts the principles into duties that do not depend on future regulation. Article 8 requires protection against systems that unduly manipulate human behaviour, in particular by exploiting cognitive biases, information asymmetries, or contextual vulnerabilities that affect autonomy or the capacity for informed decision-making and requires safeguards from design and development through implementation and monitoring, across the full lifecycle.
Article 9 requires meaningful human oversight for high-impact and critical-impact decisions, defined as the real capacity to understand, evaluate, intervene in, and reverse AI-assisted decisions. The article is unusually candid about the failure mode it targets; it obliges entities to establish mechanisms to evaluate the quality of that oversight and to prevent it from being reduced to a mere formal control without real effect. A named reviewer who approves every output in eleven seconds will not satisfy this provision, and the supporting record the article demands, namely clear processes, defined allocation of responsibilities, verifiable logs and sufficient institutional capacity, is what a regulator would ask to see.
Article 10 grants affected persons the right to clear, comprehensible, and contextualized information about AI-assisted decisions affecting their fundamental rights, including the relevant factors that influenced the decision, together with accessible and effective institutional mechanisms to challenge, review, and, where appropriate, correct those decisions. Article 10 also requires that those mechanisms feed institutional learning rather than resolve complaints one at a time, which is a heavier operational ask than it first appears.
Can a company test an AI system outside the applicable rules?
Within limits, yes, and this is the part of the bill that is genuinely differentiated across regions. Chapter III establishes an experimental regime around seven mechanisms listed in Article 13: an innovation hub, an innovation testbed, a public policy laboratory, a public policy prototype, a high-level experimentation framework, a regulatory sandbox, and an innovation sandbox. Only the regulatory sandbox involves temporary and supervised relaxation of binding obligations; the innovation hub expressly enables neither controlled testing nor normative exceptions.
Article 15 draws the boundary. Within an authorized regulatory sandbox, administrative, technical or procedural norms may be tested, including compliance requirements, authorization processes, supervision mechanisms, technical standards, reporting obligations, impact assessment schemes, documentation criteria and operating parameters. Any relaxation must be express, temporary, reversible, and subject to clear conditions of supervision, accountability, and continuous evaluation, and may not, in any case, suspend or limit the fundamental rights recognized in the law. Article 16 requires every experimentation project to document a strategic definition with learning hypotheses and success criteria, a risk and safeguard plan, monitoring metrics, and an exit plan that addresses termination, scaling, or replication.
Article 19 is the provision private clients will use. Public and private organizations may request guidance, accompaniment, and participation in experimentation space. They may propose that specific norms, procedures, or safeguards be subjected to experimentation and evaluation, and approved by SENACYT or the competent authority. A regulated business that considers a supervisory requirement ill-suited to an AI-assisted process would, for the first time, gain a statutory channel to propose testing an alternative.
Stricter duties for public entities
Article 15 draws the boundary. Within an authorized regulatory sandbox, administrative, technical or procedural norms may be tested, including compliance requirements, authorization processes, supervision mechanisms, technical standards, reporting obligations, impact assessment schemes, documentation criteria and operating parameters. Any relaxation must be express, temporary, reversible, and subject to clear conditions of supervision, accountability, and continuous evaluation, and may not, in any case, suspend or limit the fundamental rights recognized in the law. Article 16 requires every experimentation project to document a strategic definition with learning hypotheses and success criteria, a risk and safeguard plan, monitoring metrics, and an exit plan that addresses termination, scaling, or replication.
Article 19 is the provision private clients will use. Public and private organizations may request guidance, accompaniment, and participation in experimentation space. They may propose that specific norms, procedures, or safeguards be subjected to experimentation and evaluation, and approved by SENACYT or the competent authority. A regulated business that considers a supervisory requirement ill-suited to an AI-assisted process would, for the first time, gain a statutory channel to propose testing an alternative.
Who supervises the framework?
The bill creates no new regulator. Article 22 establishes a National Regulatory Experimentation Commission composed of one representative each from SENACYT, which chairs it, the National Public Services Authority (in Spanish, Autoridad Nacional de los Servicios Públicos or ASEP), the AIG, the National Authority for Transparency and Access to Information (in Spanish, Autoridad Nacional de Transparencia y Acceso a la Información or ANTAI), and the National Assembly. Under Articles 2 and 3, the Commission evaluates and supervises experimentation processes, verifying the proportionality of any normative flexibility, the sufficiency of the safeguards, the effective protection of rights, and the pertinence of the proposed learning objectives. At the same time, SENACYT issues technical and methodological guidelines and systematizes experimental results.
How it interacts with the law already in force
Bill 588 neither repeals nor amends existing legislation, so it would sit atop a stack that already covers most AI deployments. Law 81 of 26 March 2019 on the protection of personal data, regulated by Executive Decree 285 of 28 May 2021 and enforced by ANTAI, already grants data subjects the right not to be subject to decisions based solely on automated processing that produce adverse legal effects, with the exceptions set out in Article 19 of that law. Executive Decree 285 already requires controllers to disclose the existence of automated decision-making and profiling and to give meaningful information about the logic applied. Law 478 of 4 August 2025 reformed the Criminal Code and the Criminal Procedure Code on computer crime. On the policy side, the Cabinet Council adopted the National Artificial Intelligence Strategy by Resolution 89-26 in August 2026, a policy instrument rather than an enforceable norm.
Any client already compliant with Law 81 in its automated decision-making would be part of the way toward Articles 9 and 10. Any client that is not compliant with Law 81 today has an enforcement problem now, before Bill 588 is anywhere near promulgation.
What the bill leaves unanswered?
No sanctions regime. The text creates duties and rights without penalties, an administrative procedure, or an express competent authority for enforcement outside the experimentation regime.
No definition of “competent authority”. Articles 5 and 12 assign functions to competent authorities without identifying them, which leaves sectoral regulators to apply the impact criteria under their own statutes.
No deadline for the SENACYT guidelines under Article 6, on which the classification of high and critical impact depends.
No regulation clause and no vacatio legis. Article 31 brings the law into force on promulgation, so obligations under Articles 8, 9 and 10 would apply before any implementing guidance exists.
Overlap with ANTAI. The right to explanation in Article 10 and the right in Article 19 of Law 81 of 2019 cover much of the same ground, and the bill does not say which authority resolves a complaint that engages both.
Article 30 sets the real horizon. The State has three years from the date of promulgation to generate evidence on how the experimentation mechanism’s function. It must then prioritize specific sectoral regulation, adjust the mechanisms, and, where warranted, propose reforms, publishing a report on what it learned. The framework statute is the beginning of the regulatory cycle, not the end.
What should clients do now?
Inventory the automated systems that influence decisions about people, using the Article 3 definition rather than an internal notion of what counts as artificial intelligence.
Determine which entity in the group actually decides Panama before classifying anything. Group-level policies drafted for a foreign parent rarely correctly identify the Panamanian obligated party.
Classify each system against the five criteria in Article 5 and record the reasoning. That memorandum is the document a regulator or a claimant will ask for, and it is far cheaper to write now than to reconstruct later.
Test human oversight on high-impact systems against the standard in Article 9, including whether the reviewer can in fact reverse a decision and whether the intervention is logged.
Align customer-facing explanation and challenge procedures with both Article 10 and Article 19 of Law 81 of 2019, so that one process satisfies both.
For regulated businesses and government vendors, identify the requirements worth proposing for experimentation under Article 19 and prepare the learning hypotheses and exit plan that Article 16 will require.
Frequently asked questions
Does Panama have an artificial intelligence law?
Not yet. Bill 588 was approved in third debate on 19 August 2026 and awaits sanction by the Executive. Personal data processing by AI systems is already governed by Law 81 of 2019 and enforced by ANTAI.
When would the law take effect?
Article 31 provides that it takes effect upon the date of promulgation. If the President sanctions it, the obligations will take effect upon publication in the Gaceta Oficial, with no transition period.
Does the Bill apply to companies established outside Panama?
Article 2 does not set an express extraterritorial rule. It reaches systems that significantly influence decisions affecting persons, which, in practice, points to the Panamanian entity making the decision.
Are there fines for non-compliance?
The bill contains no penalty regime. Exposure in the near term would run through Law 81 of 2019, sectoral regulation and civil liability rather than through a new AI sanction.
Do AI systems need to be registered?
No. The bill creates no registry or notification duty. It requires traceability, documentation and safeguards proportionate to the system’s impact level.
Does it apply to a Panamanian entity that does not serve the Panamanian market?
Article 2 sets no territorial connecting factor, so the position is unsettled. A holding vehicle with no Panamanian operations has a serious territoriality argument. An entity with staff, management, or systems in Panama does not: the decision is taken here even if its effects are exported, and employee-facing systems reach persons in Panama.
For advice on how this applies to your business structure, contact us at info@pacifica.legal.