Skip to main content

    AI by country · South America

    AI in Colombia: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Colombia know before starting with AI?

    Colombia has no AI law as of 29 October 2026. Law 1581 of 2012 on personal data applies to AI today, and the regulator, the Superintendence of Industry and Commerce (SIC), issued guidelines on AI and personal data in August 2024. Several AI bills are in Congress, including one for health care, but none has passed.

    At a glance

    Colombia at a glance

    Key facts about Colombia
    Data protection lawStatutory Law 1581 of 2012, in force since 18 October 2012
    RegulatorSuperintendencia de Industria y Comercio (SIC)
    AI policyNational AI Policy, CONPES 4144 (February 2025). No AI law as of 29 October 2026
    Time zoneUTC-5, no daylight saving (India is 10.5 hours ahead)
    CurrencyCOP (Colombian peso)
    Business languageSpanish

    Why now

    Why Colombia is worth watching

    Each point links to the document it comes from.

    • The SIC issued External Circular 002 on 21 August 2024 with guidelines for processing personal data in AI systems, including a privacy impact study and demonstrable compliance.[2]

    • The National AI Policy, CONPES 4144, was published in February 2025 with 106 actions, a budget of COP 479,273 million and a horizon to 2030.[5]

    • A government AI bill, 043 of 2025 Senate and 324 of 2025 House, received a positive first-debate report in December 2025 with a four-level risk approach.[3]

    • An earlier government AI bill was archived in June 2025 after it missed its first debate in the Senate's Sixth Committee.[4]

    • On 19 October 2026 the Senate's Seventh Committee held a public hearing on bill 216 of 2026, which would govern AI in health care.[6]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Statutory Law 1581 of 2012 on personal data

    In force2012Processing needs the person's prior, informed authorisation, obtained in a way you can prove later (article 9). Health and biometric data are sensitive (article 5). Controllers must tell the SIC about security breaches that put people's data at risk (article 17).[1]

    Law 1581 of 2012: transfers, registration and fines

    In force2012Sending data to countries without adequate protection is prohibited, unless an exception applies, such as express consent or a contract with the person; other cases need an SIC declaration of conformity (article 26). Databases go into the National Register of Databases (article 25). Fines reach 2,000 monthly minimum wages (article 23).[1]

    SIC External Circular 002 of 2024 on AI and personal data

    In force2024It tells controllers using AI to run a privacy impact study, show that processing is suitable, necessary and proportionate, protect systems against unauthorised access, and be able to prove compliance. A law firm summary also notes it suggests techniques such as differential privacy.[2]

    AI bill 043 of 2025 Senate, 324 of 2025 House

    Draft2025It would sort AI into four levels: critical (not allowed), high risk with impact assessments and audits, systems with transparency duties, and minimal risk. MinCiencias would be the national AI authority. A first-debate report was filed on 3 December 2025; its status is unclear as of 29 October 2026.[3]

    Where AI fits first

    Where AI fits first

    Health care

    Summarising clinical notes and appointment handling, with clinicians making decisions.

    Health data is sensitive under Law 1581. Bill 216 of 2026 on AI in health is at the hearing stage before its first debate.[6]

    Banking and credit

    Fraud detection and Spanish-language customer service, with staff reviewing credit decisions.

    The SIC circular rests on Law 1581 and Law 1266 of 2008, which covers financial and credit data.[2]

    Contact centres and outsourcing

    Call summaries, quality review and agent support in Spanish and English.

    Sending recordings or transcripts to an AI service abroad is a transfer under article 26 of Law 1581.[1]

    Public sector

    Handling citizen requests and searching case files.

    CONPES 4144 sets public actions on ethics, data, skills and AI adoption to 2030.[5]

    Your first steps

    Your first steps

    1. Register your databases in the National Register of Databases if you are required to, and update them when AI adds new processing.
    2. Check that your authorisations cover the AI use, and keep proof of each one.
    3. Run a privacy impact study before launching AI on personal data, as SIC Circular 002 of 2024 asks.
    4. Map transfers to AI and cloud providers abroad, and use an article 26 exception or seek an SIC declaration of conformity.
    5. Prepare a breach process to inform the SIC when security is compromised.
    6. Keep a record of the measures you take, because the SIC expects compliance you can show.
    7. If you work in health, follow bill 216 of 2026 as it moves to its first debate.

    AI services for Colombia

    AI consulting and development for teams in Colombia

    We work remotely with companies in Colombia, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Colombia is on UTC-5 and India on UTC+5:30, so India is 10.5 hours ahead. A 9:00 to 18:00 day in Colombia and 9:30 to 18:30 in India do not overlap at all: 18:30 in India is 08:00 in Bogotá. So we agree a short early-morning (Colombia) and evening (India) call window, for example 07:30 to 08:30 in Bogotá, and send written updates at the end of each Indian day so work is ready when your morning starts.

    Questions

    Common questions about AI in Colombia

    Does Colombia have an AI law?

    Not as of 29 October 2026. Several bills are in Congress, including the government bill 043 of 2025 and bill 216 of 2026 on health care. Law 1581 of 2012 and the SIC's AI guidelines apply now.

    Can we train AI on data found on the internet?

    Be careful. Law 1581 requires prior, informed authorisation for processing personal data, with limited exceptions, and the SIC expects AI processing to be necessary and proportionate. Get legal advice for your case before collecting such data.

    What are the fines?

    The SIC can fine up to the equivalent of 2,000 monthly minimum wages, repeated while a breach continues. It can also suspend activities for up to six months or order closure.

    Can we use an AI service hosted outside Colombia?

    Yes, if the destination offers adequate protection or an exception in article 26 applies, such as express authorisation. Otherwise the SIC must issue a declaration of conformity.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] DIAN normograma (official compilation), 2012-10-18. Ley Estatutaria 1581 de 2012(normograma.dian.gov.co)
      Full title and what we used it for

      Ley Estatutaria 1581 de 2012. Primary law text, published in Diario Oficial 48.587. Used for articles 5, 9, 17, 23, 25 and 26. The Función Pública and Senate copies did not load for us.

    2. [2] Garrigues, 2024-08-23. Colombia: la Superintendencia de Industria y Comercio fija lineamientos…(garrigues.com)
      Full title and what we used it for

      Colombia: la Superintendencia de Industria y Comercio fija lineamientos para sistemas de inteligencia artificial. Law firm summary, used for interpretation of SIC External Circular 002 of 21 August 2024. The SIC's own PDF (sedeelectronica.sic.gov.co) refused our connection, so we did not read the circular directly.

    3. [3] Cámara de Representantes de Colombia, 2025-12-03. Informe de ponencia para primer debate, Proyecto de Ley 043 de 2025 Sen…(camara.gov.co)
      Full title and what we used it for

      Informe de ponencia para primer debate, Proyecto de Ley 043 de 2025 Senado, 324 de 2025 Cámara. Primary. Used for filing on 28 July 2025 by three ministers, the urgency request, the four risk levels and MinCiencias as AI authority. We found no record of a first-debate vote.

    4. [4] El Espectador, 2025-06-20. Se hundió el proyecto de ley con el que el Gobierno buscaba regular la…(elespectador.com)
      Full title and what we used it for

      Se hundió el proyecto de ley con el que el Gobierno buscaba regular la IA en Colombia. Press report. Used for the earlier government AI bill failing to get its first debate before the end of sessions on 20 June 2025.

    5. [5] Impacto TIC, 2025-02-17. Colombia aprobó su Conpes de Inteligencia Artificial(impactotic.co)
      Full title and what we used it for

      Colombia aprobó su Conpes de Inteligencia Artificial. Trade press. Used for the 106 actions, COP 479,273 million budget, 2030 horizon and six axes. The DNP site and the CONPES PDF did not load for us; the bill report in s3 confirms CONPES 4144 of 2025 is the national AI policy.

    6. [6] Senado de la República de Colombia, 2026-10-19. Comisión Séptima del Senado avanza en la regulación de la inteligencia…(senado.gov.co)
      Full title and what we used it for

      Comisión Séptima del Senado avanza en la regulación de la inteligencia artificial en salud. Primary. Used for bill 216 of 2026 Senate on AI in health and its public hearing before first debate.

    This is general information, not legal advice. Several items here come from law firm or press summaries because official sites did not load, and AI bills in Congress may change or lapse. Check with a qualified Colombian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Colombia?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score