Ecuador Archives Its Artificial Intelligence Law: What It Means for Businesses

On September 15 the plenary of Ecuador's National Assembly archived, with 88 votes, the Organic Law for the Regulation and Promotion of Artificial Intelligence. The decision followed a report from the Commission on Education, Culture, Science, Technology, Innovation and Ancestral Knowledge, which back on August 31 had already recommended shelving the initiative over technical and legal objections. The vote was reported by Prensa Latina and by local outlets covering the debate.

The question that summed up the session came from assembly member Esteban Torres: "are we prepared to legislate on a technology that changes every day?" For Ecuadorian companies, the practical answer matters less than the consequence: there is no specific AI law in the country today, and that does not mean there are no rules.

Why it was archived

The commission's report identified three substantive problems. First, budgetary: the proposal created new institutional obligations —specialized staff, technology infrastructure, information systems, training and oversight mechanisms— implying an unbudgeted increase in public spending, in tension with Article 135 of the Constitution, which reserves to the Executive the initiative for laws that create expenditure. Second, design: the text imposed barriers on national technological development and did not fit well with the legal framework already in force. Third, protection: the mechanisms to safeguard the rights of children and adolescents were deemed insufficient.

Shelving the bill doesn't close the subject. On September 1 assembly member Cecilia Baltazar introduced an alternative Organic Law for the Development, Ethical Use and Governance of Artificial Intelligence, still in the legislative pipeline, which proposes classifying AI by risk level — an approach closer to European rules.

So which framework applies today

No AI law does not mean AI use inside a company is open ground. Three sets of rules already apply, and they are the ones an auditor or a corporate client will look at:

• The LOPDP. Ecuador's Organic Law on Personal Data Protection governs any processing of personal data, including processing done by an AI model. Legal basis, declared purpose, data minimization and data-subject rights apply the same whether a spreadsheet or a frontier model does the processing.
• Sector regulation. Banking, insurance, healthcare and the public sector have their own traceability and control requirements, which don't wait for an AI law to be enforced.
• The national AI strategy. In March 2026 Ecuador adopted a strategy to promote the ethical development and use of AI with a 2025–2029 roadmap. It isn't binding the way a law is, but it sets the direction future regulation and public procurement will follow.

What this means for your SME

• A legal gap isn't a permit, it's a responsibility. With no specific rules, each company defines its own controls; if a law does arrive, whoever already documented their processes adapts, and whoever didn't starts from zero.
• What's optional today will be required later. Classifying every AI use by risk, logging what the system decided, and keeping human review on sensitive decisions are practices the Baltazar bill already anticipates.
• Personal data is the real exposure point. The immediate risk isn't a fine for "using AI," it's a sanction for processing personal data without a legal basis while feeding a tool.
• Ask where your data lives. Before signing up for any AI service, confirm retention, where processing happens, and whether your data is used to train models.

How We Approach It at SimCodec

At SimCodec we design automations and AI agents starting from the data: what information the system touches, where it is processed, how long it is retained, and what gets logged about every automated decision. We build human validation checkpoints into the highest-impact flows and use zero-retention configurations when the case calls for it, aligned with the LOPDP rather than with whatever a future law might ask.

If your company already uses AI and wants to get the "how" in order before regulation requires it, let's talk at simcod.ec/es/contacto.