AI in Costa Rica

Costa Rica has no AI-specific binding statute as of 2026, but the operating environment for AI deployments is shaped by three converging layers. The first is the national policy framework — ENIA 2024-2027 (Estrategia Nacional de Inteligencia Artificial), coordinated by MICITT (Ministerio de Ciencia, Innovación, Tecnología y Telecomunicaciones). In April 2025 MICITT issued a mid-cycle implementation note clarifying how ENIA principles apply to public-sector AI procurement: any state entity contracting an AI system that supports automated decision-making against citizens must publish a model card, a data-source disclosure, and a human-oversight protocol before go-live. The note is binding on public buyers and is being used as the reference standard for private vendors that sell into government. The second layer is data protection — Ley 8968 de Protección de la Persona frente al Tratamiento de sus Datos Personales, supervised by PRODHAB (Agencia de Protección de Datos de los Habitantes — https://www.prodhab.go.cr). In February 2026 PRODHAB published an updated position on cross-border transfers under Article 14 of Ley 8968, clarifying that transfers to processors in the United States are permissible without a separate authorization only when the importing party is subject to the EU-US Data Privacy Framework or has signed standard contractual clauses aligned with PRODHAB's 2024 model. AI providers that move training data or inference logs offshore now require a documented basis for the transfer, on file before processing begins. The third layer is sector regulation — SUGEF, SUGESE and SUGEVAL each have AI-risk circulars in force for banking, insurance and securities respectively, and SUGEF's 2025 fintech AI risk guidance (incorporated into the Reglamento sobre el Riesgo Operativo) requires supervised entities to maintain a model inventory, document model-risk management, and report material AI-driven decisions to the supervisor. Enforcement is administrative — PRODHAB can fine up to 30 base salaries per violation (Ley 8968 Article 28), and SUGEF can require remediation plans backed by enforceable timelines. Recent MICITT guidance under ENIA also signals where the next round of binding rules will land: high-risk public-facing applications, transparency for automated decisions, and provenance for synthetic media.