AI Under Scrutiny by the SIC Key Points of the Consumer Protection and Privacy Framework

The absence of a comprehensive law on artificial intelligence does not leave consumers in Colombia unprotected. That is the main conclusion of the opinion issued by the Superintendency of Industry and Commerce (SIC).

When the offering of products or services through the use of an AI system constitutes a consumer relationship, the general obligations of the Consumer Statute apply, and the technology used does not exclude them.

The conditions are as follows:

1. A consumer relationship must exist.
2. The decisive factor is not whether the product or service uses AI, but whether the purchaser is an end consumer.
3. The consumer must use it to meet their own needs, including a business need that is not intrinsically linked to their economic activity.

Consequently:

If a consumer relationship exists, the AI service is subject to the general obligations regarding information, advertising, quality, suitability, safety, and warranties.

Law 1480 recognizes, among other things, the right to receive complete, truthful, transparent, timely, verifiable, and understandable information, and the right not to be subjected to misleading advertising.

The SIC does not have a public list of specific technical parameters for determining when an AI model is defective.

The general criteria apply: a defect due to an error in design, manufacturing, construction, packaging, or information that prevents the product from offering the reasonable safety to which people are entitled.

Complaint

In the event of a possible violation, the consumer may:

1. File a complaint with the SIC, which may result in sanctions if the claim is substantiated.
2. Pursue legal action for consumer protection in accordance with the applicable requirements, including filing a prior direct complaint with the manufacturer or supplier.

Territorial Scope

The SIC has no jurisdiction over consumer protection matters involving foreign suppliers not domiciled in Colombia.

However, Law 1480 declares the Statute applicable to both domestic and imported products, while Article 50 imposes specific obligations on suppliers and retailers located within the national territory who sell via electronic means.

The scope in a cross-border case must be analyzed by considering the supplier actually responsible, the place of contract formation, and the effects of the case.

For businesses using AI, documenting the purpose of the acquisition is important both for determining whether a consumer relationship exists and for contractually allocating responsibilities between the supplier and the business user.

It is advisable to retain evidence supporting performance claims, identify who provides the service and who is accountable to the consumer, and review the flows of personal data and the conditions for updating the model. These are risk management measures derived from the general obligations regarding information, warranty, and data protection set forth in the official letter and in the Consumer Protection Statute.