Brazilian Artificial Intelligence Act
Bill 2338/2023 establishing a risk-based national AI framework passed the Senate in December 2024 and remains in the Chamber of Deputies; two further AI bills were filed in February 2026. Brazil received an EU adequacy decision in January 2026.
| Jurisdiction | Brazil |
|---|---|
| Category | AI Regulations |
| Status | Proposed |
| Latest development |
Analysis
Key Requirements
The Brazilian Artificial Intelligence Act establishes several key requirements for AI development and use:
- Risk-based approach: AI systems are categorized into three risk levels: excessive risk (prohibited), high risk (heavily regulated), and other systems (basic requirements). Developers must conduct preliminary risk assessments to classify their AI systems.
- Transparency and explainability: AI systems must be explainable and auditable, with users having the right to prior information about AI decision-making processes.
- Human oversight: The law mandates effective human supervision throughout the AI lifecycle, including the right to human intervention in AI decisions.
- Algorithmic impact assessments: High-risk AI systems must undergo mandatory algorithmic impact assessments to evaluate potential threats to public safety, rights, or economic stability.
- Data protection alignment: The Act aligns with Brazil's General Data Protection Law (LGPD) to ensure privacy protection in AI systems.
Compliance Challenges
Organizations face several challenges in complying with the Brazilian AI Act:
- Risk classification complexity: Accurately categorizing AI systems into risk levels can be challenging, especially for novel applications. The Brazilian AI Bill provides limited guidance on this process.
- Balancing innovation and compliance: Companies must navigate the tension between rapid AI development and adhering to strict regulatory requirements. This challenge is highlighted in industry analyses of the Act's impact on Brazil's tech sector.
- Cross-border data flows: Ensuring compliance with both the AI Act and international data protection regulations presents challenges for multinational companies, as discussed in CIPL's analysis of the bill.
Implementation Best Practices
To effectively implement the Brazilian AI Act requirements, organizations should:
- Conduct comprehensive AI audits to identify all AI systems in use and assess their risk classifications under the new law.
- Develop clear internal policies that align with the AI Act's provisions, ensuring all AI applications adhere to ethical standards.
- Implement robust governance structures and internal processes to ensure system security and compliance with affected individuals' rights.
- Utilize regulatory sandboxes to test and refine AI systems in a controlled environment under regulatory oversight.
Recent Updates
The Brazilian AI Act is still in the legislative process:
- On December 10, 2024, the Brazilian Senate approved Bill No. 2338/2023, which sets out rules for developing and using artificial intelligence in Brazil.
- The bill now moves to the Chamber of Deputies for a vote before the President can sign it into law.
- If enacted, the law will take effect one year after publication, giving organizations time to adapt to the new requirements.
Related Regulations
The Brazilian AI Act interacts with several related regulations:
- Brazil's General Data Protection Law (LGPD): The AI Act aligns with LGPD to ensure consistent privacy protection across AI systems.
- EU AI Act: The Brazilian AI Act adopts a similar risk-based approach to AI regulation as the EU AI Act, though with some differences in specific requirements.
- Copyright laws: The AI Act interacts with copyright regulations, particularly regarding the use of copyrighted material for AI training.
Industry Impact
The Brazilian AI Act is expected to have significant impacts across industries:
- Tech sector: The Act may slow down AI innovation in the short term but is expected to foster more responsible and trustworthy AI development in the long run.
- Public sector: Government agencies will face stricter requirements for AI use, potentially affecting public services and decision-making processes.
- Financial services: The Act's provisions on high-risk AI systems will likely impact algorithmic trading and credit scoring systems, requiring more rigorous oversight and explainability.
Sources
- Brazil AI Act | Artificial Intelligence Act
- Brazil's AI Act: A New Era of AI Regulation - GDPR Local
- Law and technology in Brazil: trends, challenges, and opportunities
- CIPL Comments on Brazilian Senate Bill No. 2338
- Brazilian Senate Approves Artificial Intelligence Regulation
- Regulatory framework for artificial intelligence passes in Brazil's Senate
- Regulating AI and Copyright in Brazil: the stage of the game
- AI Watch: Global regulatory tracker - Brazil | White & Case LLP
- Article 11: Technical Documentation | EU AI Act - Securiti
- Brazil AI Project - Centre for Information Policy Leadership
Recent developments
- — Analysis of the current status of Brazil’s AI Bill PL 2338/2023 (“Marco Legal da IA”), noting that although it passed the Senate unanimously in December 2024, it remains in a special commission in the Chamber of Deputies with a floor vote now expected sometime in 2026 and no obligations in force yet.[7][9] (source)
- — Regulatory tracker update confirming that Brazil’s AI Bill (PL 2338/2023) was approved by the Federal Senate on 10 December 2024 and forwarded to the Chamber of Deputies in March 2025, where it is under special committee review with an EU‑style risk-based framework and no enactment date set.[9][6] (source)
- — Law firm briefing explaining that Bill No. 2338/2023 is the main AI legislative proposal, approved by the Senate and currently under review in the House of Representatives, highlighting possible amendments, phased implementation periods, and the absence of an official timeline for final approval.[3] (source)
- — Global AI regulatory tracker update describing Brazil’s proposed AI regulation (Bill No. 2,338/2023), its Senate approval in December 2024, pending scrutiny and vote in the House of Representatives, and key obligations such as risk classification, algorithmic impact assessments, and incident reporting for high‑risk and general‑purpose AI systems.[2] (source)
- — Overview of the Brazil AI Act following Senate approval, detailing the risk‑based approach (including prohibitions on “excessive‑risk” systems, stricter rules for high‑risk systems, and transparency requirements), alignment with Brazil’s LGPD, proposed supervisory authority, and penalties up to BRL 50 million or 2% of turnover.[1] (source)
- — Practice note from a Brazilian law firm situating Bill 2338/2023 within global AI regulation, emphasizing its EU‑inspired risk‑tiered framework, duties of transparency, explainability, and auditability for high‑risk systems, and anticipated compliance assessments including bias testing and security audits.[5] (source)
- — President Lula submitted a comprehensive **AI governance framework** to Brazil’s Congress, reviving and reshaping the Brazilian Artificial Intelligence Act debate with provisions on risk-based obligations, oversight structures, and enforcement powers.[7] (source)
- — Legal monitor report documenting that on 17 March 2025 the Federal Senate formally forwarded Bill No. 2338/2023 to the Chamber of Deputies, summarizing its 80 articles on AI use, classification, supervision, inspection, and copyright and outlining the remaining legislative steps before enactment.[6] (source)
- — Investigative article on industry and civil‑society reactions to Brazil’s proposed AI regulation, describing how specific provisions related to content moderation and child abuse material were criticized as potentially undermining online safety and noting that these controversial provisions were subsequently removed from the draft.[10] (source)
- — Policy commentary on the uncertain political future of Brazil’s AI law, discussing lobbying and strategic positioning by large technology companies, concerns about regulatory burdens, and the broader impact on Brazil’s ability to implement a robust, risk‑based AI framework.[4] (source)
- — Detailed analysis of the Senate committee’s AI report and draft law, outlining core principles (transparency, explainability, non‑discrimination, human oversight), the categorization of “high‑risk” systems, prohibitions on manipulative AI practices, mandatory risk assessments and security‑incident notifications, and proposed fines up to 50 million Reais or 2% of turnover.[8] (source)
Read the full guide to Brazilian Artificial Intelligence Act
Related regulations
- Internet Information Service Algorithmic Recommendation Management Provisions — China, Active
- National Artificial Intelligence Policy Bill — Chile, Active
- Artificial Intelligence Liability Directive — European Union, Active
- Federal Law on the Development and Use of Artificial Intelligence — Mexico, Active
- Presidential Regulation on the Framework for Artificial Intelligence Development — Indonesia, Active
- Law Establishing the Framework for the Development and Use of Artificial Intelligence — Peru, Active
- California Consumer Privacy Act AI Amendments — California, Active, effective 2020-01-01
- GPAI Framework for Responsible AI — AI Regulations, Active
Put it into practice
- Generate the policy: LGPD policy generator (generatepolicy.com)
- Buy the policy pack: Brazil LGPD Compliance Policy (cyberpolicy.shop)
- Build it yourself: GDPR & DPIA Compliance Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates