AI Regulation Tracker / Regional standard

Ibero-America's Shared Privacy Rulebook Just Added AI, Neurodata and Automated-Decision Auditing

Regulatory summary: At the XXII RIPD encuentro in Cartagena de Indias (approved June 15, 2026), Ibero-American data-protection authorities updated the Estandares de Proteccion de Datos Personales para los Estados Iberoamericanos to add AI, automated decisions, biometrics, neurodata, algorithmic governance, human oversight and periodic auditing. It is a nonbinding reference standard, not enforceable.

At the XXII RIPD meeting in Cartagena de Indias, 20-plus Ibero-American data authorities updated the region's common standard to cover artificial intelligence, biometrics, neurodata, algorithmic governance and periodic auditing. It is nonbinding reference law, and it is crystallizing now.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Ibero-America's Shared Privacy Rulebook Just Added AI, Neurodata and Automated-Decision Auditing regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The updated standard adds neurodata as a sensitive-data category, broadens automated-decision protection from exclusively automated to exclusively or essentially automated, and requires algorithmic governance, traceability, meaningful human oversight, continuous risk evaluation and periodic auditing for AI and automated processing.
DPOs, privacy counsel, biometric and health-data controllers, HR teams running automated screening, and neurotechnology and wearable vendors operating across Ibero-America, including organizations regulated by Brazil's ANPD, which assumed the RIPD presidency at this meeting.
Status: Approved by the RIPD assembly on June 15, 2026 in Cartagena de Indias.
Map every essentially automated decision in your Ibero-American operations, confirm a qualified human can genuinely override each one, and open an audit trail now so you are ready when a member authority converts the reference standard into enforceable rules.

Regulatory Briefing

Bindingness: Regional soft-law / reference standard, nonbinding. The Estandares are a model instrument that Ibero-American data-protection authorities use to harmonize and modernize national legislation. They do not, by themselves, create enforceable obligations on controllers.
Scope: All 20-plus member authorities of the Red Iberoamericana de Proteccion de Datos, spanning Latin America, Spain, Portugal and Andorra. Substantive coverage now includes AI systems, exclusively or essentially automated decisions, biometric data, neurodata, protection of children and adolescents online, algorithmic governance and data quality in automated systems.
What Changed: The updated standard adds neurodata as a sensitive-data category, broadens automated-decision protection from exclusively automated to exclusively or essentially automated, and requires algorithmic governance, traceability, meaningful human oversight, continuous risk evaluation and periodic auditing for AI and automated processing.
Who This Affects: DPOs, privacy counsel, biometric and health-data controllers, HR teams running automated screening, and neurotechnology and wearable vendors operating across Ibero-America, including organizations regulated by Brazil's ANPD, which assumed the RIPD presidency at this meeting.
Current Status: Approved by the RIPD assembly on June 15, 2026 in Cartagena de Indias. Forwarded to the Secretaria General Iberoamericana (SEGIB) for possible adoption at the Ibero-American Summit of Heads of State and Government.
Effective Date: Nonbinding; reference standard. No enforcement date. Practical effect arrives as member authorities import provisions into national law and guidance.
Primary Source: https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/red-iberoamericana-actualiza-marco-comun-privacidad
Secondary Analysis: AEPD agenda page for the 2026 RIPD encuentro; RIPD 2026-2030 Strategic Plan announcement; Argentina AAIP participation note; Infobae and El Derecho coverage dated June 15-16, 2026.
Workflow Impact: Controllers should treat the standard as a forward signal of where national statutes are heading. The near-term work is inventorying automated decisions, documenting human-oversight capacity, and standing up auditing and traceability logs, rather than filing anything with a regulator today.
Operational Next Step: Map every essentially automated decision in your Ibero-American operations, confirm a qualified human can genuinely override each one, and open an audit trail now so you are ready when a member authority converts the reference standard into enforceable rules.
Last Verified: July 9, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Brazil	The updated standard adds neurodata as a sensitive-data category, broadens automated-decision protection from exclusively automated to exclusively or essentially automated, and requires algorithmic governance, traceability, meaningful human oversight, continuous risk evaluation and periodic auditing for AI and automated processing.	DPOs, privacy counsel, biometric and health-data controllers, HR teams running automated screening, and neurotechnology and wearable vendors operating across Ibero-America, including organizations regulated by Brazil's ANPD, which assumed the RIPD presidency at this meeting.	Approved by the RIPD assembly on June 15, 2026 in Cartagena de Indias. Forwarded to the Secretaria General Iberoamericana (SEGIB) for possible adoption at the Ibero-American Summit of Heads of State and Government.

Frequently Asked Questions

Is the updated Ibero-American standard legally binding on my company today?

No. The Estandares de Proteccion de Datos Personales para los Estados Iberoamericanos are a nonbinding reference standard. They guide how member authorities write and interpret national law, but they do not create directly enforceable obligations or a compliance deadline on their own.

When and where was it approved?

The RIPD assembly approved the updated standard on June 15, 2026, at the XXII encuentro of Ibero-American data-protection authorities in Cartagena de Indias, Colombia.

What is the single most important operational change?

The shift from protecting against exclusively automated decisions to exclusively or essentially automated ones, paired with a requirement for qualified, significant and effective human intervention. A token human reviewer no longer satisfies the standard.

Does this affect companies regulated by Brazil's ANPD?

Yes, indirectly and increasingly. Brazil's ANPD assumed the RIPD presidency at this meeting, and the network's shared standard is a template ANPD and other members draw on when modernizing national rules. Prepare for convergence.

What should we do first if we operate across Ibero-America?

Map every essentially automated decision, confirm a qualified human can genuinely override each one, extend sensitive-data controls to biometric and neurodata processing, and open auditing and traceability logs now, before provisions harden into national law.