Colombia Counted 346 Credit AI Models. Governance Is the Real Split.

Colombia's financial supervisor found 346 artificial-intelligence or machine-learning models in use across 38 credit institutions. The count is less revealing than the control problem behind it.

The Superintendencia Financiera de Colombia study requested information from 47 supervised credit institutions with active loan portfolios in March 2025. Thirty-eight reported using AI or machine learning in origination, account monitoring or collections. The regulator then examined 91 representative models in a more detailed survey.

Those are different populations. The 346-model inventory describes adoption, while the 91-model sample exposes how selected systems were built, supplied with data and documented. Mixing them would turn a useful supervisory snapshot into false precision.

The detailed survey was not a second census. Institutions supplied information on the model judged most representative at each credit stage. Its percentages describe those 91 systems, not all 346 models. They cannot establish how every lender governs every model, nor can they support a national performance ranking. They can show where a supervisor should ask the next question.

Problem: the label hides the control surface

The study uses a broad AI or machine-learning definition. Decision trees represented 47.9% of the inventory and logistic regressions another 34.9%. Generative AI accounted for 4.0%.

That classification will invite an argument over whether logistic regression deserves an AI label. It is the least important argument in the report. A familiar statistical method can still be poorly documented, fed by weak data or maintained by a vendor that the lender cannot properly challenge. A newer architecture can be tightly bounded and well monitored.

Model type affects validation. It does not replace validation.

Analysis: conventional models dominate by design

The SFC publishes shares for five model types in the full inventory: 47.9% decision trees, 34.9% logistic regression, 4.0% generative AI, 2.9% clustering and 2.0% chatbots or virtual assistants. It separately records five deep-learning models and a 287-model supervised subtotal spanning trees, regression and time-series methods. The report does not publish exact integer counts for trees, logistic regression or time-series models, nor a percentage for deep learning. It also excludes 23 “other” responses from the type classification. Rounded shares cannot supply the missing integers, so the chart plots only the five published percentages and is not exhaustive.

The published shares are not evidence that lenders are technologically timid. Credit models must be explainable enough to validate, monitor and contest. Trees and logistic regressions remain useful because their inputs and outputs can be traced more readily than those of many deep neural systems. Interpretability is an operating constraint, not a museum piece.

Nor does the generative-AI count show that large language models approve loans. The cases described by the SFC centre on transcribing and classifying collections calls, reviewing contracts, extracting information and checking documents against internal policies. These uses sit near credit operations. They are not proof that a model sets a borrower's limit, rate or approval outcome.

The deployment map is broad. The inventory placed 139 models in origination, 108 in monitoring and 99 in recovery. Governance therefore has to follow a model across the credit life cycle. A model used to prioritise collections calls presents a different risk from one used to estimate default probability, even if both sit under the same AI heading.

The detailed sample reveals the harder split

Architecture is visible. Accountability is harder to chart.

In the 91-model detailed survey, about 40% of models were developed by external providers. That does not establish weak oversight. It identifies where oversight must cross an organisational boundary.

A lender can outsource development. It cannot outsource responsibility for data definitions, validation evidence, version changes and performance monitoring. The useful supervisory questions are practical: Can the institution reproduce the model's results? Can it test performance after a data shift? Does it know when the vendor changes code, features or thresholds? Can internal reviewers challenge the model without relying on the supplier's own assurance?

Data provenance creates a second boundary. Internal data appeared in 86.8% of the detailed sample and credit-bureau data in 61.5%. Those shares overlap because models can combine sources. The governance task is to preserve lineage across that join: which record came from where, under what definition, on what date, and with which correction process.

Documentation creates a third boundary. Some 57.1% of the detailed models were trained on more than 100,000 records, while 16.5% lacked detailed information on training-base size. Dataset size alone says little about representativeness or model quality. Missing even that basic descriptor makes replication, sampling and change review harder.

These boundaries form the more useful inventory. An internally built model using internal data leaves ownership inside the institution. A vendor model using bureau data crosses both a supplier boundary and a data boundary. Each crossing adds contracts, access rights and evidence that validators must inspect. The study does not publish that cross-tabulation, so it cannot show whether external development and incomplete documentation cluster in the same models.

The gap is evidence of incomplete documentation in the survey, not evidence of consumer harm. The study does not measure approval disparities, pricing effects, false declines or borrower outcomes. Architecture cannot fill those blanks.

Implications: supervise the handoffs

The next supervisory step is not a contest between conventional statistics and generative AI. It is a control map.

For each model, institutions need an accountable owner, a documented purpose, data lineage, independent validation, monitoring thresholds and a record of material changes. Externally built models need the same controls plus access rights that let the institution inspect and challenge what it bought. Models using several data sources need evidence that definitions and corrections survive the join.

The SFC calls its report an informational and academic document. Its findings and proposals do not constitute an official policy position. That caveat matters. The study is a baseline, not a rulebook or an enforcement finding.

It is still a useful baseline. Colombia's lenders have already moved AI and machine learning into every stage of credit management. The governance divide now runs between models an institution can explain, reproduce and challenge, and models it merely possesses.