Costa Rica has three AI bills waiting. None was summoned.
Technical comparative analysis of Costa Rica's three active AI regulation bills in the Legislative Assembly: procedural status, incompatible institutional architectures, documented MICITT opposition, and international comparison.
Executive Summary
- → Costa Rica has three active AI regulation bills in the Legislative Assembly (23.771, 23.919, 24.484). None was summoned by the Fernández government for the May 2026 extraordinary sessions.
- → The three bills propose mutually incompatible institutional architectures: 23.771 creates ARIA (a new independent authority); 23.919 and 24.484 designate MICITT as regulator, but with different scopes. Simultaneous approval without harmonization would create two parallel regulators with overlapping mandates.
- → Sirius-Lex technical analysis: 57 risk findings across the three texts (15 critical, 32 moderate, 10 no-risk) and 24 normative impacts on existing legislation.
- → MICITT has technically opposed the current texts since May 2023. Its position evolved: from calling for caution (2023) to declaring the bills too broad (2025) to favoring the U.S. self-regulation model (April 2026).
- → Two bills with affirmative committee reports (23.771 and 23.919) can advance in ordinary sessions without Executive summons.
The Three Bills: Comparison
Costa Rica has three active AI regulation bills in the Legislative Assembly, with different procedural statuses and regulatory philosophies. All three coexist without any having advanced to law.
| Attribute | Bill 23.771 | Bill 23.919 | Bill 24.484 |
|---|---|---|---|
| Name | Law on AI Regulation in Costa Rica | Law for the Responsible Promotion of AI | Law for the Implementation of AI Systems |
| Sponsor | Rep. Vanessa De Paul Castro Mora (PUSC) | Rep. Óscar Izquierdo Sandí (PLN) | Rep. Johana Obando Bonilla (Liberal Progressive Party) |
| Introduced | May 2023 | Sep. 2023 | Aug. 2024 |
| Current text | Committee report Sep. 2024 | Substitute text Mar. 2025 (27 pp.) | Substitute text Oct. 2025 (16 arts. + single transitional provision) |
| Status | In committee (returned after plenary) | Reported — ready for plenary debate | Reported |
| Proposed authority | ARIA — AI Regulatory Authority (new, independent) | MICITT as regulator (existing institution) | MICITT as regulator (existing institution) |
| Regulatory philosophy | Strict regulation | Regulated promotion | Specific restrictions |
| Regulatory sandboxes | No | Yes | No |
| Key note | Drafted with ChatGPT-4 assistance (Bloomberg Línea, May 31, 2023). Human reviewers corrected errors. | Technically the most advanced. Aligned with OECD principles and UNESCO values. | Art. 8 prohibits: state social scoring, subliminal manipulation of vulnerable groups, exclusive AI-based judicial decisions without human involvement. |
Source: Costa Rica Legislative Assembly, Delfino.cr records May 2026.
Headline finding
The three bills propose institutional architectures that are mutually incompatible. Approved without harmonization, Costa Rica would have two parallel regulators (ARIA + MICITT) with overlapping mandates and no defined hierarchy.
MICITT Position: Documented Timeline
The government's position on the three bills is not silence or indifference. It is documented technical opposition, sustained over two and a half years, with arguments that have evolved.
Early caution signal
Minister Paula Bogantes Zamora questions the methodology of Bill 23.771, drafted with ChatGPT-4 assistance. She calls for caution in using AI to draft legislation and notes that the drafting team did not consult MICITT. Minister of the Presidency Natalia Díaz Quintana agrees: a technical project of this nature should have incorporated MICITT criteria from the outset.
Source: Semanario Universidad, May 31, 2023
"Premature" regulation
Minister Bogantes Zamora declares it premature to advance with an AI bill at that time. She establishes a priority order: first update the Data Protection Law and cybersecurity legislation, and only then consider specific AI regulation.
Source: CRHoy, October 29, 2024
Explicit technical opposition
A MICITT delegation appears before the working group convened by Rep. Obando Bonilla. MICITT's Director of Research, Development and Innovation, Marlon Avalos Elizondo, states:
"From MICITT's perspective, neither the country nor the world is ready to issue legislation that could become obsolete even before it is published, which becomes a risk to the country's opportunity to lead the deployment of this technology and limit the progress we have been achieving."
"A prior regulation is being established that we consider too broad. This could affect any implementation."
Sources: DPL News, January 30, 2025; Semanario Universidad, January 29, 2025
Shift toward the U.S. model
Minister Bogantes Zamora appears before the legislative commission. In a notable shift from the ENIA 2024-2027 (which used the EU AI Act as a reference), she criticizes the European model and signals favor for the U.S. approach:
"They have already published and are in the process of implementing the AI Act, which is quite restrictive in the application of AI in European territory."
"Rather, they are limiting over-regulation to seek greater and faster implementation of AI."
Source: Semanario Universidad, April 15, 2026
Technical Risk Analysis (Sirius-Lex)
Require correction before approval
Require review and adjustment
No risk identified
20 verified against Costa Rican legal corpus · 14 pending additional verification · 4 with contradictory references
11 high severity · 10 medium · 3 low
Key finding: mutually incompatible institutional architectures
The most significant finding emerged from analyzing all three bills together: they propose mutually incompatible institutional architectures. Bill 23.771 creates a new independent authority (ARIA). Bill 23.919 designates the existing MICITT as regulator. Bill 24.484 also designates MICITT, but with a different scope and logic. If all three were approved without harmonization, Costa Rica would have two parallel regulators with overlapping mandates and no defined hierarchy.
This is not a drafting problem. It is an institutional architecture problem. The three bills were designed independently, without coordination between the sponsoring teams. The Science and Technology Committee convened a working group in January 2025 to explore harmonization. The results are not documented in public sources.
About the analysis method
Comparative analysis of the three current texts conducted in May 2026 using Sirius-Lex, an AI agent system for comparative legislative analysis with citation traceability and constitutional review. Verifier accuracy: 83%. Full traceability: 96%. No hallucinated citations.
Data from Sirius-Lex MVP-A comparative analysis, May 2026. Available upon request.
The Global Debate: Three Models with Observable Results
The debate on AI regulation is not between "regulate" or "don't regulate." It is between three distinct models that already exist.
Four levels: Prohibited (social scoring, cognitive manipulation, real-time biometric identification in public spaces, crime prediction based on personal profiles) · High risk (health, education, employment, justice — strict obligations from August 2026) · Limited risk (transparency) · Minimal risk (no specific restrictions).
Penalties: Up to €35M or 7% of global annual turnover for violations of the prohibitions.
Minister Bogantes called it "quite restrictive" in April 2026. The AI Act does not restrict most applications: minimal and limited risk categories cover the vast majority of AI uses.
EO 14179 revoked Biden's EO 14110 (Oct. 2023), which established safety standards for frontier AI models and consumer protections. No general-purpose federal AI law. State regulatory patchwork: Colorado, California, and New York have active legislation. NIST AI Risk Management Framework adopted voluntarily.
Penalties: No unified federal sanctions.
The model Minister Bogantes signaled favorably in April 2026. It is a model in active transition and political polarization — not a stable reference. States are compensating with their own legislation, creating exactly the kind of patchwork the Costa Rican Executive says it wants to avoid.
Decree creates "controlled testing spaces" where AI projects can operate without obstacles from regulations not designed for these technologies. Maximum 2-year period per environment. Requires data protection impact assessments. Cannot violate constitutional provisions or human rights obligations. Technical Committee chaired by AGESIC oversees the process. AGESIC is preparing a future law.
Penalties: N/A (enabling decree, not punitive regulation).
The most transferable model to the Costa Rican context. Bill 23.919 already proposes this mechanism. It is not a foreign idea to the Costa Rican debate.
Approved by the Federal Senate in December 2024. Still under analysis in the Chamber of Deputies. Includes risk classification, prohibitions, copyright protections for model training content, and sanctions of up to R$50M or 2% of annual turnover.
Penalties: Up to R$50M or 2% of annual turnover.
First LATAM country to approve its framework in the Senate. Direct reference for the Costa Rican debate on prohibitions and rights.
Presented by the Boric government with participation from ten ministries. Approved by the Chamber of Deputies in October 2025. Currently in second legislative review in the Senate.
Penalties: To be defined in final text.
Signal of a whole-of-government approach: when 10 ministries participate in a bill, there is real institutional coordination. Contrasts with the Costa Rican process where bills emerged without coordination between the Executive and the sponsors.
IPANDETEC confirms that no Central American country has approved specific AI legislation. Costa Rica, which positions itself as a leader in digital governance in the region, has no AI law in force.
Components of a Viable First Regulation
The central problem in Costa Rica today is not that there is too much unregulated AI. It is that the public sector already operates AI systems without a clear legal framework. A useful first regulation should solve exactly that.
Define the public sector perimeter
The most urgent regulation is not for AI in general, but for AI used by the State to make or inform decisions that affect people's rights: beneficiary selection systems for social programs, predictive models in public health, prioritization algorithms in waitlists, risk analysis tools in tax or judicial matters. These applications already exist and operate without specific accountability.
Minimum mandatory registry
Every public institution operating an AI system that directly affects people's rights must declare it: what the system does, who operates it, what population it acts on, what indicators evaluate it, and who has human oversight. It does not require creating a new body. It can be a transparency obligation administered by the Ombudsman's Office or the General Comptroller.
Three clear and specific prohibitions
Bill 24.484 already includes them in its substitute text: (1) state social scoring, (2) subliminal manipulation of vulnerable groups, (3) exclusive AI-based judicial decisions without effective human involvement. They are technically defensible, politically uncontroversial, and aligned with the EU AI Act. They are the reasonable minimum.
Regulatory sandboxes
Bill 23.919 includes them. Uruguay approved them in December 2025. They allow CCSS to scale LIDIA, the Judiciary to pilot case file analysis, and private companies to develop solutions in controlled conditions without legal limbo. This is the mechanism that turns the strategy (ENIA) into execution.
Do not create a new authority yet
MICITT already exists. The Comptroller already exists. Creating ARIA before knowing exactly what it will regulate means designing the bureaucracy before the problem. The model of designating MICITT as regulator with a reinforced mandate is more efficient. If in three years the volume of regulation justifies an independent authority, that is the time to create it.
A short first regulation, specific to the public sector, built on what the three texts have in common, and approvable with the minimum available consensus. It does not have to solve everything. It has to solve what is urgent.
Sources and References
Official documents and primary sources
- Costa Rica Legislative Assembly: Bills 23.771, 23.919, and 24.484 (Delfino.cr records, May 2026)
- Bill 23.919 substitute text (Mar. 6, 2025): Permanent Special Committee on Human Rights
- Bill 24.484 substitute text (Oct. 23, 2025): Permanent Special Committee on Science, Technology and Education
- TEC SCI-662-2025 (Aug. 2025) and SCI-361-2025 (May 2025)
- MICITT: National AI Strategy (ENIA) 2024-2027
- Regulation (EU) 2024/1689 — EU AI Act (in force Aug. 1, 2024)
- EO 14179 Trump (Jan. 23, 2025): revocation of Biden EO 14110
- Brazilian Federal Senate: approval of PL 2.338/2023 (Dec. 10, 2024)
- Chilean Senate: Bulletin 16821-19 (in process)
- Decree 276/025: Uruguay AI sandboxes (Dec. 2, 2025) — https://www.impo.com.uy/bases/decretos/276-2025
Press and analysis
- Semanario Universidad (Jan. 29, 2025): direct quotes from Marlon Avalos Elizondo, MICITT Director of R&D&I
- DPL News (Jan. 30, 2025): direct quote from Marlon Avalos Elizondo, MICITT Director of R&D&I
- CRHoy (Oct. 29, 2024): statements by Minister Paula Bogantes Zamora
- Semanario Universidad (Apr. 15, 2026): MICITT shift toward U.S. model
- Semanario Universidad (May 31, 2023): initial MICITT position on Bill 23.771
- Teletica (Mar. 15, 2025): CAMTIC and Chamber of Commerce position
- El Financiero CR (Mar. 19, 2025): analysis of three bills
- Infobae CR (May 13, 2026): Fernández government calls 62 bills
- Bloomberg Línea (May 31, 2023): Bill 23.771 drafted with ChatGPT-4
- IPANDETEC (2025): AI Legislative Trends in Central America
- Cooperativa.cl (Oct. 13, 2025): Chilean Chamber of Deputies approval
- Diario Constitucional Chile (Feb. 23, 2026): Senate status
Original technical analysis
- Sirius-Lex MVP-A comparative analysis (May 2026): 38 claims, 57 classified risk findings — available upon request