A Comprehensive Overview of the Legal Framework for Artificial Intelligence in Colombia

The massification of artificial intelligence (AI) tools into the global economy, now making AI available to everyone, has sparked a global revolution, with expectation of its ability to transform and improve various industries and to change the way in which people work and develop their day-to-day activities. For some years, Colombia has tried implementing different strategies to prepare itself for harnessing AI as a potential driver to boost its national economy and vibrant culture. This article aims to explore relevant aspects of AI in Colombia, including regulatory issues, ethical topics and practical aspects, and to give the reader an overview of the latest developments in the local environment. 

The Dawn of the Colombian Regulatory Framework

Colombia’s approach to AI regulation has been characterised by an open yet cautious attitude. Despite the current absence of a specific law or regulation on AI, the country has – for some time now – adopted a strategic direction through various policy documents and bills of law. In various ways, these have helped to bridge the digital gap and to prepare different stakeholders for the adoption of AI as a tool for the local economy’s development.

CONPES Policies and Documents

The National Council for Economic and Social Policy (Consejo Nacional de Política Económica y Social, or CONPES), established in 1958, serves as one of the main planning authorities in Colombia. CONPES provides long-term guidance to the government on issues related to the country’s economic and social development. Its influence extends to legislation and governmental policies, and it plays a crucial role in numerous ways, including CONPES documents outlining strategic policies aimed at economic growth, and the balancing of other governmental priorities such as environmental, social and governance (ESG) aspects.

CONPES documents thus play a critical role in shaping the country’s approach to different topics, including AI and related digital technologies. These have been influential in shaping Colombia’s digital economic strategy by prioritising digitalisation at the highest levels of government, recognising the need for a robust digital strategy for the country’s future success.

CONPES 3975 on National Policy for Digital Transformation and Artificial Intelligence is one of the most important pieces of policy concerning this topic. The policy was approved on 8 November 2019, and outlined Colombia’s strategic view towards leveraging AI to drive social and economic development. The document made special reference to the strategic importance of AI when enhancing public services, fostering innovation in different industries, and improving the well-being of Colombian citizens. The main strategic actions included in the document were the following, and all aimed for the promotion and generation of social and economic value through the adoption of AI and digital technologies:

• reducing barriers to the incorporation of digital technologies, both in the private sector and in the state sector;
• creating conditions for digital innovation in the public sector and the private sector;
• strengthening the digital competences of Colombian human capital; and
• developing conditions to prepare the country for the economic and social changes that the implementation of AI will bring.

Other CONPES documents, such as CONPES 3701 and CONPES 3995, cover essential guidelines for digital security and cybersecurity.

The legislative developments and guidelines are part of Colombia’s broader strategy of ensuring that AI is developed and implemented in a responsible manner, with a focus on:

• data protection;
• addressing issues such as fairness, transparency, accountability, bias and security; and
• the protection of all individual rights.

These reflect the country’s values and legal framework, and its commitment to being technologically advanced.

Based on CONPES fundamentals, the following guidance, regulations and bills of law are currently in the Colombian legal landscape.

Ministry of Science, Technology and Innovation (MinCiencias): Roadmap for Ethical and Sustainable Adoption of AI in Colombia

The roadmap does not provide concrete criteria and/or responsibilities for the ethical use of AI, but instead concentrates on the present state of technology and the fundamental principles that should guide its development.

The roadmap is split into the following five areas, to guarantee the ethical and sustainable use of AI in Colombia.

Ethics and governance

MinCiencias understands that the adoption of AI in Latin America has been a key issue on the agenda of many countries in the region. However, despite progress, significant challenges prevent the effective governance of AI.

Therefore, the roadmap emphasises the need to ensure sustainable, ethical development and implementation of AI systems in Colombia, while always respecting citizens’ rights. For this, the roadmap:

• reiterates the importance of privacy, transparency, responsibility, accessibility and justice for users; and
• suggests establishing and strengthening the legal and regulatory framework for AI in Colombia.

This involves making laws and regulations addressing ethical issues, responsibilities and rights related to the implementation and use of AI.

Education, research and innovation

According to MinCiencias, AI’s impact on minorities and vulnerable groups is an important matter. According to the roadmap and based on a study carried out by the World Economic Forum, the Ministry understands that AI-driven automation has been found to affect these groups, pushing them out of their current jobs; as such, it is expected that 44% of workers’ core skills will change in the next five years because of the increase in tasks performed by machines.

The roadmap recommends combining inclusive education with ethical support measures to ensure that AI helps foster equality instead of accentuates disparities. The goal is to promote an education model focused on competencies to take advantage of opportunities, and to address challenges in this new labour and education paradigm. The roadmap also suggests the creation of specialised research and development in AI, in collaboration with educational institutions and companies.

Data and organisations

The roadmap highlights that the sharing and handling of information and data is a key challenge in the ethical development and use of AI. Moreover, the ethical issues concerning processing of personal data in the field of AI are of crucial importance, due to potentially inappropriate management of the information, which could lead to the segmentation and discrimination of certain sectors of the population.

Therefore, the roadmap suggests cross-sector collaboration to develop ethical and regulatory frameworks for data-processing and governance. Involvement of society will increase the benefits and reduce the risks associated with access to and exchange of data, and will help pave the way for digital transformation. 

Innovative and emerging industries

MinCiencias states that these technologies are seen as a strategic opportunity for countries. For Colombia, in particular, this change may mean an opportunity to transform into a developed country.

Therefore, new progress offers a unique possibility for Colombia to enhance its economic development and improve the well-being of its citizens. However, addressing the identified challenges will require a joint effort and long-term vision. The implementation of Industry 4.0 is not just a technological matter but is also a cultural and educational change, which will determine the future of the country in this new industrial era.

Privacy, cybersecurity and defence

MinCiencias states that AI has changed how governments and armed forces face current challenges in security and defence. AI has shown its value in different areas that are vital for national security, such as intelligence-gathering and strategic decision-making. However, these advances also come with ethical, legal and strategic challenges. The ability to analyse data in real-time and the autonomy of systems raise questions about who is responsible and accountable for autonomous operations.

Therefore, the roadmap aims to improve the lives of citizens by creating AI-based solutions that address security, social, economic and environmental issues in an innovative and ethical way. This supports the achievement of goals set out in the National Development Plan and Sustainable Development Goals. Additionally, the roadmap identifies five main obstacles that may prevent the successful adoption of AI in Colombia:

• limited availability of skills, knowledge or experience in AI;
• high costs;
• lack of tools or platforms to build models;
• project complexity; and
• data complexity.

Finally, MinCiencias suggests a list of innovations to accomplish the goals planned in the roadmap, which includes (among others):

• developing a comprehensive legal framework on this topic;
• allowing public participation in the creation of AI policies; and
• conducting ethical audits to ensure ethical AI development.

Ibero-American Network for Data Protection: General Recommendations for the Data-Processing of AI

The Ibero-American Network for Data Protection has issued a guideline aimed at protecting the data privacy of individuals, and reflecting best practices in the processing of data through AI.

The main recommendations are the following:

• to comply with local regulations on personal data-processing;
• to conduct privacy impact assessments;
• to materialise the principle of accountability;
• to design appropriate governance schemes on personal data protection in organisations that are developing AI products;
• to adopt measures for ensuring personal data protection in AI projects;
• to respect data subjects’ rights, and to implement effective mechanisms that allow individuals to adequately exercise them;
• to ensure data quality;
• to use anonymisation tools;
• to increase trust and transparency with data subjects;
• to maintain open channels of communication and disclosure on the use of personal data in AI processes or products;
• to conduct pilot tests, in order to evaluate decision-making models and correct any issues;
• to provide data subjects with the option of their information being excluded from the data collected and studied in certain cases; and
• to establish review channels, so that decisions made by a machine can be reviewed by humans (in order to confirm or rectify them).

Presidential Guidelines on the Use of AI

Through Directive 03 of 2021, a Presidential Guideline was issued for public entities of the Colombian executive branch, on the use of cloud services, AI, digital security and data management.

Regarding AI use specifically, the Directive sets forth the following requirements.

• The use of AI systems should promote inclusive growth, sustainable development and citizen welfare.
• To encourage the participation of public officials in courses, training or talent programmes aimed at generating greater knowledge and skills regarding AI, its implementation, features and functionalities, and complying with the guidelines of austerity in spending.
• To facilitate the realisation of regulatory sandboxes in AI within the framework of inter-institutional co-ordination and articulation.
• To carry out the development of AI projects within the framework of inter-institutional co-ordination, and in support of international co-operation arising in the field. This should also enable the exchange of information and the following-up of recommendations, subject to the assigned functions and applicable regulations.
• Within the framework of Law 1712 of 2014, “whereby the Law on Transparency and the Right of Access to National Public Information is created and other provisions are enacted”, to inform citizens of when they are implementing a project that incorporates AI systems and the purpose of its use, providing clear and updated information. This should ensure knowledge of such technology and its characteristics.
• To formulate and develop AI projects, complying with the recommendations and ethical principles in the field.
• To deploy AI systems based on their functions, context and in line with the state of the art. To this end, measures should be used that actively demonstrate diligence and care in the implementation of these systems.
• Based on the entity’s role, context and ability to act, to apply a systematic risk-management approach at each phase of an AI system’s life cycle. This should address risks related to AI systems and their implementation, reducing any risk of discrimination (among other potential impacts).
• To document the processes and decisions taken during the AI system’s life cycle, in order to enable analysis of their outcomes, considering the context and being consistent with the state of the art.

Emerging Legislation

Colombia is also making practical efforts to create a solid legal framework for AI governance, capable of handling the issues and possibilities that arise from this fast-evolving technology. Various bills are underway aimed at setting up a strong legal basis for AI, as follows.

Bill 225 of 2024

This recent bill proposes a modification to Article 296 of the Colombian Criminal Code, which sanctions “personal misrepresentation”, by including an aggravating circumstance for when such misrepresentations are made using AI. In this sense, it introduces the concept of “deepfakes” as criminal conduct in Colombia.

Bill No 200 of 2023

This bill defines and regulates AI, conforms to human rights standards, establishes limits to AI’s development, use and implementation, and establishes other provisions.

The bill intends to adapt the criteria of respect and protection of human rights for AI, regulating and encouraging its growth, and setting boundaries for its use, application and assessment by individuals and entities. It introduces modifications such as:

• AI principles;
• risk classification;
• rights for individuals whose information is being processed by AI systems; and
• a series of obligations and limitations for the development and implementation of AI systems in the country.

This bill has already been approved in the first debate and is now pending a second debate in the Senate.

Bill No 059 of 2023

On 29 November 2023, Bill No 059 of 2023 was filed, establishing public policy guidelines for the development, use and implementation of AI, among other provisions. It proposed the following changes.

• Principles for AI systems: the bill outlines principles that must be guaranteed during AI system development, including human intelligence supervision, security, sustainability, transparency and demonstrated responsibility.
• Risk classification: AI developments are categorised based on risk levels – ie, unacceptable, high, limited or null risk.
• Informed consent: data subjects involved in AI development or implementation require specific and informed consent.
• Risk assessment and impact: entities using AI systems must publish assessments of risks and impacts on human and fundamental rights before deployment.
• Rights of affected individuals: individuals impacted by AI have rights to request review, lodge complaints, and seek revocation before competent authorities.
• Minimum age for AI use: the minimum age for AI system use and implementation is 18 years of age.
• Job displacement: entities eliminating jobs due to AI must relocate affected workers to equal or superior conditions for at least six months.
• Data protection authority: the Superintendence of Industry and Commerce (SIC), through the Delegation for the Protection of Personal Data, supervises and guarantees data protection in AI systems.
• Model registration: entities developing AI systems must register their models on a certification platform administered by the SIC.
• Excluded activities: certain activities (eg, behaviour manipulation, police prediction of criminal behaviour) are excluded from AI system use. Any activity causing significant harm to human rights or the environment is also excluded.
• Data transfer restrictions: public and private companies cannot transfer personal data for AI use, unless the risk is null and excluded from the specified activities.

Proposed bill updating the General Data Privacy Regulation, Law 1581 of 2012

In the context of Colombia’s legislative advancements, a significant development is a new bill of law amending Law 1581, which pertains to the protection of personal data, and which is currently being drafted by the SIC. This amendment aims to strengthen the right to personal data protection, and to update the current regulations to better align with the evolving digital landscape.

The amendment, which is still in a preliminary draft stage, aims to introduce several key changes:

• to modify and add to Law 1581 of 2012, enhancing the protection of personal data rights;
• to expand the scope of application to include all personal data-processing by natural or legal persons, public or private, even if the data is not part of a database;
• extraterritorial application – the amendment applies to data-processing activities related to offering goods or services to data subjects located in Colombia, or monitoring their behaviour within the country;
• legal bases for data-processing: the amendment introduces additional legal grounds for lawful data-processing beyond consent, such as contract execution, legal obligation, vital interests and legitimate interests;
• principles: new principles are introduced, including proportionality, retention period and accountability;
• consent conditions – the amendment specifies that consent must be prior, express, informed, free, unambiguous and specific;
• information to data subjects – the amendment outlines additional requirements regarding the information that data controllers must provide to data subjects at the time of data collection; and
• rights of data subjects – the amendment provides data subjects with additional rights, such as data portability, allowing them to obtain a copy of their data in a structured and commonly used format.

Bill No 130 of 2023

This project was filed on 6 September 2023, seeking to promote the use of AI to enhance human talent and protect the right to work, while preserving positions that may be displaced using innovative technologies. The bill seeks to benefit both the public and private productive sectors, and to create new job opportunities to stimulate innovation.

Specifically, the bill’s provisions:

• establish that public or private entities using AI for personnel selection must incorporate criteria to prevent discrimination and ensure impartiality in such processes;
• mandate that entities must incorporate techniques to implement programmes for harmonising and adapting human talent, prioritising human intelligence over AI;
• propose that entities utilising AI in evaluation, management, performance and control processes must ensure the privacy of employee and contractor data;
• suggest that higher education institutions must provide their students with a new vision of work, and prepare them to interact appropriately with AI; and
• establish that job positions potentially displaced using modern technologies should be requalified to enhance the human capacity – both physical and intellectual – of workers.

AI in Practice

AI’s impact in Colombia is evident across multiple domains, including as follows.

Public sector

AI is streamlining administrative processes, enhancing efficiency and improving citizen engagement. The implementation of information and communication technologies in Colombia’s public sector has been a strategic national effort to enhance government processes and public management.

For example, initiatives that leverage the use of new technologies, such as AI, have been implemented by different state actors, through pilot studies and further adoptions of the following:

• AI tools and machine learning, to optimise case association and perform data analysis for risk prediction of recidivism, as well as to request measures of assurance swiftly and to expedite processes;
• AI systems using tools to automate the reception of actions, in order to expedite the selection process for review, given the limited workforce for filtering the volume of files (the initiative is being reviewed to avoid eventual bias in the analysis); and
• systems that focus on modernising core structure to efficiently manage revenues and combat tax evasion and smuggling, by implementing AI-based chatbots for citizen services as well as an electronic auditing system to enhance control coverage and effectiveness.

Private sector

In the private sector, AI has been widely adopted to modernise organisational structures, streamline internal processes and enhance customer service experiences. Companies are utilising tools such as chatbots, and are conducting big data analyses to refine their marketing strategies. However, the widespread adoption of AI technologies raises concerns about the potential infringement of citizens’ rights, particularly due to the limited internet access and communication network availability for a sizeable portion of the population. This highlights the need for a balanced approach to technology integration, ensuring advancements do not come at the cost of inclusivity and equality.

Conclusion

In conclusion, Colombia is taking significant steps towards harnessing the potential of AI to drive its national economy and improve the well-being of its citizens. The country has adopted an open yet cautious approach to AI regulation, with various policy documents and bills of law providing strategic direction and guidance. The government has also issued recommendations and guidelines to ensure the responsible development and implementation of AI, with a focus on data protection, ethics and security. Although it is not certain that all the above-mentioned regulatory initiatives will be approved, they reflect the approach envisioned by Colombian regulators regarding AI development in the country.

In practice, AI is already having an impact across multiple domains, from public services to industry, with Colombian businesses leveraging AI to gain a competitive edge. As Colombia continues to develop its AI capabilities, it will be important to ensure that the technology is used in a manner that reflects the country’s values and legal framework, and its commitment to being technologically advanced.