Brazil intends to regulate AI through Bill No. 2,338/2023 ("Brazil's Proposed AI Regulation"), although there are currently no specific codified laws, statutory rules or regulations in Brazil that directly regulate AI.¹

When Brazil's Proposed AI Regulation will come into effect, and what its final text will entail, remains unclear. Although the Federal Senate approved Bill No. 2,338/2023 in December 2024, the proposal must still be scrutinized and voted on in the House of Representatives, before being approved by the president, and so, the details remain subject to change. There is currently no expected date for the next developments in the legislative procedure.

There are various laws that do not directly seek to regulate AI but may affect its development or use in Brazil. A non-exhaustive list of key examples includes:

Intellectual property laws may affect several aspects of AI development and use.

Given Brazil's Proposed AI Regulation is not yet law, there is currently no legally recognized definition of AI in Brazil.

Nevertheless, the latest version of Brazil's Proposed AI Regulation defines an AI system as "a machine-based system that, with varying degrees of autonomy and for explicit or implicit objectives, infers, based on a set of input data or information it receives, how to generate outputs, in particular, predictions, content, recommendations, or decisions that may influence virtual, physical, or real environments."⁵

Brazil's Proposed AI Regulation currently has a broad territorial scope. Based on the current draft, it will apply to the development, deployment, and use of AI systems within Brazilian territory, without making a distinction between national and foreign entities.

Brazil's Proposed AI Regulation does not currently adopt a sector-specific focus. Based on the current draft, it will apply to the development, deployment, and use of AI systems irrespective of sector.

Brazil's Proposed AI Regulation will introduce obligations for the following AI system agents:

Brazil's Proposed AI Regulation aims to protect fundamental rights and ensures the implementation of secure and reliable systems for the benefit of the human person, the democratic regime, and scientific and technological development.

Brazil's Proposed AI Regulation categorizes AI systems according to different levels of risk:

Every AI system shall undergo a preliminary risk classification conducted by the developer or deployer to determine whether it qualifies as an excessive-risk, high-risk, or other AI system. For high-risk and general-purpose AI systems, an algorithmic impact assessment must be undertaken prior to the AI system being placed onto the market or put into operation.¹¹

Brazil's Proposed AI Regulation aims to establish a detailed approach to compliance requirements. By way of an example, Brazil's Proposed AI Regulation currently requires:

AI system developers and operators must also establish governance structures and internal processes capable of ensuring the security of systems and compliance with the rights of affected individuals, which shall include, at least:

In addition, AI system developers and operators of high-risk AI systems must adopt the following governance measures and internal processes:

Brazil's Proposed AI Regulation designates the National Data Protection Authority (ANPD) as the competent authority responsible for coordinating the National System for the Regulation and Governance of Artificial Intelligence (SIA), within the scope of the Federal Public Administration. The ANPD will oversee the implementation of the regulation and cooperate with sectoral authorities.¹⁵

Pursuant to Brazil's Proposed AI Regulation, the competent authority will have a range of enforcement measures to consider. Specifically, the competent authority may:

• Prohibit or restrict: (i) the AI system from participating in the regulatory sandbox regime provided for in Brazil's Proposed AI Regulation, for up to five years; or (ii) processing from certain databases.
• Suspend the development, supply, or operation of the AI system on a partial or total, and temporary or permanent, basis.

Additionally, as a general rule in Brazil, individuals and legal entities that violate the law and cause harm to others, whether material or moral, may be ordered by a court to pay compensation.¹⁶

1 See Brazil's Proposed AI Regulation here. It was approved on December 10, 2024.
2 See the Brazilian Data Protection Law here.
3 See Law No. 8,078/1990 here.
4 See Law No. 9,610/1998 here.
5 See Article 4, I of Brazil's Proposed AI Regulation here.
6 See Article 4, V of Brazil's Proposed AI Regulation here.
7 See Article 4, VI of Brazil's Proposed AI Regulation here.
8 See Article 4, VII of Brazil's Proposed AI Regulation here.
9 See Article 13 of Brazil's Proposed AI Regulation here.
10 See Article 14 of Brazil's Proposed AI Regulation here.
11 See Articles 12 and 25 of Brazil's Proposed AI Regulation here.
12 See Articles 25 and 42 of Brazil's Proposed AI Regulation here.
13 See Article 17 of Brazil's Proposed AI Regulation here.
14 See Article 18 of Brazil's Proposed AI Regulation here.
15 See Article 45 of Brazil's Proposed AI Regulation here.
16 See Article 50 of Brazil's Proposed AI Regulation here

Laura Bottega Eskudlark (Associate, Pinheiro Neto Advogados) contributed to this publication.