Government of Puerto Rico agencies are deploying artificial intelligence, and the rules that govern the vendors who supply it have accumulated faster than most of those vendors realize. Since September 29, 2025, PRITS-POL-0012, the Government’s AI policy, has bound contractors and suppliers of AI systems to detailed requirements, replaced the 2023 circular letter that preceded it, and required written clearance from the Puerto Rico Innovation and Technology Service (“PRITS”) before any AI contract is signed. Ley Núm. 40-2024, as amended this year, applies its minimum cybersecurity standards, its 48-hour incident notice and its penalties to every information technology provider that serves the Government, and since June 1, 2026, PRITS-REG-001 supplies the enforcement procedure, with unannounced inspections and fines up to the contract amount. Agentic AI, which acts on systems and data rather than only answering questions, tests all three, and the Policy’s own terms classify it as high risk. In this Legal Update, we summarize the three instruments, apply them to agentic deployments, and identify the contract terms vendors should expect.
The Policy: PRITS-POL-0012
The Política para el uso de inteligencia artificial en el Gobierno de Puerto Rico (Policy for the Use of Artificial Intelligence in the Government of Puerto Rico), issued under Ley Núm. 75-2019, Ley Núm. 40-2024, the Ley de Gobierno Electrónico and the Ley de Datos Abiertos, and built on NIST’s AI Risk Management Framework 1.0 and Cybersecurity Framework 2.0, applies to Executive Branch entities, public corporations and municipalities, and to any person who does business or contracts with the Government, as to the public functions performed.[1] It governs every AI system or service used, developed, procured or maintained by or on behalf of a government body, including generative AI, decision-support systems and robotic process automation with AI components, through the system’s full life cycle. Two of its rules frame everything else. Every contract involving AI services must include terms that reflect and enforce the Policy. And no contract for an AI product or service may be finalized without documented PRITS confirmation and explicit written clearance.
The Policy then regulates the system itself. Each AI system must be classified as low, moderate or high risk under the matrix in Appendix I, and a system that operates autonomously or with limited human intervention is high risk, which requires fairness and bias assessments, regular audits and continuous monitoring, and permits PRITS to impose additional conditions. Certain uses, such as social scoring and mass surveillance without lawful authority, are banned outright. AI must support rather than replace human judgment, with pre-decisional human review for critical determinations or a post-decisional appeal. Access to AI resources requires multi-factor authentication for all user accounts and least privilege for users and processes, under a zero-trust model. And in the provision that matters most for agents, no AI system may be granted privileged or administrative access to government IT infrastructure, including system configuration, the creation, modification or deletion of user accounts, or elevated API permissions; those functions must remain under direct human control. AI activity, including decision outputs where feasible, must be logged in tamper-protected form and monitored, incidents involving an AI system must be reported to PRITS’s Office for Cyber Incident Evaluation within the periods of the Government’s incident response policy, sensitive government data may not be fed to external or public AI services without authorization and safeguards, and cloud AI providers must hold FedRAMP or an equivalent certification.
For vendors, Section 19.6.2 and the twenty-clause checklist in Appendix II set the minimum contract terms: compliance with PRITS security standards and recognized frameworks; government ownership of its data and of every derivative model, analytic or insight; no secondary use of government data; disclosure of third-party datasets and pre-trained models; measurable performance metrics with a duty to remediate defects, vulnerabilities and algorithmic bias; a government right to test and audit the system at any time, with no contractual “black box” limitation; documentation including model cards and change logs; no hidden functionality; prompt reporting to the agency and PRITS of incidents, vulnerabilities and significant errors or anomalous AI behavior; indemnification; liability caps that are not meaningless, with confidentiality violations, intellectual-property infringement and major security incidents excluded from them; no major version change without agency testing and acceptance; agency approval of subcontractors that handle sensitive data; Puerto Rico law as governing law; dispute-resolution terms that do not force the agency into an out-of-state forum or arbitration; and termination and transition obligations. Noncompliance exposes the vendor to suspension or deactivation of the system, fines and sanctions under Ley Núm. 40-2024, contract termination, disqualification from contracting, and referral of willful or reckless misconduct to law enforcement.
The Statute and Its Regulation
Ley Núm. 40-2024, the Ley de Ciberseguridad del Gobierno de Puerto Rico (Government of Puerto Rico Cybersecurity Act), as amended by Ley Núm. 140-2026, sets minimum cybersecurity standards for agencies and for private providers of information technology and communications services, requires those providers to notify PRITS and the contracting agency within 48 hours of discovering an incident, prohibits covered entities and their agents, insurers and guarantors from paying ransoms, and penalizes a provider found responsible for obstruction, negligence or bad faith in handling an attack with liability up to the contract amount plus damages and a five-year bar from government contracting.[2] The 2026 amendment also added the use of AI to the cybersecurity training the Act requires, and the Legislature has separately required disclosure of AI-generated content in political advertising.[3] We discussed the 48-hour notice in our Legal Update of October 19 and the ransom prohibition in our Legal Update of October 23.
On May 26, 2026, PRITS adopted the regulation that gives those penalties a procedure: PRITS-REG-001, the Reglamento para la Imposición de Multas por Violaciones a los Estándares de Ciberseguridad (Regulation for the Imposition of Fines for Violations of Cybersecurity Standards), in force since June 1, 2026, and adopted without the public-comment process of the Ley de Procedimiento Administrativo Uniforme, which Ley Núm. 40-2024 waives.[4] It defines “contracted service providers” to include any entity that supplies networks, applications, software, infrastructure or security tools with ongoing support, whether on the agency’s premises, in its data center or in a third party’s, which reaches cloud, software-as-a-service and AI vendors. It authorizes PRITS to investigate on its own initiative or on a complaint from anyone, to demand sworn written answers and documents, to enter rooms and access equipment holding public information without prior notice, and to inspect in person or remotely; a provider may contest a request only on the ground that it exceeds PRITS’s authority, and only within three calendar days. Where PRITS finds a violation, it may issue an incident notice with 15 days to cure or submit a corrective action plan, impose fines up to the contract amount independent of contractual penalties and damages, take direct control of the affected systems at the provider’s expense, cancel the contract, declare null a contract executed without consulting PRITS that cannot be brought into compliance, and bar the provider, and any entity sharing a significant number of the same people, from government contracting and subcontracting for five years. A fine becomes final 20 days after notice unless the provider requests a hearing, hearings are public unless the provider shows harm, and neither reconsideration nor judicial review stays the order.
Applied to Agents
What Comes Next
Pending bills would extend PRITS’s authority further. P. del S. 68 would create a Government AI Officer within PRITS and direct PRITS to set government-wide AI policy, and a House measure would require agencies to obtain PRITS authorization before using AI, with fines of up to $10,000 for noncompliance.[5] The federal baseline is moving the same way. The joint guidance of CISA, NSA and four allied agencies on the careful adoption of agentic AI (May 1, 2026) and NIST’s AI Agent Standards Initiative (February 2026) describe the controls agencies will come to expect, and PRITS built its Policy on NIST’s frameworks before either existed.[6] We discussed that guidance, and the contract terms it implies for any buyer of agentic AI, in our Legal Update of October 25.
Practical Implications for Vendors
We will continue to monitor developments and will provide further updates as warranted. If you have questions about the matters discussed in this Legal Update, please contact the Maceira Zayas lawyers with whom you regularly work.
Endnotes
This publication provides general information on legal developments of interest to clients and friends of Maceira Zayas. It is not a comprehensive treatment of the subject matter and does not constitute legal advice. Readers should consult counsel before acting on any matter discussed here. Developments after the date of this Legal Update are not reflected.
