Brazil AI Bill PL 2338: What It Means for Companies and What to Do

Brazil AI Bill PL 2338: What It Means for Companies and What to Do

Brazil's AI legal framework is being debated in Congress through Bill PL 2338. It proposes rules by risk level, rights for people affected by AI systems, and governance duties for anyone who develops or uses them. Until the text becomes law, the LGPD (Brazil's General Data Protection Law), the Consumer Defense Code and sector rules already apply. This article summarizes the parts of the bill that matter to companies, shows where to check its current stage at the official source, and lists what you can prepare now.

A note on method: we separate what comes from official documentation (the text and its legislative progress), what is practical implementation experience, and what is a working hypothesis. The text can change at every stage. Before deciding anything based on this summary, read the current version of the proposal and get legal validation.

Key takeaways

• The bill follows a risk logic: the greater the potential impact on people, the more duties the company carries.
• Some excessive-risk practices would be prohibited, and a high-risk category would carry duties of assessment, documentation and human oversight.
• People affected by decisions from AI systems would have rights to information, explanation, contestation and review, closely aligned with the LGPD.
• Enforcement coordination is associated with a governance system involving the ANPD (Brazil's data protection authority). Confirm this in the current text.
• You can prepare without waiting: a system inventory, internal risk classification, decision records and a usage policy.

Where the bill stands and how to check its current stage

PL 2338 originated in the Federal Senate and, according to its legislative record, moved on to the Chamber of Deputies. Because the stage changes often (committees, rapporteurs, amendments, votes), do not rely on third-party summaries, this one included, to know where the bill stands today.

The path to check the primary source is short:

• On the Senate website, search for the bill by number (PL 2338) and read the summary, the author, the legislative history and the most recent text.
• On the Chamber of Deputies website, open the legislative proposals area, search for the same number and check whether it has its own numbering, a rapporteur, committees and opinions.
• Compare the date and version of the text you are reading with the last recorded movement. Committee opinions and substitute texts can differ from what was approved earlier.
• Record the version you read and the day you checked in your internal material. This prevents the company from deciding based on an outdated text.

If the proposal becomes law, there will still be adaptation periods and regulation to follow. This matters for planning: the formal obligation may come later, but the habits it requires take time to build.

How the bill classifies systems by risk

The core design, according to the text that passed the Senate, is classification by risk. In broad terms:

• Excessive risk: uses the bill intends to prohibit, such as certain forms of behavioral manipulation or exploitation of the vulnerabilities of specific groups.
• High risk: systems used in sensitive areas, such as decisions on access to credit, hiring and people management, health, safety and essential services. Check the exact list in the current text.
• Other systems: subject to lighter duties, such as transparency and good practices.

The bill also provides for a preliminary assessment to identify the risk level before a system goes into use, and pays specific attention to general-purpose and generative models. Details vary between versions, so treat this list as a reading map, not a substitute for the text.

A useful comparison is the European Union's AI regulation, which also organizes obligations by risk. It does not apply in Brazil, but it helps in understanding the logic. The official overview site at artificialintelligenceact.eu is a good starting point.

What changes for companies that use AI but do not build it?

Most Brazilian companies do not train models. They buy tools, connect a model to customer service or a CRM, and build workflows. The bill distinguishes the agents in the chain (developer, supplier, deployer), and whoever puts the system into operation usually has duties of their own, even without having created the model.

In implementation practice, this means a company that uses AI needs to be able to answer a few simple questions:

• Which AI systems are in use, and for what purpose?
• What personal data goes in and out of each one?
• Who decides when the AI is wrong or does not know?
• Is there a decision with a relevant effect on a person, such as credit, hiring, cancellation or access to a service?
• Is there enough record to explain what happened in a specific case?

This is a working hypothesis, not a legal reading, but companies that already have these five points documented tend to reach any final version of the framework in a better position. A WhatsApp assistant that only answers questions about opening hours and order status sits at a different risk level than a workflow that approves or denies something for the customer.

Rights of affected people and the link to the LGPD

An important block of the bill covers the rights of people affected by AI systems: being told they are interacting with a system, receiving an explanation of decisions, contesting them and asking for human review when the effect is relevant, plus protection against discrimination.

Anyone familiar with the LGPD will recognize the pattern. The law already gives people the right to request review of decisions made solely through automated processing, and the bill reinforces and details that line. To understand what already applies today, read LGPD automated decision-making and the right to review.

Another point that is already reality and will remain so: if your model provider processes data outside Brazil, the LGPD requires care. The article on international data transfer when using AI providers details what to verify. The AI framework does not replace that analysis, it adds to it.

What to prepare without waiting for the law

Nothing here depends on the bill being approved. These are practices that already reduce risk under the LGPD and the Consumer Defense Code. A plan in steps, in the order that usually works:

• Step 1, inventory: list every use of AI in the company, including informal use, such as employees using chat assistants with customer data. A company policy for employee ChatGPT use helps bring that use into the open.
• Step 2, internal classification: for each use, note whether personal data is involved, whether a decision affects someone, and whether a human reviews it. Use three simple levels: informational, operational, decisional.
• Step 3, limits: define what the system can and cannot do, which tools and data it can access, and when it hands off to a person.
• Step 4, records: keep logs of inputs, responses, actions taken and handoffs to humans, with a defined retention period and restricted access.
• Step 5, contestation channel: make sure customers or employees can ask for human review and know how.
• Step 6, owner and routine: name who is accountable for the system and schedule periodic quality and risk reviews.
• Step 7, follow-up: set a fixed moment, for example each quarter, to recheck the bill's progress on the Senate and Chamber pages.

For a reference on risk management structure, NIST publishes a voluntary framework used internationally that organizes the subject into governance, mapping, measuring and managing functions. It is not Brazilian law, but it gives you vocabulary and a roadmap.

If AI is also used to track people's performance, read how to measure AI productivity without surveillance on your team, because people management often falls into sensitive areas.

Illustrative scenario: two companies, two risk levels

Illustrative scenario, unrelated to any real company. A building materials store uses a WhatsApp agent to share opening hours, delivery status and duplicate payment slips, handing off to a human when the customer complains. Another services company uses an AI system to score candidates and decide who moves forward in a hiring process.

The first has an operational use: basic personal data, no relevant decision without a human, simple logs. The second touches an area that regulation proposals usually treat as sensitive, because the decision affects a person's access to an opportunity. The second company would need, at a minimum, to document criteria, test for bias, inform candidates, keep human review and be able to explain an individual result.

The practical lesson: the same framework can ask little of one case and a lot of the other. That is why inventory and classification come before any compliance investment.

How Map, Limit, Pilot and Hand over applies here

The method we use in AI implementations fits regulatory preparation well, without promising compliance with a law that is not yet final:

• Map: describe the current process, who decides what and which data moves, before putting AI in the middle.
• Limit: restrict the agent's data, tools and actions, with minimum permissions and handoff to a human when in doubt or when the effect is relevant.
• Pilot: start with one real workflow, with logs and an agreed success metric, and review the records before expanding.
• Hand over: give the team the documentation, logs and review routine, and decide from what was observed whether to expand, adjust or stop.

The byproduct of this work (inventory, limits, logs, owners) is exactly the material that any version of the framework is likely to require. If the rule changes, the company adjusts documents instead of starting over.

Frequently asked questions

Is PL 2338 already in force? No. A bill only takes effect after both Houses approve it, it is signed into law and published, and the text may set adaptation periods. Check the current stage on the Senate and Chamber of Deputies websites.

Does my company need to wait for the law to organize its use of AI? No. The LGPD, the Consumer Defense Code and sector rules already apply today to AI systems that process data or affect customers. An inventory, limits, records and a human review channel are useful in any scenario.

Is a WhatsApp customer service agent considered high risk? It depends on what it does, and the final answer lies in the current text and in legal analysis of the case. As a working hypothesis, an agent that only informs and routes tends to carry lower risk than one that approves, denies or classifies people with a relevant effect.

Who would enforce AI rules in Brazil? The text under discussion associates coordination with a governance system in which the ANPD plays a central role, but the structure may change during the legislative process. Follow the ANPD page and the most recent text of the bill to confirm.

Sources

• Senado Federal: consulta a matérias legislativas
• Câmara dos Deputados: consulta a propostas legislativas
• ANPD: Autoridade Nacional de Proteção de Dados
• NIST: AI Risk Management Framework