In March 2025, Colombia’s Superintendence of Industry and Commerce (SIC) issued a legal opinion in response to a request from a call center company seeking guidance on the legal framework applicable to the use of artificial intelligence (AI) to generate commercial calls, instead of relying on human personnel. In its response, the SIC clarified that such opinions are not binding administrative acts but serve as general guidance under the applicable legal regime.
Regarding personal data, the SIC reaffirmed the applicability of Law 1581 of 2012, its regulatory decrees, and in particular, External Directive No. 002 of 2024, which outlines specific guidelines for the processing of personal data in AI systems. Key obligations include the implementation of security measures, conducting privacy impact assessments in high-risk scenarios, and adherence to the principle of accountability.
From a consumer protection standpoint, the SIC stressed that all technological solutions, including AI-based systems, must comply with the core principles established in Law 1480 of 2011: transparency, security, responsibility, and the special protection of children and adolescents. It emphasized that the use of AI does not exempt producers and providers from their duty to provide accurate, understandable, and timely information about the products or services offered, including any associated risks.
The opinion also references the 2021 Ethical Framework for AI and CONPES 4144 of 2025, which recognize AI as a cross-cutting issue requiring development under principles of governance, transparency, and risk mitigation. In this context, the SIC noted that Colombia’s Ministry of Labor is tasked with monitoring the labor impacts of automation and developing strategies for labor transition and retraining.
Ultimately, the SIC emphasized that AI-related obligations apply throughout the entire lifecycle of these systems—from design to deployment—and warned that failure to comply with the established norms may lead to administrative sanctions for violations of consumer or data protection regulations.