Colombia - Ethical AI Law Proposal (PL 005/2024C)

Overview

Proyecto 05/24 (PL 005/2024C) — "Ley de inteligencia artificial ética y sostenible para el bienestar social" — was presented to the Colombian Cámara of Representatives on 20 July 2024. Its stated aim was to establish a principle-based regulatory framework governing development and use of artificial intelligence in Colombia, with a specific emphasis on human rights protection, environmental sustainability, and social welfare. The Cámara of Representatives maintains an official project page for the bill and basic procedural metadata; see the Cámara project record and the Universidad de los Andes / Congreso Visible dossier for legislative timeline details. The proposal advanced through the Comisión Sexta (Constitutional) and a positive ponencia for first debate was published on 22 November 2024. The draft proposes a tiered, risk-sensitive regime that combines documentation and transparency obligations, data-protection safeguards, mandatory risk assessments for high-impact systems, cybersecurity measures, and institutional arrangements for oversight and enforcement. For primary project records, consult the Cámara project page at Cámara - Ley de Inteligencia Artificial Ética and the legislative tracker at Congreso Visible - Project 05/24.

Definitions

The bill establishes definitions to ensure legal clarity. Key terms include: "artificial intelligence" (a system that, given a set of human-defined objectives, generates outputs such as content, predictions, recommendations or decisions influencing environments or human actors), "AI system developer", "provider/operator", "high-risk AI system" (systems with significant potential to affect fundamental rights, health, safety, or socioeconomic status), "data controller/processor" (aligned with Law 1581/2012), "explainability" (the capacity to provide meaningful information about model logic and outputs), and "sustainability" (environmental and lifecycle obligations including obsolescence management). The bill’s definitions create the baseline for obligations, conformity processes and enforcement actions outlined in later sections.

Governance and Institutional Framework

The draft creates an institutional architecture for AI oversight that combines sectoral, horizontal, and advisory roles. It envisions coordination among the Ministry of Science, Technology and Innovation (Minciencias), the Ministry of Information Technologies and Communications (MinTIC), the Superintendence of Industry and Commerce (SIC) for data protection and consumer protection, and the Agencia Nacional Digital (AND) for public-sector digital transformation and interoperability. The bill contemplates either (a) designation of an existing agency as the national AI oversight coordinator or (b) establishment of an inter-agency council to manage registration, high-risk system review, public consultations, capacity building and international cooperation. Institutional duties include maintaining registries of high-risk systems, issuing technical guidelines and conformity frameworks, operating complaint and redress channels, and coordinating market surveillance and enforcement actions.

Key Focus Areas

The project concentrates on several core areas: (1) Rights protection and nondiscrimination — ensuring AI respects constitutional rights and mitigates algorithmic bias; (2) Data protection and privacy — requiring adherence to Law 1581/2012 and privacy impact assessments where relevant; (3) Transparency and explainability — obliging providers to disclose system capabilities, limitations and data provenance and to label synthetic content; (4) Risk management — mandatory risk classification, pre-deployment impact assessments, and continuous post-deployment monitoring for high-risk systems; (5) Safety, testing and conformity — standardized testing, third-party audits and technical conformity checks; (6) Cybersecurity and model-security — baseline requirements for secure development, logging and vulnerability management; (7) Environmental sustainability — lifecycle disclosures, energy consumption reporting, and obligations on obsolescence management in public procurement; and (8) Access and inclusion — measures to reduce the digital divide and promote gender- and child-sensitive protections.

Implementation Framework

The draft defines phased implementation sequenced by risk and sector. Low-risk systems would face light-touch obligations (transparency and documentation), whereas high-risk systems would be subject to mandatory impact assessments, conformity assessment or registration, and periodic audits. Obligations rest primarily on developers/providers and public-sector procurers. The bill proposes guidance documents and implementation roadmaps to be issued by coordinating agencies, capacity-building programs for public actors, and a central registry for high-risk systems to enable market surveillance. Public procurement rules would be adapted to require sustainability and ethics criteria for AI acquisitions by state entities.

Monitoring and Evaluation

Monitoring mechanisms include periodic reporting by regulated entities, a national registry of high-risk AI systems for sampling and inspection, incident and harm reporting channels, and requirements for independent or third-party audits in specified cases. The oversight body or council is required to publish yearly enforcement and impact reports, and to update risk taxonomies and technical standards in light of technological evolution. The bill promotes participatory monitoring involving civil society, academia and affected communities to ensure responsive evaluation of social impacts and policy coherence.

Penalties, Liability, and Appeals

The draft contemplates administrative sanctions (corrective orders, fines, temporary suspension of systems, and orders to withdraw noncompliant services) and preserves civil liability claims for harm caused by AI systems. It also defines internal appeals and administrative review processes for sanctioned parties and protects procedural due process. Sanctions are calibrated according to the severity of harm and the culpability of the operator, and the bill foresees remedial obligations (product fixes, public notifications, remediation funds for affected individuals) alongside enforcement actions. Criminal penalties are not central in the text but may apply where existing criminal laws are implicated (e.g., fraud, privacy breaches with aggravated circumstances).

Relationship to Other Instruments

The proposal explicitly links to domestic instruments — notably Colombia’s data protection regime (Law 1581/2012) and consumer protection law — and to international commitments and standards. It recommends alignment with global ethical AI guidance, interoperability standards, and cross-border cooperation for enforcement and certification. The bill is drafted to be complementary to sectoral regulation (health, finance, telecommunications) while providing horizontal safeguards and baseline obligations for AI across sectors.

International Alignment

The project references international frameworks and instruments as models and points of alignment — for example, ethical AI recommendations from UNESCO and risk-based approaches similar to the European Union’s AI Act. The text signals intent to coordinate with foreign regulators and international organizations for capacity building, mutual recognition of conformity assessments and exchange of best practices. The Colombian Ministry responsible for science and technology and the diplomatic apparatus were expected to coordinate international cooperation to facilitate alignment and technical assistance.

Implementation Timeline

Sources and References