Brazil's Customer Service Decree: What Chatbots and AI Must Do

Brazil's Customer Service Decree: What Chatbots and AI Must Do

Decree No. 11.034 regulates the SAC (Serviço de Atendimento ao Consumidor, Brazil's customer service channel rules) under the Consumer Defense Code. If you are researching how the Brazil customer service decree treats chatbots and AI, the short answer is that it does not prohibit either one. It requires that the channel actually solve the consumer's problem, give access to a human, log the contact with a protocol number, and handle requests such as cancellation without creating barriers. If your company automates customer service, what needs review is the design of the flow, not the technology itself.

Key takeaways

• The decree applies to the customer service of providers of services regulated by the federal government, but the Consumer Defense Code applies to every provider and serves as a reference for everyone else.
• Automation is allowed. Trapping a consumer in a flow with no exit to a human agent is the central risk.
• Protocol numbers, service history, and not forcing customers to repeat their problem are requirements an AI agent has to respect in practice.
• Cancellation requests are treated strictly: the agent cannot delay them, divert them, or make them conditional on a retention conversation.
• Before putting AI live, map the flow, limit what the agent decides, test with logs, and guarantee transfer to a person.

What the decree regulates and who must comply

Decree No. 11.034 sets guidelines and rules for the customer service of providers of services regulated by the federal government. That group includes sectors such as telecommunications, financial services, health plans, energy, and air transport, among others under federal regulation. The official text is on the Planalto government portal, and reading it directly is the starting point for this article.

If your company is not regulated at that level, the decree may not apply to you directly. Even so, the Consumer Defense Code applies to any provider, and the decree works as a picture of what the government considers minimally respectful service. Treating it as a good-practice reference is a prudent decision even when the formal obligation is unclear. Confirming how it applies to your case is a job for a lawyer, and this article is not legal advice.

This article keeps three layers separate, as is our editorial policy: what is in the official rule, what comes from experience implementing automated customer service, and what is a working interpretation. When something is interpretation, we say so.

What does the decree say that affects automated customer service?

From the official text, these are the points that most affect a chatbot or AI agent. Confirm the exact wording and deadlines in the relevant articles, because numbers and conditions change depending on the channel and the type of request.

• Access to a human agent: the decree covers the consumer's contact with an agent, including rules on the electronic menu in the phone channel, so that people are not stuck in automated options.
• Records and protocol: each contact must generate a protocol number, and the consumer can ask for the history of what was handled.
• Continuity: the consumer should not have to repeat the request at every transfer or change of agent.
• Resolution: there is a deadline to resolve and respond, and the response has to address what was asked.
• Cancellation: a cancellation request must be received and processed without obstacles, and the decree covers its effects and the confirmation sent to the consumer.
• Clear information: the consumer must understand what is happening, in plain language and without hiding the right channel.

None of these points mention technology. They describe outcomes for the consumer, which is why they apply equally to a human agent, a voice menu, or an AI agent on WhatsApp.

How does this translate to a chatbot or AI agent?

This is the interpretation layer, based on how these flows are usually built. In an AI agent, each requirement becomes a design rule.

Access to a human becomes a permanent exit route. The consumer should be able to ask for a person at any moment, in natural language, without going through three triage questions first. Phrases like "I want to talk to an agent" must be recognized reliably and treated as a transfer instruction, not as one more message to answer.

The protocol becomes a record generated at the start and handed to the customer inside the conversation. The agent should store the history in a system the human agent can consult, so the transfer carries context with it.

Not repeating the request becomes a handoff requirement. The transfer should give the human a summary of the reason for contact, the data already confirmed, and what the agent tried. If the human agent starts by asking everything again, the flow has failed.

Cancellation becomes its own intent class with dedicated handling. The agent identifies the intent, does not try to persuade beyond what the rule allows, and routes the request to the process that records and confirms it. Offering an alternative can be legitimate, as long as it does not block or delay the request. Review that boundary with your legal team.

If you are deciding what to automate and what to keep with people, AI customer support: what to automate and what to keep human breaks down the split by type of request.

Illustrative scenario: a cancellation request on WhatsApp

Imagine, as an illustrative scenario, a regulated-service company that handles customers on WhatsApp with an AI agent. The customer writes: "I want to cancel my plan."

A problematic flow replies with a menu of offers, asks for three pieces of data before acknowledging the request, and, when the customer insists, repeats the menu. The consumer concludes the channel will not solve anything and leaves the conversation with no protocol and no confirmation.

A safer flow recognizes the intent to cancel in the first message, gives the protocol number, asks only for the data needed to identify the contract, and routes the request to the cancellation process. If the company wants to present an alternative, it does so in one sentence and makes clear the request remains registered. If the customer asks for a person at any point, the conversation is transferred with a summary, without making them start over.

The difference is not the AI model. It is the flow rules and what the agent is authorized to do.

Checklist to review your automated customer service

Use this list to audit an existing chatbot or agent, or to specify a new one. Each item should have a clear answer and evidence (a test conversation, a log, or a configuration).

• Is there a phrase or button that leads to a human at any point in the conversation, and does it work when tested with language variations?
• What happens outside the hours when agents are available? Is the consumer told what to do and when they will be helped? (see after-hours customer service with AI)
• Is the protocol generated at the start and delivered to the customer in the conversation itself?
• Is the history accessible to the human agent, and can it be provided to the consumer on request?
• Does the transfer send a summary and already-confirmed data, without requiring repetition?
• Is the cancellation request its own intent, with a direct path and a confirmation?
• Is the agent forbidden from stating deadlines, amounts, or decisions that are not in an official company source?
• Is the personal data requested the minimum necessary, with a legal basis and information to the data subject as required by LGPD (Brazil's data protection law)?
• Are the agent's decisions logged (what it answered, what it transferred, and why) for audit?
• Is it defined internally who is responsible for flow failures and, if there is a vendor, in the contract?

What risks does AI add to customer service?

Beyond the decree's requirements, an AI agent brings its own risks that affect compliance.

The first is the invented answer. A model can state a contract condition that does not exist. In customer service, that creates false expectations and can turn into a formal complaint. The mitigation is to limit the agent to approved sources and make it transfer when there is no basis to answer. The article on guardrails for AI agents shows how to validate input, output, and action.

The second is excess insistence. Poorly written prompts can make the agent try to retain the customer or repeat the same offer. Explicit priority instructions (the customer's request comes first) and tests with difficult conversations reduce this behavior.

The third is data handling. Support conversations contain personal data, and LGPD applies. The ANPD (Brazil's national data protection authority) is the official reference for guidance. If an AI vendor processes the conversations, it is worth understanding the controller and processor roles, the subject of data controller vs processor in an AI vendor contract.

The fourth is the record-keeping gap. If the agent decides without leaving a trace, the company cannot demonstrate what happened in a dispute. Decision logs are part of the design, not an extra.

How to apply it: map, limit, pilot, and transfer

The method we use to deploy support agents fits these requirements well.

Map: survey the current customer service flow, the channels, the request categories, and what people already handle. Without that picture there is no baseline to tell whether automation made something better or worse.

Limit: define what the agent can answer, what data it can ask for, and what actions it can take. Cancellation, disputes, and formal complaints generally become fast-routing categories, not free conversation.

Pilot: run a real flow, with logs and an agreed success criterion, for example time to reach a human when requested and the share of conversations that required repetition. To measure it, the guide on how to measure an AI automation pilot offers metrics and decision gates.

Transfer: guarantee the handoff with context, then decide, with evidence, whether the flow expands, gets adjusted, or stops.

Step by step to adapt your flow in a few weeks

• Read the official text of the decree with your legal team and list the articles that apply to your sector.
• Inventory your customer service channels (phone, WhatsApp, website chat, social media) and mark where automation exists.
• Choose one moderate-risk flow for the pilot and one high-risk flow (such as cancellation) to handle with strict rules.
• Write the rules for transfer to a human and test them with real, anonymized conversations.
• Configure the protocol and history, and confirm the human agent can see them.
• Run the pilot with decision logging and review the conversations that ended in abandonment.
• Document what was decided and who approves future changes, including changes to the agent's instructions.

To follow the broader regulatory context on AI, also read Brazil AI regulation: what companies should watch and do now.

Frequently asked questions

Does the customer service decree prohibit chatbots? No. The text regulates the outcome of the service, such as access to a human, protocol numbers, and handling of requests, and it does not forbid automation. What matters is that the chatbot does not stop the consumer from being helped and from resolving what they need.

Must my business follow the decree even if it is not regulated? The decree applies to the customer service of providers of services regulated by the federal government. If you are not in that group, the Consumer Defense Code still applies, and following the decree as a good-practice reference reduces risk. Confirmation of how it applies to you should come from legal advice.

Can the AI agent try to retain a customer who wants to cancel? It can present an alternative briefly, as long as that does not delay, condition, or complicate the request. The request must be registered and confirmed to the consumer. Where the line sits between a legitimate offer and an obstacle is a question to review with your legal team and test in real conversations.

Where should I start reviewing what already exists? Start with the exit route to a human and the transfer with context, because those are the points where failure is most visible to the consumer. Then handle cancellation, protocol numbers, and decision logging. A small pilot with logs quickly shows where the flow traps the customer.

Sources

• Planalto: Decreto nº 11.034/2022 (SAC)
• Planalto: Lei nº 8.078/1990 (Código de Defesa do Consumidor)
• ANPD: Autoridade Nacional de Proteção de Dados