In August 2026, our team measured something that should worry any compliance officer relying on a single AI reviewer: with a single model reviewing generated code, the false rejection rate on its evaluation set was 38%. Adding a second reviewer and requiring both to agree before blocking dropped it to 19%. The finding matters because it quantifies what governance looks like when you stop treating a model as an oracle and start treating it as a component in a controlled pipeline.
What happened
Panama's Bill 588 of 2026, which establishes adaptive governance for artificial intelligence, cleared its third debate on August 19, 2026. As of late September 2026, it awaited executive sanction and was not yet law. The bill introduces requirements that shift AI oversight from a policy aspiration to a verifiable process.
According to the legislative summary published by the firm Pacífica Legal, Bill 588 calls for meaningful human oversight: the real capacity to understand, evaluate, intervene in, and reverse AI-assisted decisions, supported by documented processes and verifiable records. It also calls for clear information about AI-assisted decisions. These are not abstract principles. They imply that a company must know which model touched which data, who approved the outcome, and what evidence remains.
Separately, Panama's Law 81 of 2019 already mandates security measures proportional to risk for personal data. The combination of an active data protection law and a pending AI governance bill creates a regulatory environment where companies handling sensitive data—financial institutions, insurers, regulated service providers—need controls that work regardless of which model sits behind them.
A survey of 237 companies in Panama, cited by Infobae on September 22, 2026, found that 39% have no clear responsible parties or processes for AI, 38% supervise AI in isolated silos by department, and only 11% have AI integrated and generating value. The numbers describe a market where governance infrastructure is still being built.
Why model-agnostic governance matters now
A frontier model and a local model serve different purposes in a regulated operation. The frontier model handles tasks that require broad reasoning: designing architecture, specifying requirements, evaluating complex trade-offs. The local model, running on infrastructure the company controls, handles high-volume work where data cannot leave the perimeter: generating code, processing documents with sensitive fields, classifying transactions.
When governance is tied to a specific model, every model swap resets the controls. The prompts change, the output format shifts, and the audit trail fragments. When governance lives one layer above the model—at the gateway, the identity layer, and the approval workflow—the controls survive the swap.
A model gateway that assigns a unique key per person and per agent, enforces a budget per key, and logs every call with model, token count, and latency creates an audit trail that is independent of the model behind it. If the local model is replaced next quarter, the gateway still knows who called it, how much they spent, and what came back. The budget per key prevents runaway consumption. The per-call trace enables the verifiable records that Bill 588 describes.
What this means for operations in Latin America
Bill 588 puts the emphasis on documented processes and verifiable records. That is the same thing any auditor asks for today: evidence, not assurances.
For a company operating in multiple Latin American markets, building governance that is model-agnostic from the start reduces the cost of adapting to new regulations. The same gateway that logs model calls for Panama's requirements can log calls for another country's data protection authority. The same approval workflow that ensures a human signs off before code reaches production satisfies multiple audit frameworks.
The 39% figure from the Infobae survey—companies with no responsible parties or processes for AI—represents exposure. When a regulator asks for the record of an AI-assisted decision, the absence of a gateway log, an approval trail, or a data classification policy becomes the finding. The survey does not say what the 11% have in place; the useful question for everyone else is whether they could produce that record today.
Data residency adds another layer. A local model running on company infrastructure solves the residency problem for data at rest and in transit during inference. But it does not solve the governance problem. Without a gateway, the local model is an ungoverned endpoint. With a gateway, every call to the local model is logged, budgeted, and attributable, just like every call to the frontier model. The model changes; the controls do not.
What your company can do this week
-
Inventory every place a model touches data. List which models (frontier or local) interact with which data categories. Note whether the data contains personal information under Law 81, financial records, or other regulated content. This inventory is the foundation for every control that follows.
-
Separate the gateway layer from the model layer. If you are calling models directly from application code, insert a gateway that assigns keys per user and per agent, sets budgets, and logs every call. Do this before the next model swap, so the audit trail is continuous across changes.
-
Define what requires human approval before it takes effect. Identify outputs that have external consequences—publishing content, merging code to production, sending communications—and route them through an approval step where a person signs off. Document the approval criteria so the process is consistent and auditable.
-
Run a dual-review test on your highest-risk AI output. If you use a model to generate or review something that affects compliance, test what happens when two models must agree before the output is accepted. Measure the false rejection rate with one reviewer versus two. Our August 2026 measurement showed a 19-percentage-point reduction in false rejections when two reviewers had to concur.
-
Draft the evidence package you would show a regulator. Before a request arrives, assemble what you would provide: the gateway log for the relevant call, the data classification of the inputs, the approval record, and the identity of the approver. If you cannot produce this for a given AI-assisted decision, you have identified a gap to close.
My take
I lead a cybersecurity team in Panama that works with regulated companies. The companies that treat AI governance as a compliance checkbox are the ones that will have to rebuild their controls when a model changes or a regulation takes effect. The companies that treat governance as infrastructure—a gateway, an identity layer, an approval workflow, a logging standard—will swap models without swapping controls.
The dual-review measurement we ran in August 2026 taught me something practical: governance is not about trusting a model more; it is about trusting any single model less. Requiring two models to agree before blocking a change cut false rejections in half. That is a measurable improvement in a control, and it works the same way whether the models are frontier or local.
Bill 588 is not law yet, but its requirements for documented processes and verifiable records are already what a competent audit expects. Law 81 is already in force. The companies that build model-agnostic governance now will have less to retrofit later.
Frequently asked questions
Does running a model locally automatically solve data residency?
Running a model locally keeps data within your perimeter, but that alone does not meet governance requirements. You still need to control which data reaches the model, log every interaction, and enforce access policies per user and per agent. Without those controls, a local model is just an ungoverned endpoint inside your network.
What is the difference between a model gateway and a standard API proxy?
A standard API proxy routes requests and may add rate limiting. A model gateway assigns a unique key per person and per agent, enforces a budget per key, and logs every call with model, token count, and latency. This creates an audit trail that survives a model change because the controls live at the gateway layer, not inside the model.
How does the Panama AI bill define meaningful human oversight?
According to the legislative summary published by the firm Pacífica Legal, Panama's Bill 588 of 2026, still pending sanction, calls for the real capacity to understand, evaluate, intervene in, and reverse AI-assisted decisions. It also calls for documented processes, verifiable records, and clear information about AI-assisted decisions.
For more on governance infrastructure for regulated AI operations, see Soluciones Etech's AI services and the compliance mapping for Panama's Law 81.
Already using AI? We run a free 45-minute AI governance assessment for regulated companies: which model touches which data, where a control is missing, and what evidence an auditor would ask for today. Book the assessment