Bill 413.

Summary.

The bill establishes rules for the development, implementation, and use of artificial intelligence in Panama in relation to the Constitution and the international treaties or conventions signed by Panama. It covers the processing of information and personal data by public and private entities. Among other concepts, it defines developers, data controllers and processors, interpretability, algorithmic bias, and transparency. It requires data controllers to certify completion of diploma courses of at least 120 hours in human and fundamental rights.

It sets out principles of fairness, responsibility, human oversight, privacy, security, inclusion, sustainability, transparency, and accountability. It links their application to the rights mentioned in Panama’s Political Constitution, including dignity, equality, privacy, freedom of expression, and access to justice. It also establishes values concerning human rights, coexistence, diversity, and environmental protection. It classifies systems as posing unacceptable, high, limited, or no risk; prohibits systems posing unacceptable risk; and allows automation in public and private entities subject to the bill’s principles.

Affected persons could request human review, file complaints, seek revocation, and request interim measures. Those intending to implement systems would have to publish a prior assessment of risks and impacts on rights; users would have to give informed, free, and voluntary consent, and those responsible would have to inform them when they interact with these systems. The bill sets the minimum age for use at 18 years. If an institution eliminates jobs because of implementation, it must reassign the worker on equal or better terms for at least 6 months before proceeding under the Labor Code.

It excludes uses such as behavioral manipulation, credit scoring through profiling, certain biometric applications, social scoring, electoral influence, and the determination of judicial decisions. It assigns legal responsibility to institutions that develop or contract for the systems and establishes an environmental approach for developers. It requires systems to be registered and directs the National Secretariat for Science, Technology and Innovation (Secretaría Nacional de Ciencia, Tecnología e Innovación, SENACYT) to establish an oversight and audit unit. It requires a prior assessment for high-risk systems and also provides for measures against bias, explanations of automated decisions, data protection, and rights of access, rectification, cancellation, and objection.

It provides for regulation of the use of artificial intelligence in health, finance, transportation, education, justice, and public administration. It assigns algorithm audits and administration of a platform where developer companies would register their models for certification to the Superintendency of Industry and Commerce (Superintendencia de Industria y Comercio). It restricts the transfer and exchange of personal data intended for these systems. It designates the National Secretariat for Science, Technology and Innovation as the regulatory authority and provides for fines, prohibitions, and other measures according to the violation. It mentions possible implications of Law 31 of February 8, 1996, for telecommunications, without expressly amending that law.

It also establishes safeguards against discrimination and harm, human rights reports before implementation, and training on those rights. It provides for campaigns for public servants and students, as well as the promotion of educational, scientific, cultural, and administrative applications by the National Secretariat for Science, Technology and Innovation and the Authority for Government Innovation (Autoridad para la Innovación Gubernamental). Implementation would be phased, and its evaluation could lead to proposals submitted to the Legislative Branch (Órgano Legislativo). Both institutions would issue regulations for the bill within 3 months following its promulgation in the Official Gazette; it would take effect upon publication and repeal conflicting provisions. Its content may be of interest to those public entities and to the technology, labor, health, finance, telecommunications, transportation, education, and justice sectors.