The Next Outbreak in Aquaculture Won’t Be Biological

By Sandra Silva | Guest Columnist | Aquaculture Magazine

Regulatory outbreaks reach the aquaculture sector with the same logic as sanitary ones: no warning, a clearly identifiable causal agent, and a predictable propagation map. Five algorithmic governance regulations are landing on Latin American aquaculture operations at the same time, driven both by local regulators and by European buyers. Having a protocol in place before the first case is what separates the companies that absorb the change from those that pay for it.

A year ago I began documenting how the European algorithmic regulation regime is reaching Latin American aquaculture producers by way of contract. The scene keeps repeating itself: a European buyer asks its supplier for things it did not ask for in 2023. Algorithmic traceability in supplier selection. A written declaration on the use of artificial intelligence at the plant. Documentary evidence of human review over automated decisions. These are not tariff or sanitary requirements. They are something else. They arrive unannounced, in a new clause.

The phenomenon has all the features of a regulatory outbreak: symptoms, a causal agent, a propagation map, and a possible treatment. Five regulations are reaching the aquaculture sector at the same time, uncoordinated with one another. The European Artificial Intelligence Act applies as of August 2, 2026. The European Deforestation Regulation, after the second postponement approved by the European Parliament on December 17, 2025, takes effect for large and medium-sized companies on December 30, 2026. Chile activates Law 21.719 on December 1, 2026. Brazil has applied the LGPD since 2020, with the ANPD’s sanctioning regime in force since August 1, 2021. Peru activated the operational regulations of its Artificial Intelligence Law on January 22, 2026, through Supreme Decree 115-2025-PCM. They all push in the same direction: the European client faces regulatory pressure of its own and passes it on to Latin American suppliers by contract.

Five regulations are reaching the aquaculture sector at the same time, uncoordinated with one another. The European client faces regulatory pressure of its own and passes it on to Latin American suppliers by contract.

Chile as Ground Zero

Chile is not the first country on the continent to regulate. But it is the first to assemble the complete package: a demanding law, a new agency, enforcement from day one, and real penalties. Law 21.719 requires that every algorithmic decision affecting people have documentary traceability, meaningful human review, and auditable criteria. “Decisions affecting people” means how suppliers are selected, how plant staff performance is evaluated, how shifts are assigned to seasonal workers, and how prices or commercial penalties are set for a mid-sized fish farmer. These are not laboratory decisions. They are everyday operations.

Fines scale with severity. For the most serious infractions with recidivism, the ceiling is 20,000 UTM (Chilean monthly tax units) or 4% of annual revenue, whichever is greater. For a mid-sized Chilean salmon farmer, that ceiling amounts to several million dollars for a single infraction. Over the coming year, regulators and executive teams across the rest of the continent will be watching Chile closely. It is either a window for learning or a window for repetition.

For the most serious infractions with recidivism, the ceiling is 20,000 UTM or 4% of annual revenue, whichever is greater. For a mid-sized Chilean salmon farmer, that ceiling amounts to several million dollars for a single infraction.

The Map, Country by Country

Chilean salmon farmers: fully within the scope of the 21.719 regime. The large companies with European buyers already received their first documentation requests in May and June. Mid-sized companies are moving at a different pace, still in the early stages.

Ecuadorian shrimp farmers: since February 12, 2026, when the Superintendency for Personal Data Protection issued Resolution SPDP-SPD-2026-0009-R, a general rule has been in force on the use of artificial intelligence systems and personal data, with obligations on transparency, risk assessment, and auditing. The additional pressure arrives through European commercial contracts, not from the Ecuadorian authority — indirect, and therefore harder to detect: it shows up in the buyer’s email, not in the official gazette.

Brazilian tilapia farmers: double exposure. They have had the LGPD in force since 2020, with the ANPD’s sanctioning regime since August 2021, and they have European clients who make demands as well. Those that went through the first LGPD wave are better prepared.

Peruvian producers (whiteleg shrimp, paiche, trout): Law 29733 on data protection is in force with partial enforcement, and since January 22, 2026, the operational regulations of Law 31814 on the use of artificial intelligence apply as well. Large producers are already adapting; mid-sized ones are not yet reading the issue.

Spain, a dual role. As a producer (Galician mussels, Mediterranean sea bream), it has complied with the GDPR since 2018 and applies the European AI Act directly. As a demanding client, it passes its legal obligations on to Latin American suppliers by contract. That is what the Latin American reader is feeling, even without ever having read a Spanish regulation.

Two Recurring Patterns

One. The companies making the best progress are those treating the issue as an operational adjustment, not as an exclusively legal task. If an inspection detects an algorithmic gap at the plant or along the supply chain, what gets evaluated is the production process, not the signed paperwork.

Two. Generic international certifications — ISO 27001, ISO 27701, sector frameworks such as GLOBALG.A.P. — do not match the Chilean regime point by point. They serve as a technical floor, not as a complete legal answer. The difference is paid on the day the regulator asks for the specific matrix the law requires and the consultancy delivers its generic one.

Generic international certifications serve as a technical floor, not as a complete legal answer. The difference is paid on the day the regulator asks for the specific matrix the law requires and the consultancy delivers its generic one.

What Comes After the First Regulation

Law 21.719 is the current trigger, not the endgame. Others are coming behind it: the European AI Act, with high-risk systems fully enforceable on December 2, 2027; the Chilean artificial intelligence bill making its way through the legislature; and the sector-specific rules that the SMA, Sernapesca, and SAG have yet to issue. Each one will rest on the governance infrastructure a company builds for 21.719 — or the work starts from zero every time.

Producers who treat the law as a one-off project — we solve this and get back to business — will find themselves in 2027 redoing the same work with the AI Act bearing down on them. Those building permanent internal capacity — a committee, a protocol, a decision log, periodic review — will absorb the next regulation without starting over.

Biological outbreaks taught the aquaculture sector to have sanitary protocols ready before the first case. Regulatory outbreaks have not yet taught it anything equivalent, because the sector remains convinced they do not apply to it. They do. They already are.

Biological outbreaks taught the aquaculture sector to have sanitary protocols ready before the first case. Regulatory outbreaks have not yet taught it anything equivalent. They do apply. They already are.

For the Latin American producer reading this from Guayaquil, Florianópolis, La Paz, or Mazatlán: what is happening in Chile is not a Chilean problem. It is a live rehearsal of a regulatory shift reaching the region at different speeds by country. Watching it now is what it takes for the European buyer’s email, when it arrives, not to arrive as a surprise.

References

• Law 21.719 (Chile). National Congress Library of Chile.
• Regulation (EU) 2024/1689 · AI Act. European Commission AI Act Service Desk.
• Regulation (EU) 2023/1115 · EUDR and December 2025 amendment. European Commission · Deforestation Regulation.
• LGPD Brazil · sanctioning regime since August 1, 2021. Autoridade Nacional de Proteção de Dados.
• Peru · Supreme Decree 115-2025-PCM (Regulations of Law 31814). Official Gazette El Peruano.
• Ecuador · Resolution SPDP-SPD-2026-0009-R. Superintendency for Personal Data Protection.

Sandra Silva is a consultant in algorithmic governance and international market development for regulated industries. Author of the whitepaper Compliance with Law 21.719 in the Chilean Salmon Farming Industry (Registration DDI 2026-A-6405 with Chile’s Department of Intellectual Rights · certificate available upon request). Columnist for Diario Lechero and Salmonexpert. Contact: contacto@sandrasilvaautora.com · linkedin.com/in/sandrasilvaautora