Colombia debates regulating AI in healthcare: Bill 216 puts the doctor in charge and splits blame among vendor, provider and clinician

By IFM Noticias · October 25, 2026.

Colombia’s Senate is moving forward with Bill 216 of 2026, which sets limits on the use of algorithms in diagnoses, treatments and patient data. According to IFM Noticias, the text went through a public hearing in the Senate’s Seventh Committee and is being prepared for its first debate. It is not yet law and, according to the same source, no date has been set for that first debate.

The core principle, according to the analysis by Fepasde cited by the outlet, is that AI should support clinical judgment, not replace it. Healthcare professionals retain the authority and the duty to accept, question or reject an algorithm’s recommendations.

The bill classifies systems into four risk levels: minimal, limited, high and critical. Administrative uses would face lighter requirements. Tools that support diagnoses, prescriptions or treatment decisions would have to meet stricter validation, monitoring and oversight requirements. High- and critical-risk systems would need risk management plans, bias assessments (systematic errors that can harm certain groups of patients) and incident protocols.

Human oversight would be mandatory. Patients could request that a professional review an automated decision affecting their care. Clinical robots could not perform diagnostic, therapeutic or surgical procedures autonomously without the direct and continuous supervision of a specialist physician. AI-generated clinical reports would have to be reviewed by people, and the text includes mechanisms to detect synthetic content and prevent falsified medical images or documents.

One of the most significant points is how liability is allocated. Providers would be liable for system design, data quality, updates and failures. Healthcare provider institutions (IPS) would be liable for selecting the tools, integrating them technically and monitoring them at the institutional level. The treating physician would not be liable for hidden defects, algorithmic errors or technical failures they could not reasonably detect. They would only be liable for use that is manifestly contrary to standards or to authorized indications.

Several stakeholders weighed in at the hearing. The Pan American Health Organization (PAHO) welcomed the fact that the text covers the entire lifecycle of systems, from design to retirement, though it asked for specific adjustments. The National Institute of Health (INS) and Adres asked for epidemiological surveillance and administrative functions to be included, such as early detection of outbreaks and of billing anomalies. Other participants proposed a principles-based law with technical details left to later regulations, validation on the Colombian population, representation of all health professions (including nursing) in governance, and controlled testing environments. The Senate said it would consider turning it into a framework law.

The landscape is fragmented. According to the Senate, more than ten AI bills are making their way through Congress. In the House, Bill 392 of 2026 is also advancing, on continuity of care when AI systems fail or degrade in critical clinical functions. It is awaiting a rapporteur’s report for its first debate, according to the Universidad de los Andes tracker cited by the source.

**Our take.** The bill’s best idea is not its list of prohibitions but its chain of liability. Today, when an algorithm fails, the temptation is to blame the doctor for having signed off, even if they could not have seen the defect. If the law exempts clinicians from undetectable errors and makes the provider and the IPS answer for their own part, incentives fall into place: whoever controls the design and the data bears the risk. That logic also helps doctors use the tool without fear.

The risk lies at the other end. A four-tier scheme with detailed requirements can become outdated within months if the text writes technical requirements into the law itself. That is why the proposal for a framework law with later regulations and testing environments strikes us as sensible. In general, health AI regulation works better when it is anchored in real clinical risk and backed by evidence, and worse when it regulates out of panic. Requiring validation on the Colombian population also matters: a model trained in other countries may perform worse with local patients.

In the short term, this will add friction and compliance costs, especially for startups and small hospitals. But AI-assisted medicine will only scale once trust is established, and that trust is built on human oversight, traceability and clear lines of responsibility. It is a precondition for early diagnosis and personalized medicine to reach more people safely in the long run. The open question is political: with more than ten bills running in parallel, the biggest danger is a regulatory tangle. Harmonizing them would be the best news to come out of this debate.