Brazil ANPD Artificial Intelligence Guidance: What Already Applies

Brazil ANPD Artificial Intelligence Guidance: What Already Applies

As far as official sources show, Brazil's data protection authority (ANPD) does not yet have a single, complete rule dedicated only to artificial intelligence. Even so, it already guides the topic: it applies the LGPD (Brazil's General Data Protection Law) to AI systems, publishes general-purpose guides and regulations, and acts in concrete cases involving personal data used to train or operate models. For a company, this means that using AI with personal data already requires a legal basis, transparency, security and the possibility of human review.

Key takeaways

• The LGPD already applies to any AI that processes personal data, with or without an AI-specific rule.
• The ANPD guides through general regulations and guides (legitimate interest, security incidents, the data protection officer, security) that apply to AI projects.
• Automated decisions that affect people call for transparency and a right to review, under art. 20 of the LGPD.
• AI-specific rules depend on the legislative debate and future regulation, and that is still hypothesis.
• The safe path is to map data, limit what the AI can access, pilot one flow with logging, and check the official source before deciding.

How to separate existing guidance from hypothesis

A lot of online content mixes what the authority has said with what the author expects it to say. To decide well, it helps to separate three layers.

The first is the law and regulation in force: the text of the LGPD and the regulations the ANPD has published. This is obligation. The second is the authority's guidance and activity: guides, technical studies, public consultations, enforcement measures and announcements. This shows how the ANPD interprets the law and deserves heavy weight, but each document has its own scope. The third is hypothesis: what may come from bills, from comparisons with other countries, or from the author's own reading. This is useful for planning, not for claiming compliance.

In this article, anything from the third layer is marked as hypothesis. One note on method: the list of ANPD publications changes. Before using any item as the basis for a decision, check the official ANPD website and read the original document.

What the LGPD already requires of an AI system

The law does not mention artificial intelligence by name, but it regulates the processing of personal data, and that is exactly what AI does when it receives a customer message, a resume or a document. Several points apply directly.

• Principles in art. 6: purpose, adequacy, necessity, transparency, security, prevention, non-discrimination and accountability. They weigh on every AI project.
• Legal basis under art. 7 (and art. 11 for sensitive data): you need to know which basis supports each use. Saying the AI is just a tool is not enough.
• Legitimate interest (art. 10): it can serve as a basis in some cases, but it requires a documented assessment and respect for the data subject's expectations.
• Impact report (art. 38): the ANPD can request one, and it is worth having it ready when the AI use carries higher risk for the data subject.
• Security (art. 46): the AI's access to data must be limited and protected against misuse.
• Data subject rights (art. 18) and review of automated decisions (art. 20).

Note that none of these items depends on a new rule. If an AI agent on WhatsApp stores conversations with names, phone numbers and health data, the obligation exists today.

What the ANPD has already published and done that touches AI

The authority has general-purpose materials that apply to AI projects even when the title does not mention the term. The ones that tend to be relevant include the legitimate interest guide, the regulations on security incident reporting and on the data protection officer role, the regulation for small-scale processing agents, and the information security guides. Anyone using AI with personal data should read these documents as part of the project, not as a separate subject.

The ANPD has also acted directly on AI topics. It has taken a position in a case involving the use of a platform's users' personal data to train AI models, with preventive measures, which shows the kind of concern the authority has: an adequate legal basis, clear information to the data subject, and easy ways to exercise rights such as objection. The authority has also recorded dialogue initiatives with society on AI and data protection, such as public consultations and regulatory sandbox projects. The details, status and scope of each one should be read at the official source, because they can change and because each case has its own facts.

What you can conclude safely is limited but useful: the ANPD treats AI as one more form of data processing and expects the same foundations of the law, with attention to transparency, legal basis and risk to the data subject. You cannot conclude, from a single case, that it works as a general rule for every company.

Automated decisions and the right to review

Art. 20 of the LGPD gives the data subject the right to request review of decisions made solely on the basis of automated processing that affect their interests, including decisions meant to define a personal, professional, consumer or credit profile. The law also provides that the controller must supply clear and adequate information on the criteria and procedures used, subject to commercial and industrial secrecy.

In practice, this matters in uses such as candidate screening, credit analysis, customer prioritization and automatic refusals of service. An assistant that only drafts a reply for a human to approve is in a different situation, but that depends on who actually decides. To go deeper on the article and on how to structure the review, see LGPD automated decision-making and the right to review.

What is still hypothesis

Separating what is not settled prevents hasty decisions. The points below are hypotheses or open topics, not confirmed obligations.

• That the ANPD will play a coordinating role in a national AI regulation system. This depends on the final text of a future law, and the legislative debate continues. Follow the topic in Brazil AI regulation: what companies should watch and do now.
• That there will be specific rules on training models with personal data beyond what already follows from the LGPD.
• That the authority will publish formal documentation requirements for high-risk AI systems.
• That reference models from other countries, such as the European AI law and the NIST AI Risk Management Framework, will influence the Brazilian position. They are good risk management references, but they are not ANPD requirements.

Treat these items as a radar, not as a compliance checklist. The safe action today is to comply well with the LGPD and document your decisions.

Practical plan: apply what already holds to your AI project

A simple roadmap that fits a small project and a company of any size.

• List the flows where AI touches personal data: support, sales, HR, collections, helpdesk. Note which data goes in and which comes out.
• Define the purpose and legal basis of each flow. If it is legitimate interest, record the assessment.
• Cut the excess: the AI should only receive the data it needs. Sensitive data, documents and children's data require extra care.
• Check the contract and terms of the model provider: where the data is processed, whether it is used for training, how long it is retained and who acts as processor.
• Define who decides: does the AI only suggest, or does it decide on its own? If it decides something that affects a person, design the human review.
• Tell the data subject clearly that they are talking to an AI and how to ask for a human or exercise their rights.
• Record logs of actions and decisions with restricted access, and have an incident response plan aligned with the ANPD regulation.
• Review the flow on a regular schedule and whenever the provider, the model or the purpose changes.

If your team already uses chat tools on its own, start with an internal rule. The article on company policy for employee ChatGPT use helps define what to allow and what to ban. When the data is too sensitive to leave your infrastructure, running a local model can be an option to evaluate, without removing the other obligations.

Illustrative scenario: AI in a clinic's customer service

Imagine a small clinic that wants an AI agent on WhatsApp to confirm appointments and answer questions about opening hours. This is an illustrative scenario, not a real client.

The data map shows name, phone number, appointment date and, sometimes, messages in which the patient describes symptoms. The phone number and time are necessary for the flow. The symptoms are health data, which is sensitive, and the agent does not need them to confirm a time slot. The decision to limit is clear: the agent is instructed not to collect or record symptom descriptions and to hand those cases to a person at the front desk.

The patient is told they are talking to an automated assistant and can ask for human service at any time. The agent does not reschedule or cancel without clear confirmation, and every action is logged. The model provider is assessed for data retention and use. The clinic picks one flow, measures the result against an agreed criterion, and only then decides whether to expand. None of this requires a new ANPD rule: it is the LGPD applied with discipline.

How the map, limit, pilot and hand over method fits

Juan Carlo's working method follows the same logic as the obligations above. Mapping means surveying the current process and the data involved, which supports purpose and legal basis. Limiting means restricting the AI's data and actions, which answers necessity and security. Piloting means testing one real flow with logs and an agreed metric, which produces evidence of accountability. Handing over means delivering the operation with documentation, so the company can decide whether to expand, adjust or stop.

This does not replace legal advice or reading the official sources. Questions about legal basis, impact reports and contracts should go through whoever carries legal responsibility for the company, such as the data protection officer and legal counsel.

Frequently asked questions

Does the ANPD already have a specific rule on artificial intelligence? As far as official sources indicate, there is no single, complete rule dedicated only to AI. The ANPD applies the LGPD, its general regulations and its actions in concrete cases. Always check the official website to see whether anything new has been published.

Do I need consent to use AI with customer data? Not necessarily. Consent is one legal basis, but there are others, such as contract performance and legitimate interest, each with its own requirements. The central point is to have an adequate basis for each purpose and to inform the data subject clearly. The choice should be validated with legal counsel or the data protection officer.

Does an AI agent on WhatsApp need to say it is an AI? The LGPD requires transparency about processing, and saying the service is automated is consistent with that principle and with the right to request review of automated decisions. Even if a specific case does not require an express notice, giving one reduces risk and confusion. Also leave a simple path to reach a person.

What if the model provider uses the data for training? Read the contract and privacy settings to see whether training is active and whether it can be turned off. Assess whether that use has a legal basis and falls within what the data subject expects. If it is unclear, reduce the data you send, choose another plan or provider, or use an alternative that keeps the data under your control.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications