Skip to content
AI Policy Generator

ESWhat applies

Colombia · Circular

SIC guidelines on personal data and AI

Regulator guidanceSIC Circular 002/2024

Summary

Explains how the data law applies to AI: prior privacy impact study for high risk, proportionality test, precautionary principle, data quality and privacy by design.

Who it applies to

Controllers and processors that develop, deploy or use AI with personal data.

Penalties

The rule has no penalty regime of its own, or it does not apply.

Official name
Circular Externa 002 de 2024, Lineamientos sobre el tratamiento de datos personales en sistemas de inteligencia artificial
Official reference
Circular Externa 002 de 2024, Superintendencia de Industria y Comercio, 21 de agosto de 2024; Diario Oficial 52.856, 22 de agosto de 2024
Regulator
Superintendency of Industry and Commerce (SIC)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Privacy impact study before designing high-risk AICircular Externa SIC 002 de 2024Regulator guidanceAugust 21, 2024Controllers and processors that develop, deploy or use AI that may pose high risk to people.Verified in the official source on November 4, 2026
Show the AI use is suitable, necessary and proportionateCircular Externa SIC 002 de 2024Regulator guidanceAugust 21, 2024Organizations that process personal data with AI in Colombia.Verified in the official source on November 4, 2026
Data quality and privacy when training modelsCircular Externa SIC 002 de 2024Regulator guidanceAugust 21, 2024Organizations that train, fine-tune or sell AI systems using personal data.Verified in the official source on November 4, 2026

Privacy impact study before designing high-risk AI

Circular Externa SIC 002 de 2024Regulator guidance

Applies from August 21, 2024

When it relates
Controllers and processors that develop, deploy or use AI that may pose high risk to people.
What the rule provides
  • When the system is likely to pose a high risk to people, carry out and document a privacy impact study before designing and developing it.
  • Apply the precautionary principle: if possible harms are uncertain, refrain from processing the data or take preventive measures.
Typical evidence
  • Dated privacy impact study and measures taken
Verification
Verified in the official source on November 4, 2026Checked against the Circular text in the MinTIC legal database (Official Gazette 52,856), items II (precaution) and IV (impact study when high risk is likely). The Circular creates no new obligations and has no penalties of its own, but it is the standard the SIC uses to assess demonstrated accountability for AI systems.

Show the AI use is suitable, necessary and proportionate

Circular Externa SIC 002 de 2024Regulator guidance

Applies from August 21, 2024

When it relates
Organizations that process personal data with AI in Colombia.
What the rule provides
  • Document an analysis of the suitability, necessity, reasonableness and proportionality of the processing.
  • Adapt the company's risk management system to AI-specific risks and have demonstrable strategies to uphold people's rights.
Typical evidence
  • Proportionality analysis per use case
Related base documents
Verification
Verified in the official source on November 4, 2026Checked against the Circular text in the MinTIC legal database (Official Gazette 52,856), items I (suitability, necessity, reasonableness and proportionality) and III (risk management). The Circular creates no new obligations and has no penalties of its own, but it is the standard the SIC uses to assess demonstrated accountability for AI systems.

Data quality and privacy when training models

Circular Externa SIC 002 de 2024Regulator guidance

Applies from August 21, 2024

When it relates
Organizations that train, fine-tune or sell AI systems using personal data.
What the rule provides
  • Use data that is truthful, complete, accurate, up to date and verifiable.
  • Do not treat information as public just because it is accessible online.
  • Use techniques such as differential privacy so people cannot be identified when training models.
Typical evidence
  • Dataset sheets with source, legal basis and controls
Verification
Verified in the official source on November 4, 2026Checked against the Circular text in the MinTIC legal database (Official Gazette 52,856), items V (accurate, complete data), VI (differential privacy) and IX (information available online is not public by itself). The Circular creates no new obligations and has no penalties of its own, but it is the standard the SIC uses to assess demonstrated accountability for AI systems.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)