Part of the AI Regulation News hub.
Puerto Rico's Ley 140-2026 requires the annual cybersecurity continuing education course for government information officers and public servants to cover the use of artificial intelligence
Training mandates rarely make news. This one is worth reading because it is a rare example of a legislature putting AI competence into a statutory annual requirement rather than into a framework document.
Bottom line: Binding and in force. The act states it takes effect immediately upon approval, and the legislative record gives 22 July 2026 as both the approval date and the effective date.
Who this affects: Puerto Rico Innovation and Technology Service (PRITS) staff who run the programs, the Oficina de Etica Gubernamental as co-administrator, designated Information Officers at each agency, and every public servant of a covered agency who must take the annual course.
Issue date: Approved 22 July 2026, effective 22 July 2026. The House secretary certified the bill on 17 June 2026. There is no separate compliance deadline in the text.
What changed: Article 9 of Ley 40-2024 now requires the public virtual education program to cover the use of AI, and requires the annual continuing education cybersecurity course for Information Officers and public servants to include the subject of AI use. Articles 1 and 4 carry technical amendments, including renaming the act to Ley de Ciberseguridad del Gobierno de Puerto Rico.
Analysis: The statute obliges coverage of AI but says nothing about content, hours, assessment or evidence of completion. Whoever builds the curriculum inherits the definitional work the legislature left undone, and that is where the real policy will be set.
Primary sources: Ley 140-2026, certified text (PDF, ES) · Ayuda Legal PR, Leyes de 2026 index
- Instrument (EN)
- Act No. 140-2026, an act to amend Articles 1, 4 and 9 of Act 40-2024, known as the Cybersecurity Act, so that the virtual program and the continuing education cybersecurity course include the subject of artificial intelligence use
- Authority
- Asamblea Legislativa de Puerto Rico
- Jurisdiction
- Puerto Rico, government agencies
- Status
- Enacted and in force
- Bindingness
- Binding statute
- Issue date / next deadline
- Approved and effective 22 July 2026; the underlying obligation is an annual course, with no separate transition date
- Bill number
- P. de la C. 824
- Administering bodies
- Puerto Rico Innovation and Technology Service (PRITS), in collaboration with the Oficina de Etica Gubernamental
- Primary source
- https://ayudalegalpr.org/resource/leyes-2026
Two programs, both now covering AI
Article 9 of Ley 40-2024 carries two distinct obligations, and the amendment touches both. The first is a virtual education program PRITS maintains to inform and educate the public about cybersecurity. As amended, that program covers the technical aspects of safe and appropriate use of the electronic and cyber instruments that give access to public information, as well as the use of artificial intelligence.
The second is a continuing education program PRITS maintains in collaboration with the Oficina de Etica Gubernamental for Information Officers and for public servants of the agencies. As amended, those people are required to take an annual cybersecurity continuing education course that includes the subject of AI use.
The public program is an availability duty. The continuing education course is a personal duty on named categories of staff. Conflating the two is the easiest way to misread this act.
What the statute does not say
There is no definition of artificial intelligence anywhere in the amended articles I read. There is no minimum duration, no syllabus, no competency standard, no assessment requirement, and no stated consequence for a public servant who does not complete the course.
The amendment also does not create any obligation for private employers. Its subjects are PRITS, the Oficina de Etica Gubernamental, Information Officers and public servants of the agencies.
Article 9 as amended does mention that PRITS may schedule the use of training and preparedness exercises such as Table Top Exercises. That is permissive, not mandatory, and it is not tied specifically to AI.
The legislature's stated reasoning
The statement of motives traces the authority: Ley 75-2019 gave PRITS the power to implement and coordinate government policy on innovation, information and technology, and Ley 40-2024 gave it responsibility for secure administration of information resources, for information technology security norms across government, and for advising agencies and maintaining the government's cybersecurity strategies and plans.
On AI, the drafters make a short and unglamorous argument. AI is increasingly used across sectors for tasks a person would normally do. It can make life easier for people, firms and governments. It also brings challenges including data privacy, system security and the possibility of cyberattacks. Therefore people need to be oriented and informed about what its use represents.
That reasoning matters for construction. The AI content is framed as a security-risk topic inside a cybersecurity course, not as a general AI literacy mandate.
A quiet renaming with a real effect
Section 1 amends Article 1 so the short title becomes Ley de Ciberseguridad del Gobierno de Puerto Rico, dropping the Estado Libre Asociado formulation. Section 2 amends Article 4 so that Gobierno means the Gobierno de Puerto Rico.
These are described in the bill title as technical amendments, and they are. But if you maintain policy documents, contracts or agency procedures that cite the act by its former short title, those citations are now stale.
What a private employer should take from it
Nothing directly. There is no private-sector obligation here. What is worth noting is the drafting pattern: rather than writing an AI training statute, the legislature attached AI to an annual cybersecurity requirement that already existed and already had an owner.
That pattern is cheap to legislate and hard to argue with, and it is likely to recur. If your organisation already runs annual security awareness training, the question this act raises is whether your existing course says anything at all about AI-assisted attacks and about staff use of AI tools.
What we did not verify
I opened the certified text of P. de la C. 824 as published by Ayuda Legal Puerto Rico, containing the House secretary's certification dated 17 June 2026, the statement of motives, and Sections 1 through 4. I also opened the Ayuda Legal PR index of 2026 laws, which gives Ley 140 de 2026 an approval and effective date of 22 July 2026.
I did not open Ley 40-2024, Ley 75-2019, or any PRITS regulation or curriculum. The PDF is a scan and the final transmittal page carries a garbled date stamp that reads Nov. 2024, which is inconsistent with the rest of the record; I have relied on the legislative index for the operative dates rather than on that stamp.
I will not state what the annual course currently contains, what happens to a public servant who does not complete it, whether PRITS has issued implementing guidance, or how AI is defined for this purpose. None of that appears in the text I read.
Puerto Rico attached AI to an obligation that already existed and already had an administrator, which is a faster route than a standalone AI statute. The duty is coverage, not competence: the law requires the annual course to include the subject of AI use and leaves everything about depth and assessment to PRITS. For anyone benchmarking their own security awareness program, the useful question is not whether you are covered by this act but whether your annual course would satisfy it.
Source File
https://ayudalegalpr.org/resource/leyes-2026
Open the Ayuda Legal PR index of 2026 laws and find the Ley 140 de 2026 entry, confirming the 22 July 2026 approval and effective dates and the stated purpose. Then open the linked PDF and confirm that Section 3 amends Article 9 of Ley 40-2024 to require an annual continuing education cybersecurity course that includes the subject of AI use, and that Section 4 makes the act effective immediately upon approval.
se requerira que los Oficiales de Informacion y los servidores publicos del Gobierno tomen un curso de educacion continua de Ciberseguridad anualmente, que incluya el tema del uso de la inteligencia artificial. Ley Num. 140-2026, Section 3, amending Article 9 of Ley 40-2024, approved 22 July 2026
FAQ
Does Ley 140-2026 apply to private employers in Puerto Rico?
No. The obligations in the text fall on PRITS, the Oficina de Etica Gubernamental, Information Officers and public servants of covered government agencies.
How often is the course required?
Annually. Article 9 as amended requires Information Officers and public servants to take a cybersecurity continuing education course each year, and that course must include the subject of AI use.
Does the act define artificial intelligence?
Not in the articles amended. Sections 1 through 4 add no AI definition, no syllabus and no assessment standard, which leaves the substance to whoever builds the curriculum.
Did the act change the name of the 2024 cybersecurity law?
Yes. Article 1 was amended so the short title is Ley de Ciberseguridad del Gobierno de Puerto Rico, and Article 4 was amended so Gobierno means the Gobierno de Puerto Rico.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.