Colombia - AI for Road Safety (255/2024)

Overview

Proyecto de Ley No. 255 de 2024 (Senado) was filed on 13 March 2024 and proposes operational and governance lineamientos for the use of Artificial Intelligence (AI) to reduce road traffic accidents and their socio-economic costs in Colombia. The initiative positions AI as a tool for automated collection and analysis of sensor and incident data, predictive risk modeling, and real-time alerting to drivers, pedestrians and authorities. The bill frames its objectives around improving prevention, detection and management of road incidents while limiting negative impacts on privacy and fundamental rights. Official Senate coverage and legislative summaries describe the project’s sponsors and the public-sector actors to be involved — notably the Senate press release (March 21, 2024) and a technical synopsis published by Congreso Visible / Uniandes.

Definitions

The bill defines key terms to delimit scope and obligations. Important definitions include: "Artificial Intelligence (AI) systems" (software systems that perform tasks by processing data and generating predictions, classifications or recommendations); "safety-critical AI" (systems whose malfunction could lead to serious harm to persons or property, e.g., traffic-control automation or automated vehicle interventions); "real-time alerting" (systems that process live data streams and issue immediate notifications to road users or authorities); "personal data" and "sensitive data" (as per Colombia's data protection regime); "human-in-the-loop" (operational models requiring human review before enforcement or life-safety decisions); "operator" (entity deploying or controlling an AI system); and "incident" (any event classified as a traffic accident, near-miss, or hazard detected or predicted by the AI).

Governance and Institutional Framework

The project assigns roles to national and territorial institutions with road-safety mandates. Primary institutional actors named in the bill include the Agencia Nacional de Seguridad Vial (ANSV), the Ministry of Transport">Ministry of Transport and the Dirección de Tránsito y Transporte de la Policía Nacional. The bill contemplates an inter-institutional coordination mechanism and designates a lead regulatory authority (or joint secretariat) responsible for: (i) maintaining a registry of deployed AI systems for road safety; (ii) issuing technical guidelines and minimum standards for safety testing, data governance and cybersecurity; (iii) coordinating pilot programs between central and territorial governments; and (iv) receiving reports of incidents and overseeing enforcement actions. The draft further envisages cooperation with academia and technical experts (e.g., Universidad Nacional sede Manizales) to define validation methodologies and evaluation frameworks. These governance arrangements are described in legislative ponencias published by the Senate commission process and are intended to avoid fragmented local rules while allowing territorial adaptation. See the Senate commission first- and second-debate reports for procedural details and institutional assignments (Congreso Visible and vLex - informe de ponencia).

Key Focus Areas

The bill’s substantive provisions cluster around several focus areas. First, data governance: standards for lawful collection (including what sensor and mobility data may be gathered), retention limits, pseudonymization/anonymization and permitted sharing with public bodies, researchers and third-party evaluators. Second, risk and safety management: mandatory safety impact assessments (SIA) and risk mitigation plans before deployment, and continuous monitoring obligations with defined trigger thresholds for system downgrades or suspension. Third, transparency and accountability: public registries, model cards or technical summaries describing system purpose, performance metrics, known limitations and the human oversight model. Fourth, conformity, testing and certification: requirements for pre-deployment testing in controlled environments and for periodic third-party audits of high-risk systems. Fifth, cybersecurity and model security: minimum technical controls for sensor integrity, secure telemetry, cryptographic protections and incident response plans. Sixth, privacy and fundamental rights: procedures to prevent discriminatory profiling, safeguards for sensitive personal data (e.g., health status following accidents) and channels for affected persons to request explanations and remedies. Seventh, operational coordination: protocols for multi-agency alerting, interoperability standards for sensor networks and mechanisms for localized pilot projects and scaling after evaluation. These themes are articulated across the project's articles and the accompanying commission reports (vLex - informe de ponencia (first debate)).

Implementation Framework

Practical implementation envisioned by the bill proceeds in stages: (1) Registry and notification — Operators must notify/register AI systems with the lead authority and provide technical documentation, data flow diagrams, and the SIA; (2) Pilot certification — New technologies qualify for time-limited pilots under strict monitoring with predefined evaluation metrics and public disclosure requirements; (3) Validation and conformity — High-risk systems require independent testing laboratories or accredited conformity assessment entities to validate model safety and performance against specified benchmarks; (4) Deployment with human oversight — For systems producing potentially enforceable outcomes or life-safety actions, the bill mandates human-in-the-loop review or human-on-the-loop monitoring and explicit escalation procedures; (5) Operations and monitoring — Continuous logging, anomaly detection, periodic re-evaluation and an incident reporting channel to the lead authority; and (6) Decommissioning and data erasure — Sunset or retirement processes with secure deletion of personal data when no longer needed. The implementation framework assigns responsibilities across national and territorial actors and anticipates technical guidance documents to be issued by the competent agencies after the law’s adoption.

Monitoring and Evaluation

Monitoring mechanisms combine technical, administrative and public-reporting tracks. The lead agency must operate a central dashboard consolidating key performance indicators (KPIs): accident reduction metrics, false-positive/false-negative rates for predictive alerts, mean time to remediate vulnerabilities, and incident frequency. Independent periodic audits and open aggregate reports are required to ensure transparency. The bill proposes a feedback loop enabling adaptation of algorithms, retraining regimes and updates to safety thresholds based on operational evidence. Academic partnerships and data-sharing arrangements for approved research are explicitly encouraged to create an evidence base for policy refinement and to inform national road-safety strategies.

Penalties, Liability, and Appeals

The draft contemplates administrative enforcement measures and penalties for non-compliance. Typical sanctions include graduated administrative fines, orders to suspend or deactivate non-compliant AI systems, mandatory corrective plans, public disclosure of violations, and potential referral to judicial authorities where criminal negligence or willful misconduct is alleged. The bill also outlines civil liability pathways for victims harmed by negligent deployment or insufficient oversight, including obligations for operators to maintain proof of conformity, insurance requirements for certain high-risk systems, and administrative appeal channels to contest sanctions before the designated authority. Remediation, restitution and access to explanations for affected persons are foreseen as remedies.

Relationship to Other Instruments

Proyecto 255 is designed to complement existing Colombian legal frameworks rather than replace them. It intersects with the Personal Data Protection Law (Ley 1581/2012), sectoral transport law and police traffic regulations; it also touches obligations under procurement and public contracting rules when public entities procure AI systems. The bill anticipates harmonization with national cybersecurity law and with any future horizontal AI governance frameworks. Coordination clauses require that AI systems used by the police, health services or emergency response follow applicable confidentiality and evidentiary rules, especially when data may be used in judicial or administrative enforcement actions.

International Alignment

The project references global best practices for safe deployment of AI in safety-critical settings and aligns with emerging international guidance on trustworthy AI: risk-based regulation, impact assessments, human oversight, and third-party conformity assessment. By adopting conformity-assessment and documentation regimes, the bill aims for interoperability with foreign certification practices and for Colombia to comply with cross-border data-sharing agreements for research. The initiative positions Colombia to engage with international road-safety and AI governance fora and to accept technical cooperation with academic partners and international standard-setting organizations.

Implementation Timeline

Sources and References