What is AI regulation in Colombia?

How it works

What is binding now, and what is still policy or proposal

Colombia does not yet have a single comprehensive AI statute in force. What is already binding comes from general regimes and official instruments that apply to AI today. The most important are personal data law, consumer law, public information law and constitutional principles for state use of automated systems.

The data protection side is especially important. The Superintendence of Industry and Commerce, SIC, says Colombia's personal data rules apply to personal data used to develop, test, monitor or deploy AI. Its 2024 circular treats AI as fully inside the existing habeas data regime and pushes accountability, privacy by design and by default, risk management, security controls and privacy impact studies where high-risk processing is likely.

For the state, the Constitutional Court has already made algorithmic transparency a constitutional issue. In Sentencia T-067 de 2025, the Court treated algorithmic transparency as part of the right of access to public information. After that, the Procuraduria and Defensoria issued Directiva Conjunta 007 de 2025, which sets minimum transparency standards for covered algorithmic systems used by the state and requires annual reporting.

Alongside those binding rules, Colombia now has a national AI policy. CONPES 4144, approved in February 2025, is a policy roadmap to 2030 rather than an Act of Congress. It is still important because it organises the public agenda around ethics and governance, data and infrastructure, research and innovation, digital talent, risk mitigation, and AI use and adoption. The later bill is drafted to operate in coherence with that policy.

How broad the proposed bill is

The committee text of Bill 043/2025 Senate and 324/2025 Chamber is deliberately broad. It is not confined to one sector, one model type or one procurement route. It would apply to public and private actors involved in any stage of the AI lifecycle, including design, development, training, testing, validation, deployment, operation, monitoring, maintenance, commercialisation, importation, distribution and use.

Its territorial logic is also wide. The draft reaches systems physically developed, trained, implemented or used in Colombia. It also reaches systems that create legal, economic, social or environmental effects in Colombia, systems that use inputs drawn from Colombian persons, entities, works or protected information, and systems that depend on essential inputs supplied from Colombia or by actors subject to Colombian law.

That matters for foreign suppliers and multinationals. Under the bill's current drafting, Colombian exposure would depend less on where a model provider is headquartered and more on whether the system affects people, data, markets or infrastructure in Colombia.

The risk-based structure

The proposed framework is explicitly risk-based. In broad terms, it creates four bands.

The first band is critical risk. These systems are generally not allowed for ordinary deployment because of their potential to conflict with fundamental rights, human dignity or the superior public interest. The committee text gives examples such as subliminal manipulation that can cause serious and verifiable harm, public authority social scoring, and real-time remote biometric identification in public spaces by authorities, except in narrow, judicially authorised urgent cases.

The second band is high risk. These are systems whose nature, context and intended purpose create a high likelihood of adverse effects on health, safety or fundamental rights. The bill points to safety components in regulated products, critical infrastructure, education access and assessment, employment and worker management, access to essential public benefits, law enforcement uses that interfere with rights, justice, democratic processes and certain biometric uses.

The third band is not fully "low risk", but systems with specific transparency duties. These include AI systems that interact directly with people and systems that generate or manipulate image, audio or video in ways that appear authentic, including deepfake-type content. The draft expects clear disclosure so that users know they are dealing with AI or with synthetically generated material.

The fourth band is minimal or no risk. These systems would mainly sit under voluntary codes of conduct and good practice.

This structure is important, but it is not fully fixed. The draft says the national authority would later establish and update a more detailed list of high-risk uses through administrative action after public consultation. So the bill creates the architecture, while some of the operational detail would come later.

The main duties the bill would create

The centrepiece for high-risk systems is an impact assessment before implementation and after any substantial modification. In practice, this is an AI impact assessment by another name. The draft says it must at least cover the system's purpose, potential risks including algorithmic discrimination, mitigation measures, data quality and representativeness, performance and accuracy, transparency and explainability, and human oversight with continuous monitoring. It must then be reviewed periodically, at least once a year, or sooner if the system changes materially.

The bill also imposes role-based responsibility. It distinguishes among developers, providers, implementers and users, and says obligations should reflect each actor's role and degree of control over risk. That matters because liability and governance would not stop at the model builder. A deployer that configures and uses a system in a sensitive context could carry major responsibilities of its own.

Public administration receives special treatment. The draft says AI-supported decisions used by public bodies should be clear, understandable and open to review. Civil servants and public authorities would remain responsible for their acts. Public entities would also need governance mechanisms that include supervision, auditability and risk mitigation, and systems should undergo impact assessment before use in the public sector.

The bill also reaches workforce change. It requires the government to define "just transition" guidance on AI and work, and it would require employers that introduce AI capable of materially displacing or transforming existing functions to adopt retraining or reallocation plans for affected workers.

Who would be in charge

The bill would make the Ministry of Science, Technology and Innovation, MinCiencias, the national AI authority. MinCiencias would guide implementation of the law, coordinate AI governance, issue technical lineamientos, standards and good practices, and align the framework with CONPES 4144 and later updates.

The proposal also creates institutional layers around MinCiencias. One is an Intersectoral Coordination Committee for AI, bringing together DNP, the ministries of Education, ICT, Commerce, Culture, Foreign Affairs and Labour, plus representatives from academia, the productive sector and civil society. Another is a National Advisory Council of Experts on AI within the national science, technology and innovation system.

For regulatory experimentation, the draft creates a National Technical Committee for AI sandboxes, coordinated by MinCiencias. Sandboxes would be supervised test environments for experimenting with high-impact AI under defined legal and technical conditions. Notably, the committee text says high-risk systems should be tested in sandboxes, under ethical and technical supervision, rather than treated as automatically off limits.

This is a comparatively collaborative governance design. It does not build a single all-purpose super-regulator. Instead, it combines a central technical authority with intersector coordination and leaves room for existing sector bodies to keep acting inside their own legal mandates.

Enforcement, sanctions and near-term uncertainty

The proposal keeps enforcement distributed. The SIC would continue exercising inspection, surveillance and control within its existing powers over personal data, consumer protection and competition. The Ministry of Labour would monitor the labour transition duties attached to workplace automation. If the issue involves a public authority, the committee text routes the matter to the Procuraduria rather than using the bill's private-sector sanction article.

For private actors, the bill proposes a graduated sequence. It starts with improvement requirements and written warnings, then moves to fines of up to 3,000 monthly legal minimum wages, suspension of activities for up to 24 months, and temporary or permanent closure of the AI operation, including blocking access in Colombia when risks are grave, deliberate or irreversible. The procedure is meant to include warning, technical advice and progressive improvement before severe sanctions, unless there is grave risk or damage already done.

There is also real drafting uncertainty. The project is still pending. Important mechanics are left to later regulation within 24 months of enactment. And the committee text is not perfectly clean: the classification chapter speaks mainly of "critical risk", while an enforcement clause still refers to "unacceptable risk". That kind of terminology drift is normal in live legislative drafting, but it is a reminder that the final architecture can still move.