TwinEthos homeRequest access

Law

Chile Law 21.719 (new Art. 8 bis of Law 19.628)

Agencia de Protección de Datos Personales · CL · 1 provision encoded · verified against the official source as of 2026-10-02.

Informational data, not legal advice. Summaries and rules have not been reviewed by a lawyer: always verify official law text for decisions. A suggested guard is intended to address each rule; adding it is not a statement of compliance to that law.

AI-adjacent law General privacy or biometric law, included only where AI data flows trigger it; reported apart from AI-specific law.

Official text: www.leychile.cl.

Trust and provenance 1 official source · last verified 3 Oct 2026 · not reviewed by a lawyer · 1 of 1 provision audit-grade · release 2026.10.03.3

Where this instrument's data comes from, how current it is, and what has and has not been checked. Each provision below has its own panel.

Official sources
Lanes
Binding law — not yet in force or stayed 1
Verification
Sources last verified 3 Oct 2026; each provision states how.
Data release
Data release 2026.10.03.3, data as of 3 Oct 2026, schema 0.3.9.
Legal review
None of the 1 provision has been reviewed by a lawyer; no TwinEthos rule has been legally reviewed yet. Treat each as research to check against the official text; it is not legal advice. Open questions for counsel on them: 1.
Audit standard
1 of 1 provision audit-grade. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
Detectors
1 detector, all experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify. Each provision lists its detectors' known limits.
Changes
  • 2026.10.03.3 (3 Oct 2026): 1 provision added

Each data release records which provisions changed; the full list is on Changes.

Binding law — not yet in force or stayed AI-adjacent law

Automated individual decisions: right to object, information, explanation, human intervention, the person's view and review (Chile, Law 19.628 Art. 8 bis)

Law 19.628, new Art. 8 bis (automated individual decisions, including profiling), inserted by Law 21.719 Art. 1 · official text · Enacted, not yet applying: applies from 1 Dec 2026 · CL

From 2026-12-01, the new Art. 8 bis of Chile's Law 19.628 (inserted by Law 21.719) gives data subjects the right to object to and not be subject to decisions based on automated processing of their personal data, including profiling, that produce legal effects on them or significantly affect them, except where necessary for a contract, with prior express consent, or where a law provides for it with safeguards. In every case, exceptions included, the controller must adopt measures securing the person's rights to information and transparency, to an explanation, to human intervention, to express their point of view and to request review of the decision; Art. 14 ter (l) adds meaningful information on the logic involved and its consequences. Detect a model-driven adverse decision with no review route or no stored explanation.

Trust and provenance not reviewed by a lawyer · audit-grade · source verified 3 Oct 2026 · release 2026.10.03.3
Lane
Binding law — not yet in force or stayed Enacted, not yet applying: applies from 1 Dec 2026
Official source
Law 19.628, new Art. 8 bis (automated individual decisions, including profiling), inserted by Law 21.719 Art. 1 · captured 2 Oct 2026 · anchor hash (SHA-256) a8892fb425dd… · 3 more anchors in the data release
Verification
Quoted text found word for word in the captured official document (3 Oct 2026). Source last verified 3 Oct 2026: checked against the captured official document; not in the weekly watcher's list; checked against the captured document.
Data release
Data release 2026.10.03.3, data as of 3 Oct 2026, schema 0.3.9.
Legal review
Not reviewed by a lawyer. TwinEthos derived this rule from the official text it cites: treat it as research to check against that text; it is not legal advice. No TwinEthos rule has been legally reviewed yet. Open questions for counsel on this rule: 1.
Audit standard
Audit-grade: meets all 10 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
Detectors

1 detector (code pattern), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.

Known limits:

  • Adverse outcomes as numeric codes
  • Decision set in a different file from the model call
  • The review route and explanation may live in another module; follow the decision path before reporting.

Who it applies to

  • Duty falls on: controller
  • Systems covered: automated decision
  • Controllers within Law 19.628 as amended by Law 21.719 (established in Chile; processors acting for a controller established in Chile; or controllers abroad offering goods or services to, or monitoring the behaviour of, data subjects in Chile, Art. 1 bis) that take decisions based on automated processing of personal data, including profiling, with legal or similarly significant effects. Applies from 2026-12-01 (first transitory article). Whether 'automated processing' requires the decision to be solely automated, and the effect of bill boletín 18.623-07 (in the Senate, filed 2026-09-01) on the date, are questions for counsel (review flag).
  • Not covered:
    • The right not to be subject to the decision (first paragraph) does not apply where the decision is necessary for entering into or performing a contract, where the data subject gave prior express consent, or where a law so provides with safeguards; the information, explanation, human intervention, point-of-view and review safeguards apply in every case (Art. 8 bis, second and third paragraphs)
    • Processing by natural persons for personal activities (Law 19.628 Art. 1 as amended, read, not stored)
  • Whether it applies depends on facts outside the code; a person has to decide.

The guard to add

Route significant automated decisions through meaningful human review, or wire in an automated-decision notice, reasons, human intervention, a way to give a view, and contest.

At the point where model output becomes a significant decision about a person (approve, deny, underwrite, set_status), either queue the case for a reviewer who weighs the evidence and can change the outcome before it takes effect (review_queue.enqueue, requires_human_review), or, where the decision stays solely automated, record the permitted basis for that decision type and wire the safeguards in. Those safeguards are a notice in the decision message that it was made by automated processing, reasons the person can read, and request_human_review or contest routes where the person can give their view and have a human reconsider. A reviewer who approves every case without examining it does not make the decision non-automated, so the review records reviewer identity, the evidence viewed, and the outcome.

Where it goes: 1 application source code, 9 AI output handling, 15 agent action surface, 14 user-facing text.

What this provision adds:

  • In every automated decision, contract and consent cases included, give the person information, an explanation, human intervention, a way to express their point of view and to request review.
  • Where the decision is not necessary for a contract, consented to or provided for by law, honour the person's objection and do not subject them to it.

Example (Python + OpenAI SDK), before:

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

After:

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Control: Solely-automated significant decision without human-intervention safeguards. The same guard addresses 15 items with binding law in 15 jurisdictions. Engineering guidance, not legal advice.

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

Rule id cl-law-21719.automated-decision-safeguards · review status: primary source derived

Informational data, not legal advice. Summaries are TwinEthos's own words and rules have not been reviewed by a lawyer: check the official text before relying on any of it. A guard addresses an item; adding it is not a statement that your code meets any law.