Officials said 41 others were injured in the blast, which occurred outside the General Santander National Police Academy.
A high-ranking police official told CNN that the explosion appeared to be the result of a suicide attack.
Police said the driver rammed the vehicle into the grounds of the police academy at full speed and ignored calls to stop. The driver is presumed to have died in the blast, but it is unclear if authorities are counting the attacker in the death toll.
CNN affiliate Cablenoticias showed the area outside the police cadet school cordoned off by Colombia’s National Police.
President Ivan Duque condemned the attack as terrorism and vowed to bring the perpetrators to justice.
He later visited the scene, where he spoke from the police academy and ordered the police and armed forces to “determine who the people behind this vile attack are.”
After the President spoke, Attorney General Nestor Humberto Martinez identified “the material author of the attack, a man named Jose Aldemar Rojas Rodriguez, who was driving the car that entered the academy.”
Martinez said Rojas Rodriguez reportedly had about 80 kilograms of explosives.
Both Duque and the attorney general said an investigation is underway to identify any others behind the attack but did not provide further details.
The US Embassy earlier issued a warning on its official Twitter account to Americans in Bogota, referring to a “security incident” and advising people to monitor local media and police sources for more information.
CNN en Español’s Ana Melgar and Fernando Ramos, CNN’s AJ Davis and journalist Stefano Pozzebon contributed to this report.