Why it matters

Colombia does not yet have a general artificial intelligence statute: the AI bill filed with Congress is still under debate, and the National Artificial Intelligence Policy (CONPES document 4144 of 2025) guides government action rather than imposing duties on companies. That does not leave AI unregulated. Colombia’s existing rules on personal data, consumer protection, intellectual property, contracts and liability apply to any system, whatever the technology. The SIC, Colombia’s data protection authority, said so expressly in External Circular 002 of 2024: data protection law is technology-neutral and binds anyone who develops, deploys or simply uses AI systems that process personal data.

For a company operating in Colombia, including the local subsidiary of a group with its own global AI policy, the question is therefore not whether AI is regulated, but whether it can show that its use complies with rules already in force. Three questions structure that showing.

First question: which data feeds the system, and on what authority?

Start with a data inventory: what goes into the system, where it comes from and why it was collected. Colombian law is consent-based: processing personal data requires the data subject’s prior, express and informed authorization for purposes disclosed to them, save for statutory exceptions (Law 1581 of 2012, articles 4, 9 and 10). Using data collected for one purpose to train or feed a model for another may require a new authorization.

• Data found online. The SIC has warned that information accessible to the public is not, for that reason alone, public in nature, and that collecting private, semi-private or sensitive data from the internet does not entitle anyone to process it for any purpose.

• Sensitive data. Biometric and health data, and data revealing beliefs or origin, carry reinforced rules: explicit authorization, notice that answering is optional and a prohibition on making any activity conditional on providing it (Law 1581, article 6; Decree 1074 of 2015, article 2.2.2.25.2.3).

• Providers abroad. Sending data to a provider that processes it on the company’s behalf is a “transmission” under Colombian law and requires a contract with the confidentiality and security obligations set out in article 2.2.2.25.5.2 of Decree 1074 of 2015; transfers to another controller outside Colombia must meet article 26 of Law 1581.

Non-personal information matters too: trade secrets, client information and confidential documents. Under the Andean regime, trade secret protection depends on reasonable measures to keep the information secret (Decision 486 of 2000, article 260), and uploading it to a tool whose terms allow reuse can weaken that protection.

Second question: who is accountable for an automated decision?

The company that decides to use a system remains responsible for its effects. The data controller must be able to demonstrate appropriate and effective measures to comply with the law (Decree 1074 of 2015, article 2.2.2.25.6.1), and the SIC expects processing in AI systems to pass a test of suitability, necessity, reasonableness and proportionality, with risks identified and managed and precautionary measures adopted where serious harm is uncertain.

Current law does not yet grant a free-standing right to human review of an automated decision, but the bill amending Law 1581 now before Congress proposes a right not to be subject to automated decisions without human intervention. Building human oversight into significant decisions today, such as those affecting customers, employees or candidates, avoids redesigning processes tomorrow and is consistent with the accountability duty that already applies.

Responsibility is also allocated by contract. In External Circular 002 of 2025 the SIC asked that contracts for acquiring technology define each party’s responsibilities for personal data. Contracts with AI providers should also settle who answers for system errors, what the provider may do with the company’s information, how incidents are notified and what happens to the data when the relationship ends. When the tool interacts with consumers, the information it provides must be clear, truthful and sufficient under the Consumer Protection Statute (Law 1480 of 2011).

Third question: what evidence will exist if an authority asks?

Accountability is proven with documents. The SIC indicated that before designing and developing a system whose outputs are likely to pose a high risk to data subjects, a privacy impact assessment must be carried out and documented, covering at least the processing operations, the risks and the mitigation measures. It also recalled that data subjects may obtain information about how their data is processed in these systems at any time.

In practice, keep a record for each relevant use: the system and its purpose, the data it receives, who approved the use, what testing was done, who reviews the outputs and how data subject requests are handled. If an incident puts information at risk, the controller must report it to the SIC (Law 1581, article 17, literal n), and that report is stronger when the record already exists.

Intellectual property

The Andean regime defines the author as the natural person who carries out the intellectual creation (Decision 351 of 1993, article 3). Copyright protection for AI-generated text, images or code therefore depends on human creative contribution, and what the company can do with the outputs also depends on the provider’s terms. Before using generated material in products, campaigns or client deliverables, check ownership, the licenses granted by the provider and the risk of reproducing third-party works.

What to review before automating

• An inventory of current and planned AI uses, classified by risk.

• The purposes and authorizations of the data behind each use, including any sensitive data.

• Provider contracts: confidentiality, use of company information, security, incidents, data location and exit.

• An internal use policy approved by management, with clear rules on confidential information, aligned with any group-wide policy.

• A privacy impact assessment for high-risk uses and a human-oversight rule for significant decisions.

Conclusion

AI governance in Colombia does not require waiting for a new statute. It requires answering in writing, before automating, which data the system uses, who is accountable for what it decides and what evidence will remain. For decisions that reach the board, see also preparing a board of directors for high-impact decisions.

Sources and legal references

• Statutory Law 1581 of 2012, articles 4, 6, 9, 10, 17 and 26.

• Decree 1074 of 2015, articles 2.2.2.25.2.3, 2.2.2.25.5.2 and 2.2.2.25.6.1.

• Superintendencia de Industria y Comercio, External Circular 002 of 2024 (personal data in AI systems) and External Circular 002 of 2025 (technology transfer).

• CONPES document 4144 of 2025, National Artificial Intelligence Policy.

• Law 1480 of 2011 (Consumer Protection Statute).

• Andean Community Decision 351 of 1993, article 3, and Decision 486 of 2000, article 260.

This content is for general information and is not legal advice on any specific matter. Rules verified as of 25 September 2026.