🇧🇷Brazil

Overview

Brazil is actively constructing a comprehensive federal framework for artificial intelligence regulation, reflecting a commitment to fostering innovation while rigorously safeguarding fundamental rights and democratic principles. This evolving regulatory landscape is characterized by a multi-pronged approach that combines strategic national policies, administrative decrees establishing interministerial coordination bodies, and sector-specific binding regulations. The nation's philosophy centers on a human-centric approach to AI, ensuring that technological advancements serve societal well-being and adhere to ethical guidelines. The maturity level of Brazil's AI regulatory environment is rapidly advancing, moving from initial policy declarations to concrete legislative proposals and operational governance structures. A cornerstone of Brazil's approach is the Estratégia Brasileira de Inteligência Artificial (EBIA), a non-binding but influential strategic document that outlines principles, priorities, and actions for ethical AI development and deployment across various sectors. Complementing this policy guidance are administrative instruments like the Decreto nº 12.308/2024, which instituted the Comitê Interministerial para a Transformação Digital (CITDigital) to coordinate digital transformation policies, including AI initiatives. Furthermore, the judiciary has taken proactive steps with Resolução CNJ nº 615/2025, a binding regulation that establishes a comprehensive framework for AI use within the Brazilian Judiciary, emphasizing risk management, transparency, and human oversight. The most significant development is Projeto de Lei nº 2.338/2023, a comprehensive legislative proposal currently under review, aiming to establish a horizontal, risk-based regulatory framework for AI across the country, drawing inspiration from international best practices.

Regulatory approach

Brazil's regulatory approach to AI is characterized by a hybrid model, incorporating both horizontal and sectoral regulations, as well as a blend of binding legal instruments and soft law policy guidelines. The overarching direction is towards a risk-based framework, particularly evident in the proposed Projeto de Lei nº 2.338/2023, which categorizes AI systems into excessive, high, and non-high risks, imposing corresponding obligations to balance innovation with the protection of fundamental rights and democratic principles. This horizontal approach aims to provide a consistent legal environment for AI across all sectors, preventing fragmented regulation and ensuring a baseline of ethical and safety standards. The bill's inspiration from the EU AI Act and OECD recommendations underscores an international alignment in its design, focusing on conformity assessment, documentation, and mandatory impact assessments for high-risk systems. Alongside this horizontal legislative effort, Brazil employs a sectoral approach for specific domains, exemplified by the comprehensive Resolução CNJ nº 615/2025 for the Judiciary. This binding regulation sets detailed guidelines for the development, use, and governance of AI solutions within the judicial system, including risk classification, mandatory impact assessments, and explicit prohibitions on certain AI uses. The Estratégia Brasileira de Inteligência Artificial (EBIA) serves as a key soft law instrument, providing a strategic vision and guiding principles for AI development and adoption across public and private sectors without imposing direct legal obligations or sanctions. This combination of binding regulations for high-impact sectors and a broader, principles-based national strategy allows for both targeted oversight and flexible policy development, adapting to the rapid evolution of AI technologies while maintaining a focus on human rights and ethical considerations. Brazil's AI governance landscape is characterized by a distributed yet coordinated structure, involving several key federal bodies. The Conselho Nacional de Justiça (CNJ) plays a crucial role within the judiciary, having established the Comitê Nacional de Inteligência Artificial do Judiciário (CNIAJ) through Portaria CNJ nº 270/2025. The CNIAJ is an interdisciplinary oversight body tasked with supporting the CNJ in implementing, complying with, and supervising Resolução CNJ nº 615/2025, which sets substantive rules for AI governance in the Judiciary. Its mandate includes risk reclassification, establishing audit standards, recommending adoption or suspension of systems, consolidating governance norms for the national Sinapses platform, advising on data protection, and proposing cooperation agreements. This committee ensures centralized oversight of AI procurement and in-house development within courts, standardized audit and impact-assessment protocols, and integration with the LGPD. At a broader federal executive level, the Comitê Interministerial para a Transformação Digital (CITDigital), instituted by Decreto nº 12.308/2024, serves as a high-level advisory body to the Presidency on digital transformation issues, including AI. Under CITDigital, the Group of Work for the management and operationalization of the Plano Brasileiro de Inteligência Artificial (GT-PBIA) was established by Resolução CITDIGITAL nº 2/2025 and its composition formalized by Portaria nº 8/2025. Coordinated by the Ministry of Science, Technology and Innovation (MCTI), the GT-PBIA is responsible for monitoring PBIA execution, proposing adjustments, preparing annual operational plans, and supporting inter-agency alignment across key AI development axes. The MCTI also leads the Estratégia Brasileira de Inteligência Artificial (EBIA), a strategic policy document that guides national AI development. The Autoridade Nacional de Proteção de Dados (ANPD), Brazil's data protection authority, is a crucial interlocutor, particularly as the proposed AI regulatory framework (PL 2338/2023) emphasizes strong alignment with the Lei Geral de Proteção de Dados (LGPD). While not explicitly designated as the sole AI regulator, its mandate for data protection naturally extends to AI systems processing personal data, making it a de facto central authority in practice for privacy-related AI governance.

Enforcement & penalties

The enforcement mechanisms and potential penalties for AI non-compliance in Brazil are currently evolving, with the most comprehensive provisions outlined in the pending Projeto de Lei nº 2.338/2023. This draft legislation proposes a range of administrative sanctions, which may include warnings, fines, publicization of infractions, suspension of operation, or even prohibition from participating in regulatory sandboxes. Notably, the bill specifies significant financial penalties, with fines potentially reaching up to R$50,000,000 or 2% of a company's Brazilian turnover, whichever is greater. Furthermore, the proposal introduces civil liability rules that include objective liability for high-risk or excessive-risk AI systems, with presumptions that favor victims, aligning with principles found in the Consumer Protection Code where applicable. This aims to ensure robust redress mechanisms for individuals harmed by AI systems. In the judicial sector, Resolução CNJ nº 615/2025 outlines its own enforcement framework, primarily through continuous monitoring, periodic audits, and incident reporting. Non-compliance with the resolution's guidelines can trigger audit findings, referrals to competent authorities, and the application of administrative or contractual remedies. The newly established Comitê Nacional de Inteligência Artificial do Judiciário (CNIAJ) is empowered to recommend the adoption or suspension of particular AI systems and to require tribunals to submit systems for reclassification or audit. While specific criminal penalties for AI misuse are not extensively detailed in the current federal AI regulations, existing laws, such as those related to data protection (LGPD) and consumer rights, would apply to AI-related offenses. The enforcement of these regulations will be carried out by the designated "authority competent" (once established by the Executive Branch under PL 2338/2023) in coordination with sectoral regulators and the ANPD, ensuring a multi-layered approach to compliance and accountability.

Data protection

Brazil's data protection framework is anchored by the Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018), which serves as the country's comprehensive privacy law, akin to Europe's GDPR. The LGPD establishes principles, rights for data subjects, and obligations for data controllers and processors regarding the collection, use, processing, and storage of personal data. This foundational law is explicitly referenced and integrated into emerging AI regulations, ensuring that AI systems operating in Brazil adhere to strict privacy and data security standards. The Autoridade Nacional de Proteção de Dados (ANPD) is the primary enforcement body for the LGPD, overseeing compliance and imposing sanctions for violations. The ANPD's role is expected to be central in the enforcement of AI regulations, particularly where AI systems process personal data. The integration of data protection principles into AI governance is prominently featured in sector-specific regulations, such as Resolução CNJ nº 615/2025 for the Judiciary. This resolution mandates privacy-by-design and privacy-by-default principles for all AI solutions, requiring secure data curation, storage, and versioning. It also imposes strict conditions on the use of third-party cloud services or commercial large language models (LLMs) for judicial work, specifically prohibiting the processing of secret or justice-protected data unless properly anonymized at the origin. Furthermore, contractual clauses for AI vendors are required to ensure that judiciary data is not used for model training without a legal basis. The proposed national AI regulatory framework (PL 2338/2023) also reinforces these data protection requirements, aligning its provisions with the LGPD to ensure the lawful and ethical handling of personal data used in AI systems, and emphasizing special protections for vulnerable groups.

Sector-specific rules

While Brazil is progressing towards a horizontal AI regulatory framework, significant sector-specific rules are already in force, particularly within the judicial and public administration domains. The Brazilian Judiciary, under the guidance of the Conselho Nacional de Justiça (CNJ), has implemented a robust set of regulations for AI use. Resolução CNJ nº 615/2025 establishes comprehensive guidelines for the development, procurement, deployment, and governance of AI solutions across the Judiciary. This includes a detailed risk-based classification system for AI applications in judicial contexts, identifying high-risk use-cases such as the evaluation of evidence, formulation of legal conclusions, biometric identification, and profiling. The resolution mandates preliminary evaluations, ongoing algorithmic impact assessments, and explicit prohibitions on uses that preclude human oversight or cause abusive discrimination. Further strengthening judicial AI governance, Portaria CNJ nº 270/2025 formally designates the members of the Comitê Nacional de Inteligência Artificial do Judiciário (CNIAJ), an oversight body responsible for coordinating risk classification, audits, monitoring, and technical guidance for AI systems within the Judiciary. In the broader public administration, the Decreto nº 12.308/2024 instituted the Comitê Interministerial para a Transformação Digital (CITDigital) to advise the Presidency on digital transformation, which includes the strategic integration of AI into public services. The Plano Brasileiro de Inteligência Artificial (PBIA), managed by a dedicated Group of Work (GT-PBIA) under CITDigital, focuses on operationalizing AI actions across infrastructure, human capital, public service modernization, and regulatory aspects. These federal initiatives aim to ensure that AI adoption in public services is coordinated, efficient, and adheres to principles of transparency and accountability, laying the groundwork for future sector-specific guidelines in areas like healthcare or finance as the national AI strategy matures.

International alignment

Brazil's approach to AI regulation demonstrates a strong commitment to international alignment, drawing significant inspiration from leading global frameworks and principles. The Estratégia Brasileira de Inteligência Artificial (EBIA), a foundational policy document, explicitly aligns with international recommendations, including the OECD AI Principles. These principles, such as inclusive growth and well-being, human-centered values and equity, transparency and explainability, robustness, security and safety, and accountability, form the ethical bedrock of Brazil's national AI strategy. This alignment facilitates international cooperation, promotes the exchange of best practices, and positions Brazil as a responsible actor in global AI governance discussions. The EBIA also emphasizes the importance of data governance, privacy protection in the context of Brazil's LGPD, cybersecurity, and impact assessment, mirroring global concerns. The influence of international frameworks is particularly evident in the Projeto de Lei nº 2.338/2023, the draft national AI regulatory framework currently under review. This bill adopts a risk-based approach largely inspired by the European Union's AI Act and further informed by OECD recommendations. By categorizing AI systems into different risk levels and imposing corresponding obligations, the bill seeks to create a predictable and secure legal environment that balances innovation with the protection of fundamental rights, similar to the EU's comprehensive regulatory model. The ongoing debate in Brazil regarding regulatory competence, scope of prohibitions, and obligations for large models also reflects discussions happening at the international level. This proactive engagement with international standards and comparative law demonstrates Brazil's intent to develop a robust and globally compatible AI regulatory ecosystem.

What's next

The future of AI regulation in Brazil is poised for significant developments, primarily centered around the progression of Projeto de Lei nº 2.338/2023, which is currently under review in the Chamber of Deputies. This comprehensive bill, if enacted, will establish a foundational national AI regulatory framework, introducing a risk-based approach, rights for affected individuals, and an institutional governance model. The ongoing legislative process involves detailed analysis by a special committee, and further amendments or refinements are possible before its final approval. Stakeholders will need to closely monitor its progress, as its eventual passage will trigger the need for secondary regulations, technical guidance, and operational rules to be adopted by the designated competent authority. The debate around the allocation of regulatory competence, particularly the role of the ANPD, and specific criteria for risk classification, impact assessments, and audit methodologies, will continue to shape these future implementing acts. Beyond the legislative front, ongoing work by established governance bodies will continue to shape Brazil's AI landscape. The Comitê Nacional de Inteligência Artificial do Judiciário (CNIAJ), operationalized by Portaria CNJ nº 270/2025, is charged with developing technical guidance on risk classification, governance standards, transparency reporting, audit protocols, and capacity-building for judicial personnel. Similarly, the Group of Work for the management and operationalization of the Plano Brasileiro de Inteligência Artificial (GT-PBIA), established under CITDigital, will continue to coordinate and monitor the implementation of national AI policy actions, influencing future funding decisions and cross-sectoral initiatives. The Estratégia Brasileira de Inteligência Artificial (EBIA) is conceived as a living policy, subject to periodic review and updates by the MCTI as technology and societal impacts evolve. These ongoing administrative and policy-level activities, coupled with the pending national AI bill, indicate a dynamic and continuously evolving regulatory environment in Brazil, requiring sustained attention from all AI stakeholders.