Colombia - AI Regulation Framework (Senate 442/25)

Overview

The bill "Por medio de la cual se regula la inteligencia artificial en Colombia para garantizar su desarrollo ético y responsable" (Senate 442/25), radicated on 7 May 2025, sought to create a unified, risk‑based legal framework for AI in Colombia. The proposal assigned a national coordinating role to the Ministry of Science, Technology and Innovation and proposed coordinated oversight with the Ministry of Information and Communications Technologies and relevant sectoral regulators. Drawing on international best practice (including the OECD and the EU approach) and Colombia’s national AI policy (CONPES 4144), the draft established risk tiers (unacceptable, high, limited, low), mandatory impact assessments and registries for high‑risk systems, transparency duties, and alignment obligations with data protection law. Although widely covered by national media and legal commentary, the bill was archived in the Senate and did not become law; nevertheless, it shaped regulatory dialogue and downstream sectoral guidance.

Definitions

The bill defined core concepts to provide legal precision: "artificial intelligence" as software and computational systems able to perform tasks that ordinarily require human cognition; "AI system" as any algorithmic system generating outputs that inform, recommend or make decisions; "operator" and "provider" as entities that deploy or commercially make available AI systems; "high risk" as systems whose output can significantly affect rights, safety or fundamental freedoms; and terms such as "meaningful human oversight", "bias", "explainability" and "AI impact assessment". These definitions anchored obligations for documentation, testing and risk mitigation across the lifecycle of AI systems and aligned with language used in CONPES 4144 and comparable international texts.

Governance and Institutional Framework

The draft designated the Ministry of Science, Technology and Innovation (MinCiencias) as the national coordinating authority for AI governance, with responsibilities to issue technical guidelines, maintain the national registry for high‑risk systems, and coordinate interinstitutional oversight. The Ministry of Information and Communications Technologies (MinTIC) was tasked with supporting digital infrastructure and standards. Sectoral regulators (for example health, financial and labor regulators) would exercise delegated powers for sector‑specific enforcement and supervision. The bill also proposed an inter‑agency council to include the Superintendence of Industry and Commerce (data protection oversight), competition authorities, and representatives from academia, industry and civil society to advise on standards, conformity assessment schemes and sandboxes. The governance model emphasized public‑private coordination while reserving enforcement and sanctioning powers to public bodies. See the Senate project listing for the official registry entry: Senate project catalogue.

Key Focus Areas

Major substantive elements included: (1) a risk classification framework distinguishing unacceptable, high, limited and low risk applications; (2) prohibition of certain uses deemed unacceptable — for example, indiscriminate biometric mass surveillance and social‑scoring systems — which would be banned; (3) stringent requirements for high‑risk AI: mandatory AI impact assessments (AIAs), third‑party conformity assessments where applicable, registration in a national registry, robust data governance and documentation (model cards, dataset documentation), explainability and meaningful human oversight; (4) transparency obligations for limited‑risk systems (user notices and disclosure when content is generated or when decisions are automated); (5) data protection alignment and mandatory DPIAs where personal data are processed; (6) cybersecurity and robustness standards (secure development lifecycle, vulnerability management, resilience testing); and (7) special measures for public sector procurement, experimental sandboxes and capacity‑building incentives. The proposal emphasized protection of fundamental rights — due process, non‑discrimination, privacy, and freedom of expression — and included provisions for worker transition and re‑skilling where automation could affect employment.

Implementation Framework

Implementation relied on a combination of rulemaking, technical guidance and phased obligations. MinCiencias would publish implementing technical standards and registries; sectoral authorities would issue specific rules for regulated sectors (health, finance, justice, social services). The bill proposed regulatory sandboxes and certification pathways to support innovation while ensuring safety. Compliance instruments included self‑certification for low‑risk systems, mandatory internal governance and risk management systems for operators of high‑risk AI, and third‑party conformity assessment for certain high‑risk categories. The draft required documentation (technical files, training data inventories, performance metrics) to be maintained for supervisory audits. Transitional provisions sought to protect research and academic work through narrower exemptions while ensuring that commercial deployments meet compliance thresholds.

Monitoring and Evaluation

Monitoring combined ex‑ante and ex‑post mechanisms: pre‑deployment AI impact assessments, ongoing post‑market monitoring and periodic audits by competent authorities. The bill envisaged a public registry of high‑risk systems to enable market surveillance and encourage transparency. Authorities would collect incident reports and establish reporting obligations for serious harms. MinCiencias, working with sectoral supervisors and the Superintendence of Industry and Commerce (SIC), would publish periodic evaluations of the law's effectiveness and recommend updates. The bill also contemplated indicators and reporting templates for measuring compliance, bias incidents, cybersecurity events and user complaints.

Penalties, Liability, and Appeals

The draft established an administrative enforcement regime with graduated remedies: corrective orders (remediation plans), temporary suspension of deployment, withdrawal of systems from the market, and monetary fines proportionate to the severity of the breach. It included provisions for private liability and redress mechanisms for individuals harmed by AI decisions, aligning civil liability with existing tort law and data protection remedies. The bill created procedural rules for administrative appeals and judicial review, and required authorities to publish enforcement actions to increase deterrence and transparency.

Relationship to Other Instruments

The bill explicitly referenced Colombia’s existing legal framework, including the data protection statutory regime (Law 1581 of 2012), administrative procedure rules, consumer protection statutes and sectoral regulation (health, financial supervision). It was drafted to complement — not duplicate — CONPES 4144 (the National AI Policy) and to enable the adoption of technical standards by MinTIC and sectoral regulators. The bill anticipated coordination with the Superintendence of Industry and Commerce on data protection and with competition authorities on market concentration and dominant platform practices related to AI market power.

International Alignment

The draft aligned with international standards and instruments (OECD, UNESCO, EU AI legislative approach) to facilitate interoperability and trade. It proposed to adopt recognized technical standards for testing, conformity assessment and model documentation and to promote international cooperation on enforcement and research. The bill intended to position Colombia as a regional hub for trustworthy AI by integrating international guidance while adapting rules to national priorities and territorial equity (explicit in CONPES 4144).

Implementation Timeline

Sources and References