Brazil AI Regulation: What Companies Should Watch and Do Now

Brazil AI Regulation: What Companies Should Watch and Do Now

Brazil's AI legal framework is still, for the most part, a bill under debate in Congress: PL 2338/2023. That does not mean a legal vacuum. The LGPD (Brazil's data protection law), the Consumer Defense Code, the Civil Code and sector rules already apply to the AI systems your company uses today. The practical work is to separate what is already an obligation from what is still a proposal, and to prepare for the second without neglecting the first.

Key takeaways

• PL 2338/2023 proposes rules proportional to the risk level of each system, but it is a bill. Confirm its status on the official Senate and Chamber of Deputies pages before committing to any investment.
• The LGPD, the Consumer Defense Code, the Civil Code and sector rules already apply to AI, including the right to request review of decisions made solely through automated processing.
• Customer support, HR, credit and health are where legal risk appears first, because they involve personal data and decisions that affect people.
• NIST, the OECD and the European AI Act are useful method references, but none of them is a Brazilian legal obligation on its own.
• The best preparation is a living register of AI uses, with the data, permitted actions and an owner for each workflow. It will serve whatever the final text of the law says.

What is Brazil's AI legal framework, and where does the debate stand?

When people talk about an AI legal framework in Brazil, the main reference is PL 2338/2023, which originated in the Federal Senate. It aims to create general rules for the development, supply and use of artificial intelligence systems. After passing the Senate, the text moved to the Chamber of Deputies, where it can be amended, approved or rejected.

That leads to an important reading rule: any summary of a bill ages quickly. What we describe here is the general logic of the proposal, not a final text. To learn the current stage, search for the bill number on the Senate and Chamber websites, where the text, amendments and progress are published. For company decisions, treat this tracking as a recurring task for legal counsel or the data protection officer, not a one-time read.

In this article we separate three kinds of statements: what comes from official documentation (laws in force and public agency pages), what comes from implementation experience (how to structure controls in practice) and what is hypothesis (how the law may end up). When something is a hypothesis, we say so.

What is already an obligation today, without waiting for the new law

This is the part that most surprises business owners: the absence of a specific AI law does not suspend existing laws. In force today, among others:

• LGPD (Law 13.709/2018): applies whenever the system processes personal data, which is common in any support agent, resume screening tool or customer analysis.
• Consumer Defense Code: clear information, non-misleading advertising and supplier liability for service failures, including when support is automated.
• Civil Code: liability for damage caused to third parties.
• Marco Civil da Internet (Brazil's internet civil framework): rules on records, privacy and responsibility in digital environments.
• Sector rules: health, financial services, education and other areas have their own rules from regulators and professional councils, and these also reach the use of AI.

Within the LGPD, a few points deserve direct attention in AI projects. The principles in Article 6 (purpose, necessity, transparency, security, prevention, non-discrimination and accountability) work as design criteria. Article 20 gives the data subject the right to request review of decisions made solely through automated processing that affect their interests, along with information about the criteria used. The rules on international data transfer (Article 33 onward) matter when the language model runs outside the country. And the impact report provided for in Article 38 can be requested by the ANPD. To go deeper on this side, see LGPD and artificial intelligence: what companies should do and data protection impact assessments for AI projects.

The ANPD, Brazil's National Data Protection Authority, is the body to follow. Its official website gathers guidance, regulations and announcements that change what your company needs to document. It is worth reading its institutional page periodically.

What the bill proposes, and why it is still a hypothesis

The general design of PL 2338/2023, as the text left the Senate, follows a risk logic: the greater a system's potential for harm, the more requirements apply. In summary, and subject to change in the Chamber:

• Risk classification: uses of excessive risk would be prohibited, and high-risk uses would carry reinforced obligations.
• Rights of affected people: information about interacting with AI, explanation of decisions, the ability to contest and, in some cases, human review.
• Governance: documentation, risk management and impact assessment for higher-risk systems.
• Liability: rules on who answers for damage among those who develop, supply and operate the system.
• Oversight: an institutional arrangement for supervision, in which the ANPD appears with a coordinating role in the Senate text.

All of this should be read as a working hypothesis. Risk categories, adaptation deadlines, penalties and the design of oversight are exactly the points where a text tends to change during its passage. The prudent decision is not to bet on one version, but to build controls that stay useful in any version: know where AI is used, what data it touches, what decisions it influences and who can intervene.

How do international references fit into the conversation?

Anyone following the Brazilian debate will find constant comparisons with the European Union. The European AI Act also takes a risk-based approach. It is European law: it affects Brazilian companies only if they offer systems or services in the European market, which should be assessed case by case with legal advice.

There are also references that are not law but help organize the work:

• NIST AI Risk Management Framework: a voluntary structure for mapping, measuring and managing AI risks.
• OECD AI Principles: values such as transparency, robustness and accountability.

In our experience structuring projects, these documents are useful as a shared vocabulary between technical teams, legal counsel and leadership. But citing them in a contract or internal policy does not turn them into Brazilian legal obligations. They are good practice, and the difference should be clear on paper.

Checklist: how to classify each AI use in your company

A simple decision guide that you can apply today helps order priorities while the bill moves through Congress. For each AI use, answer:

• Does it process personal data? If yes, the LGPD already applies: legal basis, purpose, minimization and security.
• Does it process sensitive data, such as health, biometrics or racial origin? If yes, the level of care goes up and legal counsel should review before the pilot.
• Does it interact directly with customers or candidates? If yes, think about a notice that AI is involved, a channel to reach a person and conversation records.
• Does it make or influence decisions that affect rights, access or conditions (credit, hiring, pricing, collections)? If yes, treat it as a high-risk candidate: human review, documented criteria and the ability to contest.
• Does it take actions in systems (send a message, change a record, issue something)? If yes, define limits, human approval and a log of each action.
• Does it use a model provider abroad? If yes, check international transfer, data retention and use for training in the contract terms.
• Is there a named owner? Without an owner, no control holds.

The result is not a legal opinion, but a triage. Uses that answer yes to several items go to the front of the review queue with legal counsel and the data protection officer. For the technical side of limits, the article on guardrails for AI agents covers input, output and action controls.

Illustrative scenario: the clinic, WhatsApp and triage

Illustrative scenario, not related to any real company. A small clinic wants to use an AI agent on WhatsApp to confirm appointments and answer questions. In the triage above, it answers yes to: personal data, health data (if the patient describes symptoms), direct contact with customers and a model provider possibly located abroad.

Instead of waiting for the law, the clinic decides the following: the agent only confirms, reschedules and gives opening hours; any mention of a symptom or clinical request is handed to a person at the front desk; the patient is told at the start of the conversation that they are talking to an automated assistant; conversations are recorded with a defined retention period; and the supplier contract is read closely for international transfer and training on data. None of this depends on a new law, and all of it will help if the final law requires transparency, human oversight or risk documentation. For this kind of sector, it is also worth reading about health data and AI in clinics.

A five-step plan to prepare without waiting for the law

The method we use in AI projects fits well with regulatory management: map, limit, pilot and hand over. Applied to this topic, it looks like this:

• Map: take an inventory of every AI use, including informal ones, such as employees pasting customer data into public tools. A company policy for ChatGPT use is often the first document on that map.
• Classify: apply the checklist above and order by risk. Record the result in a simple spreadsheet with owner, purpose, data involved and supplier.
• Limit: for each use, define what the AI can see and what it can do. Less data and fewer permissions reduce both legal and operational risk.
• Pilot: run a real workflow with logs, an agreed success criterion and a clear handoff point to a human. The decision log is what lets you explain what happened if a data subject or a regulator asks.
• Hand over and review: give the operation to an internal owner, with a quarterly routine to review the register and the progress of the bill. At the end of each cycle, decide whether to expand, adjust or stop.

None of these steps requires predicting the final text of the law. They create evidence that the company knows what it operates, which is what any regime, current or future, will ask for first.

Signals to watch in the coming months

To keep the topic from turning into noise, set up a small radar:

• Progress of PL 2338/2023: changes to risk categories, adaptation deadlines and liability rules.
• ANPD publications: regulations, guides and positions on automated decisions and AI.
• Bodies in your sector: professional councils and sector regulators often publish their own rules before a general law.
• Supplier contracts: changes in terms on data retention, processing location and use of data for training.

One responsible person with a scheduled periodic review handles most of this. The most common mistake is treating the subject as a one-time event: someone reads a news item, a meeting discusses it and nothing changes in the process.

Frequently asked questions

Is there already an artificial intelligence law in force in Brazil? As far as the official sources we consulted indicate, PL 2338/2023 is the main bill and it is still moving through Congress, but you should confirm the current status on the Senate and Chamber websites. Even without a specific law, the LGPD, the Consumer Defense Code and the Civil Code already apply to the use of AI.

Does my company need an impact report to use AI? The LGPD provides that the ANPD can request a data protection impact report, and in projects involving sensitive data or decisions that affect people it is good practice even without a request. The decision to prepare one should go through the data protection officer and legal counsel, based on the type of data and the effect of the decision.

Does the European AI Act apply to Brazilian companies? It is European Union law and can reach those who offer AI systems or use their outputs in the European market. If your company serves customers in Europe, ask for a specific legal assessment. If it does not, the Act works only as a method reference.

Do I need to stop AI projects until the law is approved? There is no reason to, as long as the project respects the laws already in force and has clear limits on data and actions. The safest path is to start with a lower-risk workflow, with records, human review and a defined owner, and adjust as the legal text advances.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• EU Artificial Intelligence Act overview
• NIST AI Risk Management Framework
• OECD AI Principles