Uruguayan Senate reviews critical infrastructure bill

Uruguay’s Senate included the bill "On the Protection of Critical Infrastructure" on the agenda for its ordinary session on Wednesday, Sept. 16. The proposal seeks to raise cybersecurity standards for public and private entities. According to Última Hora, the text is based on the 2004 Budapest Convention on Cybercrime and has already been described with several technical and reporting obligations.

What does the bill propose?

The bill would identify certain public entities as critical infrastructure, create a national registry of categorized critical infrastructure, and require detection and response systems for incidents, known as IDS/IPS. It also adds further obligations for public and private operators, including specific security protocols for operational technology and the Internet of Things, according to Última Hora.

Who would it cover, and what deadlines does it set?

The proposal introduces the category of Critical Infrastructure Operators, or OICs, which brings together public and private entities and requires them to notify the state of incidents within a maximum of 12 hours after they occur. The text also calls for the creation of a National Cybersecurity Council, which has not yet been formed, with an explicit mandate to design a national strategy for protecting critical infrastructure.

What other steps have been taken on technology regulation?

In parallel, a message posted by SuNoticiasUY on X said that in 2024 AGESIC presented recommendations to the Uruguayan parliament for regulating artificial intelligence, with technical cooperation from UNESCO and the IDB. The post said the recommendations were aimed at defining which uses of AI are acceptable, but it did not link to the official document or specify a bill number or parliamentary status. Coverage of the launch of Uruguay’s AI think tank also described AGESIC as a key player alongside Uruguay Innova, Senci, and ANII, without explicitly linking that role to an AI bill in parliament.