SBS Resolution No. 504-2021: information security and cybersecurity
The Regulation on Information Security and Cybersecurity Management has applied since July 2021 to companies supervised by the SBS, Peru’s banking, insurance and pension fund regulator. Several of its requirements apply directly to an AI agent working on code:
| What the SBS requires | How Harkaq responds |
|---|---|
| Control privileged accounts, segregate duties and apply least privilege (art. 12.2) | The agent holds no credentials. The requester never approves, and permissions are single-use and expire on their own |
| Separate development, testing and production environments (art. 12.3) | The agent works in an isolated workspace and only pushes changes to its own branches |
| Security across the software lifecycle and change control over source code (art. 12.5) | The agent’s code arrives labeled and only reaches production with someone else’s approval |
| Monitoring and evidence preservation (arts. 12.6 and 17) | Hash-chained log of every action and a verifiable evidence report |
| Third-party and cloud service management (arts. 22 to 25) | The AI model is contracted in the company’s own cloud account and chosen region |
Law 31814 and its regulation: artificial intelligence
Law 31814 promotes the use of AI, and its regulation, Supreme Decree 115-2025-PCM, was published in September 2025. For the economy and finance sector, the adaptation period was one year. Among other obligations, article 31 requires documenting how the system works, having security and accountability policies, training staff, and keeping human oversight able to stop or correct the system.
With Harkaq, human oversight isn’t a document: what the agent isn’t allowed to do doesn’t leave, a person decides anything new, and every action is logged.
Law 29733: personal data protection
The new regulation of Law 29733, Supreme Decree 016-2024-JUS, was published in November 2024 and strengthens security measures, access management, incident notification and the rules for cross-border data flows. If the agent works on systems with personal data, the company has to be able to show who accessed what and that data didn’t go to unauthorized destinations. Harkaq’s gateway inspects everything that leaves and logs every access.
Digital Trust Framework
The Digital Trust Framework regulation (Supreme Decree 126-2025-PCM) requires providers in the financial sector, basic services, health and others to manage digital security risk, apply proportional controls and report critical incidents to the National Digital Security Center.
What an auditor will ask to see
- The agent and the model registered as vendors, including where data is processed.
- That the agent holds no standing credentials and that new access is approved by someone else.
- Complete logs of every agent action, traceable to a person.
- That the agent’s code is identified and reviewed before production.
- Evidence that the controls worked, not just written policies.