Peru's Ministry of Health has approved institutional guidelines for safe, ethical AI use, with controls that reach its vendors

Key takeaways

• Article 1 approves the technical document; Article 2 entrusts dissemination, implementation, supervision and technical assistance to the Oficina General de Tecnologías de la Información (OGTI).
• Every AI initiative is to be recorded in an OGTI-run inventory before a purchase, contract, development, pilot or test, and be classified as misuse, high risk or acceptable risk.
• High-risk systems need a completed impact assessment, designated human supervisors, a monitoring plan, an incident procedure and suspension criteria before going live.
• For generative AI, the document prohibits entering clinical records or patient data into public or unauthorised services.

What did the Ministry of Health approve, and why now?

Article 1 approves the Documento Técnico on institutional policy guidelines for AI-based systems at the Ministry, as an annex that forms part of the resolution. The recitals tie it to article 28.1 of Supreme Decree 115-2025-PCM, the regulation under Law 31814, which sets out a duty for public entities to approve an institutional policy of safe, responsible and ethical AI use. The recitals say the OGTI drafted it to help protect fundamental rights, life, health, dignity, privacy and equality across design, development, acquisition, integration, operation and safe retirement of AI systems. Our article on the Law 31814 regulation covers the national framework; our piece on the AI Officer role covers the officer the Minsa document relies on.

Who has to follow it?

The scope section says the document is of aplicación obligatoria for Minsa organs, units and decentralised bodies that design, develop, acquire, contract, implement, integrate, administer, use, supervise or withdraw AI systems. It adds that its provisions are exigibles to natural or legal persons that provide services to Minsa. For health service providers (IPRESS) and health insurance fund administrators (IAFAS), it applies to administrative or care systems and AI-based services that Minsa makes available to them, within the legal instruments governing that use and without affecting other entities' competences. Section 7 repeats this: those providers are responsible for applying the controls that fall to them, ensuring human supervision, protecting data and reporting incidents or anomalous results. In the desk's reading, a private hospital that runs its own AI tools, is not providing services to Minsa and does not use a Minsa-provided system is not reached by this wording; one that does provide services to Minsa may be.

What controls does the document put in place?

The core is a lifecycle with seven control gates in Annex 2: registration, classification, assessment, validation, operation, follow-up and retirement. Each AI initiative starts from a documented need, including non-AI alternatives and why AI is necessary and proportionate. The inventory records at least purpose, owners, supplier, version, data sources, beneficiary population, risk class, status and next review date. A unit then classifies the system as misuse, high risk or acceptable risk under articles 22 to 24 of the national regulation, and the document says detected misuse should not continue.

In health, the introduction treats as high risk the systems that manage critical assets behind health services, determine access to services or benefits, guide screening, diagnosis, prognosis or emergency prioritisation, or assess sensitive data in clinical records. For these it calls for prior impact assessment, effective human supervision, algorithmic transparency and reinforced security controls. Putting a high-risk system into production requires, per section 6.3, a concluded impact assessment, designated human supervisors, a monitoring plan, an incident procedure and suspension criteria. The document also says an automated action should not replace a health professional's decision, and that human intervention in decisions of significant impact is to be recorded. Users are to be told when they interact with AI or when it takes part in a decision that may affect them, and mechanisms for human review and complaints are to be enabled.

What does it require of AI vendors and generative AI users?

Section 6.5(G) lists the supplier terms. Minsa is to build ethics, security, privacy, quality, interoperability, auditability, continuity and intellectual property requirements into tender terms and contracts, and to require documentation on the model, data, metrics, limitations, versions, tests, incidents, subcontractors and processing location. It is also to reserve audit rights, access to evidence, portability, reversibility, knowledge transfer and termination for breach or unacceptable risk. The document says Minsa should not use supplier systems that allow the supplier to assume ownership of the personal data banks processed under outsourcing. Section 6.5(A) says Minsa is to prevent the purchase, contracting, development, testing or production use of AI systems not previously registered, evaluated and authorised by the OGTI.

On generative AI (6.5(H)), staff are to use only authorised tools, services and accounts, and the document prohibits entering clinical records, patient data, credentials, reserved information, sensitive personal data, non-public source code or confidential documents into public or unauthorised services. Anonymised or synthetic data are to be preferred for training and testing after a risk analysis, with a check that synthetic data carry no re-identification risk. One further line says source code of AI systems financed with public funds is to be published on the national public software platform under a free or open licence, without exposing confidential information or vulnerabilities.

What should vendors, providers and counsel do now?

In the desk's reading, the supplier terms in section 6.5(G) are the points a Minsa contract is likely to be tested against. For anyone providing services to Minsa or using a Minsa-provided system:

• List each AI feature you supply to Minsa, and place it against the three risk classes and the health examples of high risk.
• Prepare the documentation the document asks for: model, data, metrics, limitations, versions, tests, incidents, subcontractors and processing location.
• Check contracts for audit access, reversibility, exit and data-return terms, and for any clause giving you ownership of personal data banks.
• If your staff work inside Minsa systems, confirm they use only authorised generative AI accounts and never enter patient data into public tools.
• IPRESS and IAFAS using Minsa-provided AI should assign human supervisors and an incident-reporting route.

What are the key dates and parties?

What we did not verify

What we opened: the gob.pe resolution page and the 24-page PDF on 25 October 2026. The PDF is a scanned image, so we read it by optical character recognition and checked the signature page visually; we read the resolution, the technical document body, the responsibilities section and the start of the annexes.

What we did not open: the El Peruano publication, so we cannot give its date or confirm an entry-into-force rule; the full text of Annex 1 and Annex 2 tables beyond their headings and gate names; Supreme Decree 115-2025-PCM itself; and any Minsa implementation plan or enforcement step. The date differs between the signed PDF (2 October) and the gob.pe listing (6 October), and we did not resolve why.

What we refuse to claim: that the document binds private providers beyond the contracts and instruments it names, that any penalty attaches to it, or that any deadline applies.

Related briefings

• AI Regulation News hub
• Latin America AI regulation tracker
• Attorneys and AI regulation
• Peru Law 31814 AI regulation and its September 2026 deadline
• Peru national AI strategy and AI Officer for public entities
• Colombia telemedicine resolution on AI and human supervision
• Brazil CFM resolution on physician responsibility for AI