Bill 181.

Summary.

The bill establishes a framework for researching, developing, implementing, using and marketing artificial intelligence systems in the Republic of Panama. It would cover public and private entities, whether domestic or foreign, and individuals or legal entities that integrate these technologies within its territory. It defines, among other terms, personal data, datasets, developers, providers, persons responsible for implementation, users, incidents, isolated testing environments and risk.

It sets out principles of transparency, accountability, nondiscrimination, respect for rights, human oversight, traceability, accessibility, privacy, intellectual property and security. It requires express consent to process the personal data needed for a specific purpose and safeguards against malicious use and cyberattacks. It recognizes rights to be told when interacting with these systems, receive explanations of automated decisions, refuse data collection, request removal of sensitive personal data from indexes, and exercise access, rectification, cancellation and objection rights. It also provides for public participation in policies and decisions affecting individuals.

It classifies systems as posing unacceptable, high, limited or minimal risk. It prohibits placing unacceptable risk systems on the market or putting them into service and directs the Executive Branch (Órgano Ejecutivo) to regulate the categories and their risk mitigation measures. Developers and providers subject to additional requirements would have to obtain risk level certification, report incidents, verify system operation, permit audits, and suspend development, testing and use when they detect unacceptable or high risk until mitigation measures are applied. The certifying authority depends on whether an application is private, public or intended for research.

Those supplying or enabling systems would have to inform users of automated interaction, obtain consent to process and transmit sensitive or personal data, cooperate with audits and answer for resulting harm. Users would have to disclose certain uses involving works and other intellectual property, report uses with legal, technical, commercial or social implications, and cooperate with investigations. The bill provides for support for research, education, international cooperation, infrastructure and reusable public data; it incorporates these technologies into digital agendas and envisages supervised regulatory testing environments.

It creates a National Artificial Intelligence Policy aligned with the National Science, Technology and Innovation Policy and the Government Strategic Plan. The National Secretariat for Science, Technology and Innovation (SENACYT) would formulate, implement and evaluate it at least every two (2) years, subject to Cabinet Council (Consejo de Gabinete) approval and funding from the Ministry of Economy and Finance (Ministerio de Economía y Finanzas) according to budgetary capacity. It also creates the High-Level Artificial Intelligence Commission (Comisión de Alto Nivel de Inteligencia Artificial) for consultation, monitoring, coordination, training and advice. Its membership includes public bodies, universities, and business and academic organizations. The Ministry of Commerce and Industries (Ministerio de Comercio e Industrias), through the General Directorate of Electronic Commerce (Dirección General de Comercio Electrónico), would be responsible for implementing regulations and handling complaints; other authorities would issue data protection guidance and monitor labor effects.

The General Directorate of Electronic Commerce would register applications by risk category and alert the public to high or unacceptable risk systems. Together with the National Authority for Government Innovation (Autoridad Nacional para la Innovación Gubernamental), each within its area of responsibility, it could audit, supervise and suspend systems when human rights are violated. Complaints would go to the relevant sector authority, the Consumer Protection and Competition Defense Authority (Autoridad de Protección al Consumidor y Defensa de la Competencia), or the National Authority for Transparency and Access to Information (Autoridad Nacional de Transparencia y Acceso a la Información), depending on the matter. The Executive Branch would have one (1) year to issue implementing regulations, and certain entities would have two (2) years to comply. The bill would take effect upon publication in the Official Gazette. Its provisions concern the named authorities, the education, technology, labor and commercial sectors, and people whose data is processed.