AI Under Scrutiny by the SIC Key Points of the Consumer Protection and Privacy Framework
The absence of a comprehensive law on artificial intelligence does not leave consumers in Colombia unprotected. That is the main conclusion of the opinion issued by the Superintendency of Industry and Commerce (SIC).
When the offering of products or services through the use of an AI system constitutes a consumer relationship, the general obligations of the Consumer Statute apply, and the technology used does not exclude them.
The conditions are as follows:
- A consumer relationship must exist.
- The decisive factor is not whether the product or service uses AI, but whether the purchaser is an end consumer.
- The consumer must use it to meet their own needs, including a business need that is not intrinsically linked to their economic activity.
Consequently:
If a consumer relationship exists, the AI service is subject to the general obligations regarding information, advertising, quality, suitability, safety, and warranties.
Law 1480 recognizes, among other things, the right to receive complete, truthful, transparent, timely, verifiable, and understandable information, and the right not to be subjected to misleading advertising.
The SIC does not have a public list of specific technical parameters for determining when an AI model is defective.
The general criteria apply: a defect due to an error in design, manufacturing, construction, packaging, or information that prevents the product from offering the reasonable safety to which people are entitled.
Complaint
In the event of a possible violation, the consumer may:
- File a complaint with the SIC, which may result in sanctions if the claim is substantiated.
- Pursue legal action for consumer protection in accordance with the applicable requirements, including filing a prior direct complaint with the manufacturer or supplier.
Territorial Scope
The SIC has no jurisdiction over consumer protection matters involving foreign suppliers not domiciled in Colombia.
However, Law 1480 declares the Statute applicable to both domestic and imported products, while Article 50 imposes specific obligations on suppliers and retailers located within the national territory who sell via electronic means.
The scope in a cross-border case must be analyzed by considering the supplier actually responsible, the place of contract formation, and the effects of the case.
For businesses using AI, documenting the purpose of the acquisition is important both for determining whether a consumer relationship exists and for contractually allocating responsibilities between the supplier and the business user.
It is advisable to retain evidence supporting performance claims, identify who provides the service and who is accountable to the consumer, and review the flows of personal data and the conditions for updating the model. These are risk management measures derived from the general obligations regarding information, warranty, and data protection set forth in the official letter and in the Consumer Protection Statute.
Mediation: legal certainty for international business in Colombia
Daniel Peña Valenzuela
Partner, Peña Mancero Abogados
Since September 12, 2026, the Singapore Convention on Mediation has been in force for Colombia. Our country signed the Convention on August 7, 2019, approved its incorporation through Law 2309 of 2023, obtained favorable constitutional review in Judgment C-418 of 2024, and deposited the instrument of ratification on March 12, 2026.
For entrepreneurs and investors, the Convention provides a framework to enforce, in another State Party, certain international commercial agreements reached through mediation. Its scope covers written agreements intended to resolve international commercial disputes. Mediation must consist of a procedure in which a third party assists the parties in reaching a settlement, without authority to impose a solution.
The legal benefit is concrete: the interested party may request enforcement of the agreement before the competent authority of the State where the measure is sought, presenting the signed agreement and proof that it resulted from mediation. The Convention also recognizes the validity of electronic communications, allows requests for translations, and requires authorities to act expeditiously.
This can improve risk management in supply, construction, distribution, financing, infrastructure, joint ventures, and investment contracts. A negotiated agreement may preserve business relationships that litigation could damage. The Convention itself acknowledges that mediation can reduce abrupt termination of commercial relationships, facilitate the administration of international operations, and generate efficiencies for justice systems. However, these are potential benefits, not guarantees of savings, speed, or effective recovery.
The Convention does not eliminate all risks. Enforcement may be denied, among other grounds, if the agreement is null, ineffective, non-binding, non-final, or unintelligible; if obligations have already been performed; if there was serious misconduct by the mediator; or if enforcement contradicts the agreement or the applicable legal order.
Comparison with other mechanisms is essential. Mediation under the Convention favors a consensual solution and preserves party autonomy. Arbitration, by contrast, leads to a decision imposed by an arbitral tribunal; if the negotiated agreement is incorporated into an enforceable award, it falls outside the Convention and is subject to the regime applicable to arbitral awards.
Conciliation may be appropriate when domestic law requires a specific authority, procedure, or approval. In particular, the Court emphasized that agreements approved judicially or concluded within judicial proceedings, when enforceable as judgments, are excluded from the Convention.
Traditional litigation remains necessary when a judicial decision, coercive measures, or protection of non-disposable rights is required. Mediation does not replace these avenues: it complements them.
As a contractual practice, it is advisable to carefully document the international nature of the dispute, the written agreement, signatures, mediator’s involvement, clarity of obligations, applicable law, and the documentation required for potential enforcement. The Convention strengthens predictability, but legal certainty will also depend on the quality of the agreement and compliance with procedural requirements in the country where enforcement is sought.
Sources: UNCITRAL, Law 2309 of 2023, and Judgment C-418 of 2024.
PM Legal News – July 2026
External Circular 100-000020 of 2026
On July 2, 2026, the Superintendency of Corporations issued External Circular 100-000020, which adopts a new Basic Legal Circular and comprehensively amends the regulatory framework applicable to the prevention of:
- Money laundering (LA)
- Terrorism financing (FT)
- Financing of the proliferation of weapons of mass destruction (FP)
- Corruption and transnational bribery (C/ST)
Repeal of Previous Regulations
The new circular repeals and replaces the following External Circulars:
- 100-000016 of 2020 (SAGRILAFT – Chapter X)
- 100-000011 of 2021 (PTEE – Chapter XIII)
Important Changes
SAGRILAFT and PTEE are consolidated into a single instrument titled: “LA/FT/FP and C/ST Self-Regulation and Risk Management System,” contained in Chapter IX of the new Basic Legal Circular.
- The term “obligated company” is changed to “obligated entity.”
- The acronym FPADM (Financing of the Proliferation of Weapons of Mass Destruction) is simplified to FP.
- With regard to the financial thresholds that determine the system’s scope of application, the Current Legal Monthly Minimum Wage (SMLMV) will no longer be used as the reference unit; instead, Basic Value Units (UVB) are adopted.
- The Colombian Confederation of Chambers of Commerce (CONFECÁMARAS) is included as an obligated entity.
- Under the Minimum Measures Regime, several sectors that were not previously covered are also incorporated:
- The pharmaceutical sector (ISIC 2011 codes 2100, 3250, 4645)
- The manufacturing sector
- The mining and energy sector
- The vehicle trade sector (ISIC codes 4511, 4512, G4541), which is also subject to the full system when it exceeds the respective threshold
- Monitoring: Minimum frequency of once per year for high-risk counterparties. Minimum frequency of once every two years for medium- or low-risk counterparties.
- Regarding transparency and business ethics, mandatory policies must be established, such as those covering: the delivery and offering of gifts or benefits to third parties, political contributions, donations, travel and lodging expenses, and the filing and preservation of documents.
- The appointment of a deputy compliance officer is required; this individual must meet the same qualifications and requirements established for the principal compliance officer.
- Compliance officers must demonstrate and update their knowledge of ML/TF/FP and C/ST risk management at least once every three (3) years, in addition to demonstrating a minimum of one (1) year of professional experience in positions related to regulatory compliance in ML/TF/FP and C/ST risk management activities. Training is validated through formal education programs—specializations or master’s degrees—or through informal education programs, that is, “certificate programs provided they have a minimum duration of ninety (90) hours” with a direct and specific relationship to the subject matter.
Differences from the Previous Regulation
Previously: two parallel systems (SAGRILAFT – Chapter X / PTEE – Chapter XIII).
- Problem: duplication of obligations, bodies, and reporting requirements.
- Now: a comprehensive approach that manages all risks jointly.
Transition Period and Recommendations
- Regulated entities must make the required adjustments to the new system by May 31, 2027.
- During the transition period, the current systems will remain valid.
Peña Mancero Abogados offers support in the integration of systems and implementation of the necessary adjustments to ensure compliance with the new obligations within the established deadline.
Public Works for Taxes in Bogotá: An Opportunity to Turn Your Tax Burden into Tangible Impact
Companies seeking to maximize the value of their social investment and strengthen their relationships with communities now have an innovative alternative for fulfilling part of their tax obligations: the “Works for Taxes” (Obras por Impuestos) program.
“Works for Taxes” is an alternative mechanism through which companies can pay a portion of their taxes in Colombia by carrying out projects that help reduce socioeconomic disparities. This mechanism does not reduce companies’ tax burden, but it can generate specific benefits.
In Bogotá, the “Works for Taxes” program can facilitate the creation of partnerships between companies, local communities, and the District. Furthermore, it allows for a more efficient and transparent use of tax revenues, as these funds are channeled toward specific public works projects. In this way, companies’ tax contributions become more visible and tangible.
At our firm, we assist domestic and international companies in structuring, feasibility studies, negotiation, and execution of projects under this scheme, helping them manage the legal, regulatory, and contractual risks that arise throughout the process.
What Are “Works for Taxes”?
The “Works for Taxes” program is a mechanism that allows individuals and legal entities to allocate a portion of their taxes to the financing and implementation of projects that contribute to social development and the closing of socioeconomic gaps.
Although this mechanism does not reduce the tax burden, it does allow the funds that a company is required to pay to be channeled into specific projects that are visible to the beneficiary communities.
In Bogotá, this program has become particularly significant due to its ability to coordinate efforts among the private sector, communities, and district agencies to promote projects with high social impact.
Key Considerations for Companies
Companies interested in participating should keep in mind that:
- The projects are funded with private resources contributed by taxpayers.
- The taxpayer assumes full responsibility for implementation.
- Regulatory supervision is required.
- Cost overruns are not reimbursed.
- The project must address the District’s needs and interests.
- The taxpayer may enter into contracts under its own contracting regime.
These characteristics make adequate legal, tax, and contractual planning essential from the project’s initial stages.
How does the process work?
A company’s participation in the mechanism involves several stages:
- Identification of the project, whether it is an existing initiative or a proposal from the taxpayer.
- Project structuring, including the definition of scope, costs, risks, and timeline.
- Management of the feasibility study with the relevant district authority.
- Approval and allocation of the quota by the relevant authority.
- Formalization of the contract and project execution.
Each of these stages requires careful legal analysis to ensure compliance with regulatory requirements and minimize contingencies during implementation.
Two ways to participate
Trust (Fiducia) Option
Under this option, the company deposits a portion of the tax it was required to pay into a separate trust fund and receives a certificate that it may use at a later date.
Agreement (Convenio) Option
Under this program, the taxpayer enters into an agreement with a district government agency, carries out the project using their own funds, and receives, in return, District Territorial Renewal Certificates (TRTD), which they may later use to pay district taxes (property tax, vehicle tax, and ICA).
Current Opportunities in Bogotá
The District Secretariat for Social Integration (SDIS) currently has a portfolio of six projects spread across twenty neighborhoods in Bogotá. These projects focus on two main areas: providing social services to vulnerable populations and adapting infrastructure to be inclusive for people with disabilities.
These initiatives represent an opportunity for companies that want to make a measurable social impact while actively participating in the city’s development.
How can we help?
Our firm provides comprehensive advisory services to companies at every stage of Works-for-Taxes projects, including:
- Eligibility analysis and participation strategy.
- Legal and contractual structuring of the project.
- Regulatory due diligence.
- Negotiation of agreements and implementation contracts.
- Risk management and regulatory compliance.
- Support during project execution and supervision.
- Dispute resolution and claims handling.
The implementation of the open finance system in Colombia: transition towards an open data ecosystem
By Daniel Peña Valenzuela, Partner at Peña Mancero Abogados
Introduction
Decree 368 of 2026 introduced in Colombia the Mandatory Open Finance System, conceived as an institutional and technological transformation mechanism within the financial sector. This system constitutes the first step towards a broader model of data exchange, aimed at fostering innovation, competition, and financial inclusion. The main challenges lie in: (i) achieving a gradual implementation that ensures technical interoperability, (ii) safeguarding financial consumer protection, and (iii) preserving prudential stability, while building a trust-based ecosystem around data as a public resource.
1. Building the Open Finance System
The system is based on a hybrid model of mandatory and voluntary participation, accompanied by differentiated timelines according to the category of data. The implementation sequence foresees an initial six‑month phase for the definition of technical standards, followed by a twelve‑month period for the establishment of the Participants’ Directory and monitoring indicators. Effective access to information will be enforceable twelve months after the issuance of each standard, allowing entities to develop technical and operational capacities before assuming the obligations provided. The model will be mandatory for entities supervised by the Financial Superintendence, which must share information under the express authorization of clients. This scheme relies on a data governance system based on informed consent, an interoperable infrastructure supported by application programming interfaces, and periodic supervisory mechanisms. The creation of a Participants’ Directory and quarterly monitoring indicators seeks to ensure that the incorporation of new actors occurs without redesigning the system. Implementation also requires companies to strengthen their management of digital payments, insofar as open finance represents the next stage of sectoral development. The inclusion of the financial sector from the design phase reflects the intention to avoid regulatory lag and to adapt the system to the specificities of each subsector, such as cooperatives or insurers. In this context, any citizen will be able to authorize in seconds the use of their information to access better credit, insurance, or investment products, without physical procedures or additional certificates.
2. The Transition towards Open Data
Beyond open finance, the ultimate objective is to move towards an Open Data model involving heterogeneous sectors such as telecommunications, health, public services, and tax databases. Coordination among actors with different levels of digitalization and supervisory frameworks constitutes one of the main regulatory challenges. Building trust in information exchange becomes indispensable, especially regarding the progressive incorporation of non‑supervised providers such as fintech and insurtech, whose participation must avoid regulatory arbitrage. The balance between prudential stability and competitive openness requires a reinterpretation of regulation as a driver of innovation, beyond its traditional risk‑limiting function. The true purpose of the system demands the consolidation of an Open Data ecosystem integrating the financial, insurance, solidarity, and other sectors. This ecosystem must generate real value for citizens, facilitating access to credit, insurance, and investment products under more favorable and transparent conditions. In particular, the aim is to expand credit coverage, which remains low—between 35% and 40% of the adult population—highlighting the need to deepen financial inclusion in the country.
Conclusions
The Open Finance System represents a milestone in Colombian public policy, establishing the foundations for a model of information exchange that seeks to democratize access to financial services and promote innovation. Its gradual implementation and interoperable technical design are significant advances, but success will depend on institutional capacity to manage the transition towards Open Data. Trust‑building, intersectoral coordination, and consumer protection are necessary conditions for the system to fulfill its purpose of inclusion and competition. Ultimately, the challenge is not only regulatory or technological, but cultural: recognizing data as a public good and a driver of sustainable development. Information openness must be understood as a public policy tool which, far from being an end in itself, is oriented towards transforming the relationship between citizens and the financial system, expanding access opportunities and strengthening transparency in the digital economy.
Decree 0581 of 2026, Illegal Labor Outsourcing and Intermediation in Colombia
Newsletter Jun 2026
Decree 0545 of 2026, Issued May 29, 2026
“Whereby guidelines for the environmental planning of the Bogotá Savanna are established”
The National Government issued Decree 0545 of 2026 for the purpose of establishing guidelines for the environmental planning of the Bogotá Savanna, pursuant to the mandate set forth in Article 61 of Law 99 of 1993, which recognizes this region as an area of national ecological interest.
These guidelines constitute binding environmental planning criteria and rules of superior legal hierarchy that must be incorporated by territorial entities and considered by environmental authorities in the exercise of their respective powers.
The Decree applies to Bogotá D.C., the municipalities that comprise the Bogotá Savanna, and the authorities and entities responsible for territorial planning and land-use management.
The Bogotá Savanna encompasses 31 municipalities. The Decree applies in its entirety to: Cajicá, Chía, Cota, Funza, Gachancipá, Madrid, Mosquera, Nemocón, Sopó, Tabio, Tenjo, and Tocancipá.
It also applies partially to: Bogotá, Bojacá, Chipaque, Chocontá, Cogua, El Rosal, Cucunubá, Facatativá, Guasca, Guatavita, La Calera, Sesquilé, Sibaté, Soacha, Subachoque, Suesca, Tausa, Villapinzón, and Zipaquirá.
The Decree organizes its guidelines into five strategic components:
- Biodiversity conservation and climate change adaptation: promotes ecological connectivity, ecosystem restoration, and the protection of strategic areas.
- Integrated water resources management: strengthens the protection of aquifers, recharge areas, and surface and groundwater sources, prioritizing regional water security.
- Soil protection and conservation: establishes environmental criteria for urban expansion processes, preventing the degradation of land with high ecological and agricultural value.
- Sustainable infrastructure and green cities: requires new infrastructure projects to incorporate environmental criteria from the earliest stages of project planning, promoting sustainable mobility systems and nature-based solutions.
- Governance, information, and ancestral knowledge: incorporates mechanisms for interinstitutional coordination, open access to environmental information, and recognition of the traditional knowledge of Indigenous communities, particularly the Muisca people.
Key issues
- The Decree requires the updating of environmental mapping and watercourse buffer zones within specified timeframes.
- It promotes the ecological restoration of degraded areas and the protection of strategic ecosystems such as wetlands, Andean forests, and páramos.
- The Decree establishes a transition regime and clarifies that it does not alter vested legal rights or previously adopted planning instruments.
The environmental planning criteria must be incorporated into POTs and other planning instruments within twelve (12) months of the Decree’s effective date, beginning on May 29, 2026. During this period, priority will be given to environmental mapping, zoning, and the corresponding regulatory adjustments.
The Decree does not automatically modify projects that are covered by final administrative acts or environmental permits issued prior to its effective date, provided that such projects are carried out in accordance with the conditions established therein. However, these projects must assess related environmental risks and, where required by the competent authorities, adopt additional mitigation or compensation measures.
The municipalities identified in the Decree may face significant constraints on their autonomy to determine land use and guide their own development under the framework established by the Decree.
Property owners may face restrictions on land use and on the development of new urban projects within protected areas. Although ownership rights remain intact, owners may not freely develop, subdivide, construct on, exploit, or alter the use of their land when it is subject to environmental planning criteria. This is because the guidelines established by the Decree constitute binding criteria and rules for territorial and environmental planning and are considered rules of superior legal hierarchy within their respective spheres of competence.
The importance of protecting the Bogotá Savanna, its ecosystems, and its communities is beyond dispute. The legal issue, however, is whether the Decree maintains the constitutional balance between environmental protection of national significance and municipal autonomy.
The Constitution requires these two principles to coexist harmoniously. Therefore, the debate is not about the State’s authority to intervene, but rather whether certain provisions of the Decree exceed that authority and, in practice, displace decisions that the Constitution reserves to municipalities. This issue will likely be adjudicated by the courts, whose interpretation will ultimately define the boundaries between environmental powers and municipal autonomy.
Post-quantum digital signature and the reform of law 527 of 1999 in Colombia
By Daniel Peña Valenzuela
Introduction
Law 527 of 1999 marked a milestone in the regulation of electronic commerce in Colombia by recognizing the digital signature as a legal mechanism equivalent to the handwritten signature. This recognition consolidated trust in electronic transactions and granted evidentiary security to digital documents. The advent of quantum computing, however, poses an unprecedented challenge: the cryptographic algorithms underpinning digital signatures, such as RSA and ECC, may become vulnerable to the processing power of quantum computers. In this context, it is necessary to rethink the legal category of the digital signature and project regulatory reforms to ensure its validity in a post-quantum environment.
1. Digital signature under Law 527 of 1999
Law 527 establishes that the digital signature is an authentication mechanism based on public-key cryptography, guaranteeing the integrity and authenticity of electronic documents. The principle of technological neutrality allows any reliable method to be considered a digital signature, provided it meets security and functional equivalence standards. This principle must be reinterpreted in light of quantum risks, since legal validity depends on the technical robustness of the algorithms employed.
2. Quantum threat to digital signatures
Advances in quantum computing, particularly Shor’s algorithm, enable the factorization of large numbers and the resolution of discrete logarithm problems in polynomial time, directly undermining RSA and ECC. Likewise, Grover’s algorithm reduces the complexity of brute-force attacks on symmetric systems. These developments imply that current digital signatures may become vulnerable, weakening their evidentiary value in judicial and contractual processes.
3. Verifiable technical elements
The transition to a post-quantum environment requires the adoption of algorithms resistant to quantum attacks. The NIST (National Institute of Standards and Technology) selected between 2022 and 2024 algorithms such as CRYSTALS-Kyber for encryption and CRYSTALS-Dilithium for digital signatures. Similarly, ISO/IEC JTC 1 is working on international standards for post-quantum cryptography applicable to digital signatures. These verifiable technical elements form the basis upon which Colombian legislation must be reformed.
4. Need for reform of Law 527
The reform must explicitly recognize post-quantum algorithms as valid for digital signatures. It should also establish mechanisms for international interoperability with NIST and ISO standards, introduce the principle of technological resilience, and reinforce evidentiary guarantees to ensure that post-quantum digital signatures retain their functional equivalence with handwritten ones.
5. International comparison
In the European Union, the eIDAS 2.0 Regulation discusses the integration of quantum-resistant mechanisms. In the United States, NIST leads the standardization of post-quantum algorithms, directly impacting the validity of digital signatures. In Latin America, Colombia and Mexico have not yet explicitly incorporated the quantum threat into their legal frameworks, creating a regulatory gap and an opportunity for regional leadership.
Conclusions
The digital signature, as a legal category, faces a structural challenge in the quantum era. Reforming Law 527 is essential to recognize the post-quantum digital signature, adopt international standards, and guarantee the continuity of its functional equivalence. The post-quantum future does not eliminate the digital signature but requires its legal and technical transformation. Colombia must anticipate this transition to maintain legal certainty in electronic commerce and strengthen trust in digital transactions.
CAUSE FOR DISOLUTION OF COMPANIES DUE TO NON-COMPLIANCE WITH THE HYPOTHESIS OF CONTINUING BUSINESS
