Colombia AI Regulation Overview

Overview

Colombia's approach to artificial intelligence regulation is characterized by a reliance on non-binding national policy strategies and institutional roadmaps, complemented by strict binding oversight under existing personal data protection legislation. The nation's primary governance framework is established through high-level policy documents, notably the National Policy for Artificial Intelligence (CONPES 4144, approved in February 2025), the Estrategia Nacional Digital 2023–2026 (END), and the Ministry of Science, Technology and Innovation's (MinCiencias) Roadmap for Ethical and Sustainable AI Adoption (2024). CONPES 4144 superseded the foundational CONPES 3975 of 2019, providing an action plan and funding roadmap through 2030 across government, scientific research, and commercial sectors.

While comprehensive statutory legislation has been repeatedly introduced in the Congress of Colombia, the country has not enacted a single binding, horizontal AI act. Multiple legislative initiatives—including government-backed Senate Bill 442/25, general statutory drafts such as Proyecto 05/24 and Proyecto 200/23, and sector-specific proposals regarding labor rights (Proyecto 130/23) or public administration petitions (Proyecto 417/2025)—have been archived, withdrawn, or stalled. Consequently, enforceable compliance and risk mitigation currently operate through existing administrative law, statutory data protection under Law 1581 of 2012, binding guidelines from the Superintendence of Industry and Commerce (SIC), and municipal security deployments.

Regulatory Approach

Colombia employs a hybrid regulatory model combining non-binding soft law at the strategic national level with binding application of statutory data protection rules for personal data processing. The executive branch's policy architecture, articulated in CONPES 4144 and MinCiencias' Hoja de Ruta, advocates for a risk-based governance philosophy. This framework prioritizes high-impact applications that touch upon fundamental rights—such as biometric identification, healthcare, automated social protection decisions, and public safety—mandating safeguards such as human oversight, continuous safety evaluation, and algorithmic transparency.

Legislative efforts in the Colombian Congress have consistently attempted to formalize risk-tiered classification schemes modeled after international standards. Draft bills typically feature a four-tier risk classification (unacceptable, high, limited, and low risk), mandatory pre-deployment Artificial Intelligence Impact Assessments (AIAs), technical documentation duties (such as model cards), and national high-risk registries. In the absence of an enacted statutory framework, public authorities rely on administrative co-regulation, institutional readiness tools like the Artificial Intelligence Readiness Assessment (AIRA), and supervisory guidance such as SIC Circular Externa 002 of 2024 to guide developers and deployers.

Key AI Legislation

• CONPES 4144 - Política Nacional de Inteligencia Artificial (2025): Colombia's national policy approved on February 14, 2025, setting a strategic roadmap through 2030 with over 100 concrete actions covering governance, risk mitigation, data infrastructure, public sector adoption, and rights protection.
• Estrategia Nacional Digital 2023–2026 (END): Public policy strategy launched in February 2024 detailing 95 policy actions and 13 key indicators across eight strategic axes, including AI, cybersecurity, connectivity, and public digital transformation.
• Hoja de Ruta para la adopción ética y sostenible de la IA (2024): Strategic framework published by MinCiencias outlining five strategic action environments, readiness tools (AIRA), and cross-cutting priorities for responsible AI deployment.
• Statutory Law 1581 of 2012 & SIC Circular Externa 002 of 2024: The primary binding legal framework governing personal and sensitive biometric data processing in AI systems, enforced by the Superintendence of Industry and Commerce.
• Proyecto de Ley Estatutaria No. 154 de 2024: Active statutory legislative proposal (under review) seeking to regulate AI lifecycle activities, establish a high-risk system registry, require mandatory impact assessments, and amend Law 1581 of 2012.
• Documento CONPES 3975 (2019): Historical foundational policy for digital transformation and AI whose Plan de Acción y Seguimiento concluded in 2022 and was superseded in practice by CONPES 4144.

Governance & Enforcement Bodies

Institutional oversight for AI in Colombia is divided among policy formulation bodies, technical execution entities, and supervisory authorities. Policy leadership is anchored in the Departamento Nacional de Planeación (DNP), which acts as the national policy steward managing the annual follow-up plan (Plan Anual de Seguimiento - PAS) for CONPES policies. Operational technical standards and digital public infrastructure are managed by the Ministry of Information and Communications Technologies (MinTIC), while scientific research, ethics roadmaps, and expert advisory coordination fall under the Ministry of Science, Technology and Innovation (MinCiencias).

Enforcement powers rest with established administrative regulators. The Superintendencia de Industria y Comercio (SIC) serves as the national data protection authority, empowered to audit AI deployments processing personal data, issue binding directives, and sanction non-compliant actors. Additional operational entities—including the Registraduría Nacional del Estado Civil, municipal administrations, and the Colombian National Police—exercise specific administrative oversight over biometric databases and operational surveillance tools under their statutory mandates.

Penalties & Enforcement

Binding penalties and enforcement mechanisms in Colombia are currently derived from the personal data protection regime established under Statutory Law 1581 of 2012 and administrative law. The Superintendencia de Industria y Comercio (SIC) holds statutory powers to investigate non-compliant processing of personal and biometric data within AI tools. The SIC is authorized to issue mandatory compliance orders, order the temporary or definitive suspension of non-compliant data processing operations, and impose administrative fines of up to 2,000 minimum monthly legal salaries.

In contrast, proposed statutory legislative frameworks (such as Proyecto de Ley Estatutaria 154/24, Senate Bill 442/25, and Proyecto 05/24) envision specialized administrative enforcement schemes. These pending proposals contemplate administrative fines, corrective operational orders, mandatory system suspension, public disclosure of sanctions, and civil liability pathways. For public sector entities, oversight bodies including the Procuraduría General de la Nación maintain disciplinary powers to investigate public officials and apply administrative sanctions for failure to maintain mandatory human oversight or algorithmic traceability in automated public systems.

Data Protection Framework

The core legal foundation regulating AI applications handling personal information in Colombia is Statutory Law 1581 of 2012. Under this legal framework, biometric traits—such as facial features used in automated identification systems—are classified as sensitive personal data. Processing sensitive biometric data requires heightened security standards, strict necessity, and explicit consent from data subjects, unless specific statutory exceptions apply.

To adapt data protection enforcement to AI environments, the Superintendencia de Industria y Comercio (SIC) issued Circular Externa 002 of 2024. This circular establishes binding instructions requiring data controllers and processors to ensure that personal data processing through AI systems complies with principles of suitability, necessity, reasonableness, and proportionality. It explicitly mandates that organizations conducting personal data processing in AI systems perform pre-deployment Data Protection Impact Assessments (DPIAs) to proactively identify and mitigate risks to fundamental privacy rights.

Sector-Specific Rules

The public safety and law enforcement sector represents the most prominent operational application of AI in Colombia. In Medellín, the Police Facial Recognition System operates 80 intelligent cameras cross-referencing live video against a database of approximately 19,000 active arrest warrants, alongside the "René" mobile application deployed in coordination with the Registraduría Nacional del Estado Civil (under Resolution 27145 of 2023) for real-time biometric verification. In Bogotá, a time-bound security pilot across 20 TransMilenio mass transit stations deployed 786 biometric cameras cross-referencing live feeds against over 5,000 active judicial warrants before concluding its scheduled testing period in December 2023.

Other sector-specific rules have been detailed in legislative proposals, though none have achieved final legislative enactment. In public administration, Proyecto de Ley 417 de 2025 proposed human-in-the-loop controls and algorithmic traceability for citizen Petitions, Complaints, Claims, Suggestions, and Reports (PQRSD) while maintaining deadlines under Law 1755 of 2015. In transportation, Proyecto 255/24 proposed guidelines for safety-critical AI and sensor networks to reduce road traffic accidents under the Agencia Nacional de Seguridad Vial. In labor, Proyecto 130/23 sought to regulate AI in recruitment, performance evaluation, and workplace management under Ministry of Labour oversight; however, all these sectoral initiatives were withdrawn or archived.

International Alignment

Colombia's policy architecture demonstrates strong structural alignment with international ethical standards and AI governance benchmarks. High-level policy instruments, including CONPES 4144, MinCiencias' Hoja de Ruta, and the Estrategia Nacional Digital 2023–2026, explicitly incorporate recommendations from multilateral organizations, notably the UNESCO Recommendation on the Ethics of Artificial Intelligence and OECD AI Principles.

Furthermore, major statutory bills introduced in the Congress of Colombia—such as Senate Bill 442/25, Proyecto 05/24, and Proyecto de Ley Estatutaria 154/24—draw directly from the European Union's risk-based approach. These proposed legislative frameworks mirror international models by incorporating four-tier risk classification systems, mandatory pre-deployment impact assessments, high-risk system registration, and international technical standards for model cards, explainability, and cybersecurity robustness testing.

Future Developments

Future regulatory developments in Colombia center on executing the multi-year action plan established under CONPES 4144 through 2030. Key executive actions led by DNP, MinTIC, and MinCiencias include issuing secondary regulatory guidance, establishing technical standards for public sector AI procurement, developing sector-specific codes of conduct, and implementing institutional capacity tools such as MinCiencias' Artificial Intelligence Readiness Assessment (AIRA) and the Committee of Experts in AI.

On the legislative side, although numerous general and sector-specific bills were archived during recent legislative sessions, congressional debate continues around active proposals like Proyecto de Ley Estatutaria No. 154 de 2024. Future legislative discussions are expected to refine statutory limits, formalize high-risk system registries, adjust Law 1581 of 2012 to address machine learning training datasets, and establish legal mechanisms to contest automated individual decisions.

Enforcement Bodies