Colombia - AI Regulation Bill (C200/2023)

Overview

The Proyecto de Ley Estatutaria C200 de 2023 (commonly referenced as Proyecto 200/23) was lodged in the Cámara de Representantes on 6 September 2023 with the stated objective of defining and regulating artificial intelligence to ensure compliance with human-rights standards and to establish limits on its development, use and implementation. The project is recorded on the Chamber's legislative page and in public legislative observatories; see the Chamber project record at Cámara de Representantes – Inteligencia Artificial and the replicated dossier on Congreso Visible at Congreso Visible – Proyecto 200/23. The project combined human-rights protections with operational rules for developers, deployers and public-sector users and proposed institutional oversight mechanisms. The legislative record shows a first-debate ponencia in November 2023 and an archival entry for expiration of terms in June 2024, after which the bill's formal status is 'archived' (ended).

Definitions

The draft provided operational definitions intended to cover the lifecycle of AI systems: (i) "artificial intelligence" as systems performing tasks that would require intelligence if executed by humans, including algorithmic models, machine learning, expert systems, and generative models; (ii) "provider/developer" and "operator/deployer" distinguished by roles in design vs. deployment; (iii) "automated decision-making" and "high-risk system" defined by potential impact on fundamental rights; (iv) ancillary terms such as "training data", "model update", "explainability" and "human oversight". The aim of these definitions was to ensure legal clarity across data protection, administrative law and sectoral oversight, and to align with comparable definitions used in international guidance while reflecting Colombia's constitutional framework.

Governance and Institutional Framework

The bill proposed a multi-institutional governance architecture that would coordinate across the Ministry of Information Technologies and Communications (MinTIC), the national data protection authority (Superintendencia de Industria y Comercio — SIC), sectoral ministries and the judiciary. It envisaged the creation or designation of a national AI oversight body to maintain registries, supervise compliance for high-risk systems, coordinate conformity assessment and market surveillance activities, and convene technical advisory committees drawn from academia, civil society and industry. The bill contemplated memoranda of understanding among agencies to allocate investigative, sanctioning and technical functions; it also contemplated ex ante review for specified high-risk applications used by the public sector. The governance approach emphasized transparency, multi-stakeholder advisory inputs, and mechanisms to protect fundamental rights in public-sector AI deployments.

Key Focus Areas

The draft centered on several interlocking policy areas: (1) rights and prohibitions — establishing uses of AI incompatible with constitutional protections and human dignity (e.g., mass biometric surveillance without safeguards); (2) risk classification — a tiered framework that subjects higher-risk systems to stronger obligations (impact assessments, registration, audit); (3) transparency and accountability — mandatory documentation, model cards, human-readable explanations, user notice and logging; (4) data protection and privacy — alignment with Law 1581/2012 and strengthened safeguards for training data, consent/legitimate basis and data minimization; (5) safety, testing and conformity — procedures for testing, validation, and third-party conformity assessment for specific categories; (6) cybersecurity and model security — baseline requirements for integrity, vulnerability management, patching and supply-chain risk management; (7) redress and liability — clear pathways for affected persons to seek remedies and shifting burdens for demonstrable harms; (8) enforcement and penalties — administrative sanctions, corrective measures and market surveillance to detect unsafe or noncompliant systems. Across these foci, the bill sought to balance innovation promotion with protective duties to prevent discriminatory, opaque or otherwise harmful deployments.

Implementation Framework

Implementation measures in the draft included mandatory impact assessments (privacy, fundamental rights, non-discrimination), registration of certain high-risk systems on a public registry, periodic audits, incident and breach reporting, and technical documentation requirements (including model descriptions, datasets, training procedures and performance metrics). The bill proposed regulatory powers for the oversight authority to issue technical standards, require corrective measures, order suspensions and impose fines. For the public sector, prior evaluation and human oversight mandates would be required before adoption of automated decision-making that affects citizens' rights. The draft left room for secondary regulation and delegated technical standards to be issued by competent agencies to operationalize risk thresholds and conformity procedures.

Monitoring and Evaluation

Monitoring mechanisms included mandated reporting to the oversight body, indicators to measure compliance and impact, periodic public transparency reports, and joint inspections by regulatory authorities. The bill suggested a periodic review cycle to evaluate regulatory effectiveness, adapt risk categories, and revise obligations as technology and socio-technical contexts evolve. It also encouraged publication of anonymized enforcement data and impact metrics to promote accountability and evidence-based policy making. The bill proposed including civil-society participation in evaluation processes to strengthen legitimacy and rights-protective outcomes.

Penalties, Liability, and Appeals

The draft set out administrative remedies and sanctions for noncompliance, including fines, orders to suspend processing or decommission models, corrective action plans and public corrective notices. It anticipated contested-administration routes and judicial review for sanctioned entities and provided for compensation and redress channels for persons harmed by AI decisions. The bill contemplated escalation pathways between supervisory authorities and the judiciary for complex liability claims arising from algorithmic harms, and it emphasized obligations to preserve evidence and logs to facilitate investigations and remedies.

Relationship to Other Instruments

The bill explicitly referenced alignment with Law 1581 of 2012 (data protection) and proposed targeted modifications to ensure consistent treatment of training datasets and AI-specific processing. It positioned itself within Colombia's constitutional framework on fundamental rights and administrative law and envisaged coordination with sectoral regulation (health, finance, electoral law) to avoid fragmentation. The draft drew on international standards and regional guidance while respecting national competences and constitutional safeguards.

International Alignment

The proposal sought international alignment with key emerging frameworks and soft law — including the EU risk-based approach and principles-oriented guidance from multilateral organizations — while tailoring obligations to Colombia's legal and institutional context. It encouraged interoperability with international conformity-assessment mechanisms and recognized the value of cross-border cooperation on research, standards, and enforcement for models and datasets that operate transnationally.

Implementation Timeline

Sources and References