AI regulation in Andorra: laws & policy (2026)

Minister of Digital Transformation Marc Rossell announced plans to deploy a Microsoft Copilot-like AI assistant across every public administration employee by 2027 to automate repetitive tasks and draft administrative documents. The announcement was tied to a report of a 5.6% rise in AI-assisted cybersecurity incidents (1,624 total) in 2025, underscoring both the opportunity and risk dimensions of AI adoption.

Andorra became a founding signatory of the Council of Europe's Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, the world's first legally binding international AI treaty, alongside the EU, US, UK, Israel, and six other states. The convention requires signatories to align the full lifecycle of AI systems with human rights, democracy, and the rule of law, and to establish domestic oversight mechanisms.

The Government of Andorra adopted its Code of Ethics for AI, a voluntary framework directing the public sector, private sector, and citizens on trustworthy AI deployment. Aligned with UNESCO, OECD, and Council of Europe standards and embedded in the PdTDA 2024-2027, the Code may become binding in public procurement; it also formally established the Data Intelligence Agency (AID) mandate within Andorra Digital.

The government enacted the implementing regulation for Law 42/2022, detailing operational requirements for digital businesses, regulatory sandboxes, and innovation enablement frameworks; the regulation entered into force on 17 June 2023. This decree provides the concrete mechanisms for supervised experimentation with emerging technologies including AI-based services.

The government approved its first comprehensive Digital Transformation Strategy with a 2030 horizon, its four strategic axes include adopting emerging technologies (AI) and safeguarding citizens' digital rights. The strategy explicitly designates AI governance as a transversal national priority and sets the frame for all subsequent AI-related policy, including the Code of Ethics and the AID.

Andorra's GDPR-aligned data protection law came into full force, granting individuals the right not to be subject to solely automated individual decisions with legal effects, requiring Data Protection Impact Assessments, mandating 72-hour breach notification, and imposing fines up to €100,000. The Andorran Data Protection Agency (APDA) became the competent authority for AI systems that process personal data.

The government launched the Programa de Transformació Digital d'Andorra (PdTDA) as the operational vehicle for its long-term digital agenda, revised every three years. The programme established the Data Intelligence Agency (AID) within Andorra Digital, the body tasked with developing a national AI and data governance strategy, a regulatory and ethical framework, and tools for responsible AI deployment across public services.