Colombia does not have an artificial intelligence law yet, but using AI with personal data is already regulated. Law 1581 of 2012 applies to any processing of personal data, including processing by an AI, and External Circular 002 of 2024 from the Superintendence of Industry and Commerce (SIC) explains how it applies to AI: proportionality tests, demonstrated accountability, a privacy impact assessment when risk is high, and privacy by design.
Is there an AI law in Colombia?
No. The government bill (043 of 2025 in the Senate, 324 of 2025 in the House) was archived without a first debate, and new bills filed in 2026 are still in progress. CONPES 4144 (February 14, 2025) is the national AI policy through 2030, but it binds public entities, not companies. For a private company, today the rules come from data protection law.
What does Law 1581 require when AI processes personal data?
What does SIC Circular 002 of 2024 require?
What data should not go into ChatGPT or other AI?
The practical control is a written policy: generate yours with the AI acceptable use policy generator and check whether your team already uses AI without control with the shadow AI checklist. If your AI also reaches Europe or the US, compare the rules in ISO 42001 vs NIST AI RMF vs EU AI Act.
Frequently asked questions
Does Colombia have an artificial intelligence law?
No. Bill 043 of 2025 was archived and new bills were filed in 2026. Meanwhile, Law 1581 of 2012 and SIC External Circular 002 of 2024 apply.
What is SIC Circular 002 of 2024?
It is the Superintendence of Industry and Commerce instruction on processing personal data in artificial intelligence systems: proportionality, demonstrated accountability, privacy impact assessment and privacy by design.
Can I use ChatGPT with my customers' data?
Only if you have a legal basis for that processing, the tool has a contract with adequate safeguards (including international transfer) and the use respects the authorized purpose. In practice, use business accounts and ban sensitive data.
What is the fine for breaching Law 1581?
The SIC can impose fines of up to 2,000 monthly minimum wages, plus other sanctions under Article 23.
Does ISO 42001 help comply with Law 1581?
It helps: it organizes the AI inventory, impact assessment, data and vendors, which is what the SIC asks companies to demonstrate.
Sources
- Superintendencia de Industria y Comercio. Circular Externa 002 del 21 de agosto de 2024. 2024 https://sedeelectronica.sic.gov.co/sites/default/files/normativa/Circular%20Externa%20No.%20002%20del%2021%20de%20agosto%20de%202024.pdf
- Congreso de Colombia. Ley 1581 de 2012. 2012 http://www.secretariasenado.gov.co/senado/basedoc/ley_1581_2012.html
- Cuatrecasas. Guía para el uso responsable de la IA y los datos personales en Colombia. 2024 https://www.cuatrecasas.com/es/latam/tecnologia-medios-digitales/art/guia-uso-responsable-ia-datos-personales-colombia
- Cámara de Representantes. Inteligencia artificial. 2026 https://www.camara.gov.co/inteligencia-artificial
- ConsultorSalud. Política Nacional de Inteligencia Artificial – CONPES 4144. 2025 https://consultorsalud.com/co-politica-nacional-de-inteligencia-artificial/
Does your AI process personal data?
We review your AI systems against Law 1581 and SIC Circular 002, with a remediation plan.
See the AI auditYou may also like
ISO 42001 vs NIST AI RMF vs EU AI Act: which one does your company need?
Colorado AI law SB 26-189: what changed and what companies must do from 2027
Cybersecurity and Public Procurement in Colombia: Requirements You Must Meet
Comments (0)
Be the first to comment.