AI Legal Audit and Project Implementation in Colombia

There is no general artificial-intelligence statute in Colombia today. That does not leave AI systems unregulated: the personal-data protection regime, the Consumer Statute, intellectual-property rules, antitrust law and the contractual obligations the company already assumed all apply. The audit works on that existing framework, not a future one.

The audit looks backwards: which AI systems the company uses today, on what data, under which contracts and with what exposure. The implementation looks forward: which processes are worth delegating, how the vendor is contracted and what controls are in place before launch. Many clients start with the audit because they discover they already had more AI than they thought.

It counts, and it is usually the most common finding. A free assistant that a team pastes client information into is a transfer of personal data to a third party, often with no authorization, no processor agreement and no clarity on where that information ends up. That is why the inventory deliberately covers informal use, not only contracted tools.

It is the question we get most, and the answer depends on why that data was collected. Purpose limitation does not allow information gathered for one thing to be reused for another. We review the authorization the data subject signed, the privacy notice, the processing policy and what the vendor contract says about retraining; where the stated purpose does not cover the use, we set out how to fix it before the system goes live, not after.

As binding law no, unless the company operates in that market. We use it as a reference framework because it is the good-practice benchmark corporate clients, investors and auditors already ask for. We always separate what Colombian law requires from what the market requires, so the company knows what is mandatory and what is a commercial decision.

The company must be able to explain the criterion, keep an audit trail of the decision and offer human review. That applies to credit, hiring, pricing, customer prioritization and account suspension. We design that control point and define what evidence is retained, because the question arrives once the case is already in dispute, and by then the evidence either exists or it does not.

The company must be able to explain the criterion, keep an audit trail of the decision and offer human review. That applies to credit, hiring, pricing, customer prioritization and account suspension. We design that control point and define what evidence is retained, because the question arrives once the case is already in dispute.

It depends on the size of the inventory, not the size of the company. A company with three systems and one vendor resolves in a few weeks; a group whose departments adopted tools on their own takes longer, because the inventory phase is what reveals the real scope. We agree the scope in writing before starting.

Usually a risk-classified system inventory, the internal use policy, the incident protocol, the decision log and the contract clauses with vendors. That package is precisely the output of the audit, so the answer to the client comes out of the same work.

No. Nobody can certify that, and you should be wary of anyone who offers to. What we deliver is a precise diagnosis of where the company is exposed, what gets fixed first, and how to have the evidence ready the day someone asks, whether that is a client, a regulator or a court.