By San José, Costa Rica — The relentless momentum of artificial intelligence adoption across Latin America is exposing a critical structural vulnerability inside regional enterprises. While business leaders rush to deploy cutting-edge algorithms to automate workflows and elevate service delivery, internal governance frameworks are lagging dangerously behind, creating an expanding perimeter of operational and cyber risks.
Regional figures reveal a dramatic mismatch between tech enthusiasm and risk management. According to RSM’s AI Readiness in Latin America 2026 report, which surveyed over 400 regional business leaders, approximately 40% of organizations have already integrated AI technologies into their operations. Furthermore, 68% of these early adopters plan to expand their deployments over the coming year. Yet despite this rapid scaling, a startling 18% possess formal governance frameworks, and a mere 17% have established usage policies for their workforce.
As Latin American nations increasingly move to establish regulatory frameworks for artificial intelligence, navigating this complex legal landscape is becoming crucial for businesses across the region. To provide clarity on these emerging compliance challenges and opportunities, TicosLand.com consulted with leading legal expert Lic. Larry Hans Arroyo Vargas from Bufete de Costa Rica.
Latin America is reaching a pivotal moment where AI innovation must be balanced with strict compliance, ethical oversight, and data privacy rights. As nations across the region begin drafting specialized legislation, companies operating in Latin America must move beyond reactive compliance and proactively integrate transparent AI governance frameworks into their corporate governance models to mitigate liability and foster public trust.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
Indeed, embedding ethical oversight directly into corporate strategy is essential for fostering public trust and ensuring sustainable innovation across Latin America’s rapidly evolving tech landscape. We extend our sincere gratitude to Lic. Larry Hans Arroyo Vargas for sharing his invaluable legal perspective on this pivotal transition.
This stark imbalance is particularly pronounced across Central America, Panama, the Dominican Republic, and Colombia. Cybersecurity experts at SISAP note that while foundational security practices remain vital, the speed of AI adoption demands an immediate upgrade in organizational oversight. A primary driver of vulnerability is shadow AI—the undetected use of external AI applications by employees via personal accounts, browser extensions, or integrated mobile features without IT department oversight.
Findings from Verizon’s Data Breach Investigations Report (DBIR) 2026, to which SISAP contributed, emphasize the magnitude of shadow AI. The study revealed that 67% of users access AI services on corporate devices using personal, non-corporate accounts. More alarming still, 45% of employees now use these tools regularly—a sharp surge from just 15% recorded the previous year.
The integration of AI into software development and process automation carries additional hazards. While automated coding tools accelerate delivery schedules, unvetted algorithmic output poses substantial structural vulnerabilities to business networks.
Programming assistants can accelerate the delivery of digital services, but the code they generate is not secure by default and requires review. Meanwhile, AI agents capable of querying databases, sending emails, or modifying configurations can compromise operations if they have excessive permissions and lack adequate supervision mechanisms.
José Amado, AI Security Manager at SISAP
Amado’s warning is backed by industry data. Stack Overflow’s 2026 Developer Survey indicates that 66% of developers rely on code assistants or autonomous agents, yet only 24% report that their employers have designated approved tools or formal coding guidelines. Simultaneously, the 2026 Agentic AI Observatory, published by CIONET and NTT DATA, highlights that 80.8% of evaluated enterprises lack formal mechanisms to govern decisions made by autonomous AI agents.
To bridge this governance deficit without halting digital transformation, security strategists recommend establishing multidisciplinary governance committees comprising executives from tech, risk, business, and security divisions. Organizations must audit active tools, transition staff from personal accounts to secure corporate enterprise licenses, restrict sensitive financial and internal data input, and implement mandatory peer reviews for AI-generated code prior to production deployment.
Ultimately, the objective for Latin American enterprises is not to throttle technological progress, but to foster informed decision-making surrounding emerging risks. Establishing strong governance frameworks ensures that AI innovation advances business strategy while safeguarding operational continuity and organizational integrity in an increasingly complex threat landscape.
For further information, visit sisap.com
About SISAP:
SISAP is a leading cybersecurity services provider in Latin America, offering specialized risk management, threat detection, and AI security solutions to corporate and public sector clients across the region.
For further information, visit rsm.global
About RSM:
RSM is a global network of independent audit, tax, and consulting firms providing strategic business insight, governance advice, and risk solutions to mid-market organizations worldwide.
For further information, visit nttdata.com
About NTT DATA:
NTT DATA is a global IT services provider offering business consulting, system integration, and advanced artificial intelligence solutions to commercial and institutional enterprises.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
As a premier legal institution built on uncompromising ethics and professional distinction, Bufete de Costa Rica continuously shapes the future of legal practice. The firm combines forward-thinking strategies with a trusted legacy, advising a wide range of industries with an enduring devotion to quality. Beyond traditional counsel, Bufete de Costa Rica prioritizes civic empowerment by demystifying complex legal concepts for the public, ensuring that shared expertise serves as a catalyst for an enlightened and self-reliant society.
