Cumplimiento y regulación — Blog T.I. RESCUE

Octubre 28, 2026

AI and personal data in Colombia: what Law 1581 and SIC Circular 002 require

Colombia has no AI law yet, but using AI with personal data already has rules. What the SIC requires, the risks with ChatGPT and how to comply.

Octubre 28, 2026

ISO 42001 vs NIST AI RMF vs EU AI Act: which one does your company need?

One is a law, one is a voluntary framework and one is a certifiable standard. What each requires, the key dates and how to combine them without duplicate work.

Octubre 28, 2026

Colorado AI law SB 26-189: what changed and what companies must do from 2027

Colorado replaced its AI Act before it took effect. What SB 26-189 requires from 2027, who it applies to, and a checklist to get ready.

Octubre 2, 2026

Cybersecurity and Public Procurement in Colombia: Requirements You Must Meet

A mid-sized technology company in Cali had spent years selling to private clients without much fuss about security requirements. When it entered its first bid with a public entity, it found a list of requirements in the bidding document it had never needed before: a current ISO 27001 certification, evidence of a business continuity plan, and a signed declaration of Law 1581 compliance. It had to w

Octubre 1, 2026

Compliance Audit vs. Cybersecurity Audit: Key Differences

"We already had the audit done, so why do you keep finding vulnerabilities?" It's a question we hear more often than you'd expect, and it almost always reveals the same underlying confusion: the business hired a compliance audit, expecting it to also function as a technical cybersecurity audit. They're two different exercises, answering two different questions, and mixing them up can leave a busin

Septiembre 30, 2026

Is Your Company Legally Required to Report a Cyberattack in Colombia?

It's three in the morning, the IT team just confirmed there's active ransomware on the network, and in the middle of the technical chaos someone asks: "who do we actually have to tell?" It's one of the most anxiety-inducing questions during an incident, and the honest answer is: it depends. Colombia doesn't have a single law saying "every cyberattack must be reported here within 72 hours," the way

Septiembre 29, 2026

ISO 27001 Compliance Checklist for Colombian Companies in 2026

"We need ISO 27001 certification for the next contract" is a sentence we hear constantly from Colombian businesses that, until that moment, had never given the topic much thought. It usually arrives in the worst possible way: a large client, often in the financial or government sector, lists it as a requirement in a bid, and suddenly there are three months to get something that normally takes six

Septiembre 28, 2026

SIC Fines for Data Protection Violations: Real Cases in Colombia

Two thousand monthly minimum wages. That's the ceiling Law 1581 gives Colombia's Superintendency of Industry and Commerce (SIC) to fine a business that violates its personal data protection obligations. In today's pesos, that easily tops COP 2.6 billion for a single infraction. And contrary to what many businesses assume, the SIC doesn't reserve these penalties for massive breach scandals — most o

Septiembre 25, 2026

CONPES 3995 Explained: Colombia's National Digital Trust Policy

Most of Colombia's cybersecurity laws — Law 1581, Law 1273, the sector circulars from the SFC and Supersalud — were born either before or after a document few businesses know about, but which largely explains why all those other rules ended up existing: CONPES 3995 of 2020, the National Digital Trust and Security Policy. It's not a law that directly fines your business. It's something different, a