Guidelines for the Use of Artificial Intelligence Systems and Compliance with Provisions Related to the Law on the Promotion of Artificial Intelligence and Technologies

CNBCR-06/2026
GUIDELINES FOR THE USE OF ARTIFICIAL INTELLIGENCE SYSTEMS AND COMPLIANCE WITH PROVISIONS RELATED TO THE LAW ON THE PROMOTION OF ARTIFICIAL INTELLIGENCE AND TECHNOLOGIES Approval: 08/09/2026 Validity: 09/09/2026 Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv

GUIDELINES FOR THE USE OF ARTIFICIAL INTELLIGENCE SYSTEMS AND COMPLIANCE WITH PROVISIONS RELATED TO THE LAW ON THE PROMOTION OF ARTIFICIAL INTELLIGENCE AND TECHNOLOGIES

Within the framework of what is established in the Law on the Promotion of Artificial Intelligence and Technologies and its Provisions Relative to the Implementation of Artificial Intelligence and Technologies, these Guidelines shall be applicable to natural or legal persons subject to supervision in accordance with Article 7 of the Law on Supervision and Regulation of the Financial System, hereinafter Subjects. Consequently, when any of the Subjects deploys an Artificial Intelligence (AI) System for the determination of creditworthiness, approval or denial of loans, or establishing prices and eligibility for credit or insurance products for natural persons, where said AI System constitutes the controlling factor for taking a consequential decision, without prejudice to compliance with the other obligations established in laws, regulations, technical standards, and other regulatory provisions applicable to the entity and the activity in question, the following considerations must be observed:

I. Subjects acting as operators of an AI System, which constitutes the controlling factor of consequential decisions regarding determinations of creditworthiness, approval or denial of loans, or determinations of prices and eligibility for credit or insurance products for natural persons, must be registered, prior to the deployment of the system, in the National Registry of Development, Innovation and Application of AI of the National Agency of Artificial Intelligence (ANIA), as established in Articles 11, 12 and 13 of the Provisions Relative to the Implementation of Artificial Intelligence and Technologies. Subjects who, as of the date of validity of these Guidelines, already use AI Systems covered by this scenario must accredit their registration, in accordance with Article 29 of the Provisions Relative to the Implementation of Artificial Intelligence and Technologies.

II. The registration is carried out exclusively before the ANIA, which must communicate said registration to the Central Bank of El Salvador and the Superintendence of the Financial System, indicating the operations and services in which the Subject will use the AI System. The Superintendence of the Financial System will verify the registration certificate in its supervision processes and will not require additional authorization. In accordance with Article 12 letter a) of the Provisions Relative to the Implementation of Artificial Intelligence and Technologies, the obligation to register does not transfer to the provider of models, platforms, or cloud services.

III. When the AI System controls a consequential decision regarding a natural person, Subjects must comply with the obligations and other applicable measures provided for in the Law on the Promotion of Artificial Intelligence and Technologies and its Provisions Relative to the Implementation of Artificial Intelligence and Technologies.

IV. In the case that Subjects contract a third party for the AI System, they must observe the following:

a. The contract entered into must include the express indication that decisions regarding the approval or denial of products and services for the client or user are made at the account of and under the responsibility of the Subjects, with the Subjects being responsible for verifying compliance with applicable legal and regulatory provisions. The contracting of third parties will not limit the legal and regulatory responsibilities of the Subjects towards their clients, users, and competent authorities, nor the supervision powers of the Superintendence of the Financial System;

b. Subjects are responsible for guaranteeing the confidentiality, security, and adequate treatment of the information of clients or users to whom the AI Systems used for the approval or denial of operations and services have access, in accordance with applicable legal and regulatory obligations;

c. Comply with Article 26 and Annex No. 1 of the "Technical Standards for Information Security Management" (NRP-23), regarding Outsourcing of information technology activities or operations, related to AI Systems;

d. Comply with Article 4 of the "Technical Standards for Operational Risk Management of Financial Entities" (NRP-42), regarding the Provision of services by third parties related to AI Systems; and

e. Include in the contract the obligation of the AI System provider to comply with what is established in Article 9 of the Provisions Relative to the Implementation of Artificial Intelligence and Technologies.

V. When an AI system collects, consults, combines, infers, stores, transfers, or uses personal data, Subjects must comply with the provisions of the Law for the Protection of Personal Data, with the Subjects being responsible for the confidentiality of the information of clients or users to whom the AI Systems used for the approval or denial of operations and services have access.

VI. Subjects that use an AI System for the analysis, qualification, approval, denial, refinancing, price, limits, or monitoring of credits, must update their policies and manuals regarding credit risk management and credit concentration risk that establish the "Standards for Credit Risk and Credit Concentration Management" (NPB4-49).

VII. Subjects that use an AI System must observe, regarding fairness, transparency, accountability, informed consent, data minimization, inclusion, and non-discrimination, what is provided for in Articles 5 and 18 of the Law on the Promotion of Artificial Intelligence and Technologies, informing the client that the decision to approve or deny the product or service will be adopted through the use of an AI System as a controlling factor, indicating the available mechanisms to request review or clarification and the means to present a disagreement, complaint, or claim when the client disagrees with the decision taken.

VIII. Subjects must establish effective human supervision mechanisms, over the AI Systems used for the adoption of consequential decisions, in accordance with the nature and risk level of the system.

IX. Subjects that use artificial intelligence systems must comply with the provisions of the regulatory framework approved by the Standards Committee of the Central Bank of El Salvador that are applicable to them.