AI Regulation Tracker  /  Judicial guidance

Costa Rica's Courts Put Binding Rules on AI Use

Circular No. 31-2026 sends every Costa Rican judicial office a rulebook for ChatGPT, Gemini and NotebookLM that it calls de acatamiento obligatorio. The signing servant carries the liability, sensitive data is conditioned on a settings check, and AI-assisted work has to say so in the file.

By Anthony Guerriero  ·  Reviewed by Anthony Guerriero  ·  Published August 3, 2026  ·  Updated August 3, 2026  ·  Judicial guidance

Key facts

Regulatory briefing

Instrument

Circular de Secretaria de la Corte N. 031-2026, transcribing the basic guidelines for the use of authorized generative AI in the Judicial Branch

Authority

Consejo Superior del Poder Judicial; circulated by the Secretaria de la Corte, Corte Suprema de Justicia

Jurisdiction

Costa Rica, internal to the Judicial Branch

Status

In force and communicated to all judicial offices, the Ministerio Publico, the Defensa Publica, the OIJ and administrative offices

Bindingness

Regulatory guidance. Binding on judicial personnel by its own terms; it is not a statute and does not bind private companies

Effective date

Dated February 20, 2026 and published in Boletin Judicial N. 039 of February 26, 2026. The circular states no separate entry-into-force date

Primary source

Nexus.PJ record for Circular N. 031-2026

What the circular actually is

On February 12, 2026 the Consejo Superior del Poder Judicial, sitting in sesion 12-2026, agreed under articulo LIII, at the request of the Despacho de la Presidencia, to communicate to all judicial personnel a document of basic guidelines for the use of authorized generative artificial intelligence in the Judicial Branch. Eight days later the Secretaria de la Corte turned that agreement into a circular. The document is dated San Jose, February 20, 2026, carries reference 1433-2026, and is signed by Lic. Carlos Toscano Mora Rodriguez as Subsecretario General interino of the Corte Suprema de Justicia. It was published once in Boletin Judicial No. 039 of February 26, 2026.

Start with what it is not, because the category matters more than the content for most readers of this tracker. This is not an AI law. It is not a decree. It is not a rule of general application. It is an internal instrument of one branch of the Costa Rican state, addressed to judicial offices, the Ministerio Publico, the Defensa Publica, the OIJ, the judiciary's administrative offices and judicial personnel generally. Nothing in it creates an obligation for a private company, a bank, a hospital or a software vendor operating in Costa Rica.

Within its own population, though, it is not soft. The circular states in terms that the guidelines that follow are de acatamiento obligatorio, of mandatory compliance, and it provides for periodic revision rather than treating the text as final. The circular states no separate entry-into-force date, which I read as meaning the guidelines run from communication rather than from some later trigger. If you need the point settled for a filing, settle it against the Nexus.PJ text rather than against my reading of it.

The subject line identifies the tools in scope: ChatGPT, Gemini and NotebookLM. The annexed document is framed around authorized generative AI in the Judicial Branch. I would not read that as a closed whitelist. One of the guidelines refers to NotebookLM or similar tools, and another contemplates locally hosted tools approved by the DTIC, the judiciary's technology directorate. What you can say accurately is that those three products are the ones the instrument identifies.

The clause that assigns the blame

The first substantive guideline is a principle of human responsibility and non-delegation, and it is written the way a professional liability rule is written rather than the way an ethics statement usually is. AI is a support and assistance tool, never a substitute for human judgment. Its use may never involve delegating essential jurisdictional or administrative functions. And then the model is stripped of any institutional standing:

1.2. El modelo de IA no tiene fe pública, ni autoridad jurisdiccional, ni administrativa. La persona servidora judicial debe verificar, contrastar y validar obligatoriamente toda información, cita legal o jurisprudencia generada por la herramienta, asumiendo la responsabilidad disciplinaria y legal por "alucinaciones" (entendidas como datos falsos, hechos inexistentes, citas inventadas o errores de cálculo generados por la IA) que no sean detectados.Circular No. 31-2026, Secretaria de la Corte, Poder Judicial de Costa Rica, February 20, 2026

Read the allocation carefully. The duty to verify, contrast and validate is mandatory and it attaches to every piece of information, every legal citation and every item of jurisprudence the tool produces. The liability is disciplinary and legal, it is personal, and it is triggered by hallucinations that are not detected. The circular defines the term rather than leaving it to argument: false data, non-existent facts, invented citations, calculation errors. Final responsibility for any resolucion, oficio, informe, acusacion or dictamen rests exclusively with the judicial servant who signs it.

That is a deliberate design choice, and it is the right one. A rule that said the institution would review AI output would have created a committee. A rule that says the signature carries the risk creates an incentive on the only person who can actually check the citation. It also forecloses, in advance, the argument that the tool produced the error and the signer merely passed it along. The text does not leave that open: the responsibility for undetected hallucinations is stated as the servant's own, disciplinary and legal.

There is a second, quieter instruction in the same family. Prompts are not supposed to lean on the model's pre-trained legal knowledge. Servants may insert the full applicable statutory text into the prompt, and they must state the jurisdictional scope and a temporal cut-off. That is a working instruction rather than a slogan, and it is the sort of thing that reduces invented authority far more effectively than a warning does.

The data rule is really a procurement rule

The confidentiality guideline does not begin with a prohibition. It begins with a verification step. Before using any generative AI tool, the judicial servant has to confirm that training on user inputs can be disabled in the tool's privacy settings. If that cannot be confirmed, the position is categorical:

2.1. [...] En caso contrario queda estrictamente prohibido ingresar información sensible, confidencial o datos personales en ella. El incumplimiento de esta prohibición acarreará las responsabilidades civil, penal y administrativa.Circular No. 31-2026, Secretaria de la Corte, Poder Judicial de Costa Rica, February 20, 2026

Three consequences follow. First, the prohibition is conditional on a fact the servant is required to establish, which converts a vague duty of care into a checkable step. Second, breach is not framed as an internal matter: the circular invokes civil, criminal and administrative liability, drawing on existing regimes rather than inventing a penalty. Third, non-anonymised working documents are permitted, but only where that verification has been met, and subject to the purpose-limitation principle the circular anchors to article 6.4 of Law No. 8968.

Where the configuration cannot be assured, the guidelines point to a different route entirely: such data may be used only on locally hosted tools approved by the DTIC. That is the sentence a vendor should read twice. It means the judiciary has drawn a line between consumer cloud products with a verifiable privacy toggle and everything else, and that everything else has to come in through an internal approval process and sit on infrastructure the institution controls.

For anyone selling AI into a court system, in Costa Rica or anywhere, this is the shape of the question you will be asked from now on. Not whether the product is accurate. Whether the buyer's own staff can demonstrate, from your settings page, that their inputs are not training your model.

The disclosure note, and why outside counsel should care

The transparency and explicability guideline is the one that leaves the building. Judicial servants have to make explicit, in the case file, the document or the decision itself, the name of the tool used, the model, the vendor company, the date of use, and an explanation of what it was used for. The circular supplies a template note so that the disclosure is uniform rather than improvised.

3.9. Principio de transparencia y explicabilidad: [...] las personas servidoras harán explícito en el expediente, documento o decisión, el nombre de la herramienta usada, modelo y empresa proveedora; fecha en que fue usada; además, explicarán para qué fue empleada.Circular No. 31-2026, Secretaria de la Corte, Poder Judicial de Costa Rica, February 20, 2026

Five data points, in the file, for anyone with access to it. If you litigate in Costa Rica, that is a new artefact in the record. It tells you whether a generative tool touched the document in front of you and what it was asked to do. I would treat reading that note as a routine step, in the same way you would check who signed an order, and I would expect the first disputes about it to be about notes that are missing rather than notes that are wrong.

I want to be careful not to overstate what disclosure achieves. A note naming a tool and a purpose does not tell you what the prompt was, how much of the reasoning was adopted, or whether the verification duty was actually discharged. It gives you a fact to build on, not an answer. But in my experience an argument about AI-assisted drafting stalls at the threshold question of whether a tool was used at all, and a dated note naming tool, model and vendor moves the argument past that threshold in one step.

The remaining ethical guidelines fill in the frame: judicial independence, proportionality and non-harm, non-discrimination, mandatory discarding of any output built on gender, race or social-condition stereotypes, total human supervision, and rationality about cost and energy use. The discarding rule is the operative one there. It does not ask servants to consider bias. It tells them to throw the output away.

What a US professional should take from this

The direct legal relevance to a US practice is close to zero. This binds Costa Rican judicial personnel and no one else. Its value is comparative, and on that basis it is worth ten minutes.

Costa Rica's legislature has AI bills on file. Expediente 23.771, the Ley de Regulacion de la Inteligencia Artificial en Costa Rica, and expediente 23.919, the Ley para la Promocion Responsable de la Inteligencia Artificial en Costa Rica, both exist as legislative expedientes. Neither was shown to be enacted on the sources reviewed for this entry, and I am not going to publish a procedural status for either without opening the Asamblea Legislativa's own record. Bill 23.771 would create an Autoridad Reguladora de Inteligencia Artificial, but that is a proposal in a draft, not a body that exists.

The pattern is what makes it worth the time. Two AI bills sit on the legislative record, and an institution that actually uses the technology every day did not wait to find out what becomes of them. It wrote binding rules for its own staff, and the Secretaria de la Corte had them in every judicial office eight days after the Consejo Superior agreed to issue them. That is how a lot of AI governance is going to arrive in practice: not from a comprehensive statute, but from the entity that carries the liability deciding it cannot wait for one.

The scope is worth noticing too. What the verified text regulates is a workflow: which tools are identified, what may be put into them, who checks the output, and what the file has to say afterwards. It is not built like a risk-classification regime with conformity assessments and a supervisory body, and it did not need to be. For an institution whose exposure is one wrong citation in one signed document, that is the correct scope, and it is the reason the thing could be written in weeks. A risk-classification regime is a different instrument aimed at a different problem, and conflating the two is how internal AI policies end up unreadable and unfollowed.

If you run a firm, a compliance function or a clinical department, the four moves in this circular transfer almost unchanged and none of them require legislation. Put the responsibility on the person who signs, in writing, and define what a hallucination is so nobody argues about the word later. Require a settings-level verification before confidential material goes into any tool, and name the approved internal alternative for when it fails. Require the prompt to carry the governing text and a temporal cut-off instead of trusting the model's memory. And record tool, model, vendor, date and purpose wherever the work product goes.

That last one is the item most organisations skip, and it is the cheapest of the four. It is also the only one that produces evidence. When a citation eventually turns out to be invented, and it will, the difference between a manageable problem and an unmanageable one is whether anyone can reconstruct what was used, by whom, and for what.

Last verified: August 3, 2026 against the primary sources listed above.