ColombiaSIC Circular on AI, Demonstrated Accountability
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Superintendencia de Industria y Comercio
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Be ready to demonstrate to the Superintendencia de Industria y Comercio, on its request, that you have implemented measures that are appropriate and effective to comply with Ley 1581 de 2012 and Decreto 1074 de 2015 for any artificial intelligence system that processes personal data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
The circular quotes the decree's rule that controllers must be able to demonstrate to the Superintendencia, on request, that they have implemented appropriate and effective measures to comply with Ley 1581 de 2012. A controller can make that showing only from records of the measures. The text names no log, contents or period.
- Kind
- Implicit
- As of
- Provision
- Decreto 1074 de 2015, article 2.2.2.25.6.1, as quoted in the circular
- Trigger
- personal_data_processing
What this law does
The circular grounds its artificial intelligence specific duties in the demonstrated accountability rule the Superintendencia de Industria y Comercio already enforces under Decreto 1074 de 2015.
A data controller must be able to show, when the Superintendencia asks, that it has implemented measures that are appropriate and effective to comply with Ley 1581 de 2012 and that decree, and the circular treats the privacy impact assessment and privacy by design duties it imposes as how a controller meets that duty for an artificial intelligence system.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .