AI laws and regulation in Brazil

Medium.

There is, however, on 2025 a State Law enacted by the State of Goiás (Goiás State Law No. 205/2025), focused on promoting ethical, responsible, and innovative use of artificial intelligence within the State of Goiás, including guidelines for transparency, governance, and risk mitigation in government use of AI. The law has a policy-oriented and programmatic character, rather than establishing a full enforcement regime.

Brazil does not yet have a dedicated, comprehensive AI statute. However, AI systems are regulated through a set of existing legal frameworks that apply depending on the nature of the AI system, the data involved, and the sector in which it is deployed.

This framework is expected to be consolidated and further specified if and when Bill of Law No. 2338/2023 is enacted, introducing a dedicated risk-based AI regime.

• Brazilian Federal Constitution: Fundamental rights such as privacy, non-discrimination, due process, and consumer protection inform the interpretation and limits of activities in general, hence being also applicable to AI deployment.
• Brazilian General Data Protection Law (Law No. 13,709/2018 - LGPD): Governs the processing of personal data through any means, which includes AI systems, including requirements on lawful bases, transparency, automated decision-making, data subject rights, security measures, and accountability.

• Consumer Defense Code (Law No. 8,078/1990): Applies to any products and services offered to consumers, imposing strict liability, transparency, and information duties, which can be extended to AI systems used on consumer relations.
• Brazilian Civil Code (Law No. 10,406/2002): Provides general rules on civil liability, fault, and risk-based liability, which may apply to damages caused by AI systems.

• Marco Civil da Internet (Law No. 12,965/2014): Establishes principles for internet use in Brazil, including privacy, data protection, network neutrality, and intermediary liability, which are relevant for AI-based online platforms and services.

• General cybersecurity obligations derived from sectoral regulations and regulatory guidance, including requirements imposed by financial, telecom, and critical infrastructure regulators.
• Criminal legislation, including cybercrime provisions, may apply to unauthorized access, data misuse, or security breaches involving AI systems. In addition, Law No. 15,123/2025 amended the Brazilian Criminal Code to increase penalties for psychological violence against women when committed through the use of artificial intelligence or other technologies that manipulate image or sound, explicitly addressing harms enabled by AI-driven deepfakes and similar tools.

• Regulatory frameworks issued by authorities such as the Central Bank of Brazil (BACEN), Brazilian Securities Commission (CVM), National Health Surveillance Agency (ANVISA), National Telecommunications Agency (ANATEL), and others may impose additional requirements where AI is used in regulated activities.

Brazil does not yet have a single authority exclusively responsible for AI oversight. Supervision of AI systems may be shared among existing regulators, depending on the use case, sector, and risks involved. The most relevant authorities include:

National Data Protection Agency (ANPD): The ANPD oversees compliance with the LGPD, including rules on automated decision-making, transparency, data subject rights, security, and accountability.

The ANPD has been active in enforcement, guidance, and policy development, issuing regulations, technical guidance, and sanctions related to data protection, as well as participating in national and international discussions on AI governance. While it does not regulate AI per se, its mandate directly affects many AI systems in practice.

• Central Bank of Brazil (BACEN) and Brazilian Securities Commission (CVM): financial services, payments, capital markets
• National Health Surveillance Agency (ANVISA): health and medical technologies
• National Telecommunications Agency (ANATEL): telecom and digital infrastructure
• Administrative Council for Economic Defense (CADE): competition and algorithmic practices
• Consumer protection authorities (SENACON and state PROCONs): consumer-facing AI products and services

Brazilian courts and public prosecutors (Ministério Público) play an important role in overseeing harms caused by any means, which may include AI, particularly in cases involving discrimination, consumer protection, biometric surveillance, and misuse of automated systems by public authorities.

This framework is expected to be reorganized if and when Bill of Law No. 2338/2023 is enacted. The current version establishes a National System for the Regulation and Governance of Artificial Intelligence (SIA) as a coordinated institutional framework rather than a single, centralized AI authority. Under this model, existing sector-specific regulators remain responsible for supervising and enforcing AI-related obligations within their respective areas of competence (such as finance, health, telecommunications, and consumer protection).

The ANPD shall be the coordinator of the SIA, acting as a residual regulator for AI matters not clearly allocated to another authority. However, where AI systems involve the processing of personal data, the ANPD serves as the primary or concurrent regulator, depending on the sector and the nature of the risks involved, exercising its full powers under the LGPD alongside other competent authorities where applicable.

Yes. Although Brazil does not yet have a binding, comprehensive AI statute, it has adopted several official policy documents, guidelines, and strategic frameworks that articulate its approach to AI development and use.

These instruments are largely non-binding, but they play an important role in shaping public policy, regulatory expectations, and market practices.

• EBIA sets out Brazil’s national vision for AI development.
• It is structured around pillars such as ethical and responsible AI, data governance, innovation, education and workforce development, public sector use of AI, and international cooperation.
• EBIA explicitly emphasizes human-centered AI, protection of fundamental rights, transparency, and risk mitigation, and serves as a reference point for legislative and regulatory initiatives.

• While not AI-specific, the ANPD has issued and continues to develop guidance, regulations, and enforcement actions that directly affect AI systems, particularly regarding:
  • automated decision-making,
  • transparency and explainability,
  • data subject rights,
  • accountability and governance measures.
• AI-related topics feature prominently in the ANPD’s regulatory agenda, signaling sustained institutional focus.

• The legislative debate surrounding Bill of Law No. 2338/2023 has generated a significant body of explanatory reports, technical opinions, and public consultations, which, while not binding, help clarify Brazil’s emerging regulatory stance on AI, including its preference for a risk-based and principle-driven model.

Yes. Although Brazil does not yet have a binding AI-specific legal framework, its AI-related policies and regulatory debates explicitly reference and are strongly influenced by international AI standards and guidelines, particularly those grounded in human-centered, risk-based governance.

• OECD AI Principles
  • Although not yet an OECD member, Brazil has adopted the OECD AI Principles,
• UNESCO Recommendation on the Ethics of Artificial Intelligence
  • Brazil supported and endorsed UNESCO’s Recommendation, and its ethical foundations are echoed in Brazil’s national AI strategy and legislative proposals, particularly concerning inclusion, non-discrimination, and societal impact.
• ISO/IEC standards and NIST Framework
  • Neither is not expressly referenced in Brazilian current or proposed legislation or policy documents.

Brazil is actively considering and debating an AI-specific law, but no final statute has yet been enacted.

• Bill of Law No. 2338/2023 is the main legislative proposal currently under discussion in the Brazilian Congress.
• The bill seeks to establish a national legal framework for artificial intelligence, adopting a risk-based approach and addressing issues such as governance, transparency, accountability, allocation of liability, protection of fundamental rights, and oversight mechanisms.
• The proposal has been approved by the Senate and is currently under review in the House of Representatives, where its content may still be amended through committee discussions and plenary debate.

• There is no fixed or officially announced timeline for final approval and enactment.
• While AI regulation is treated as a policy priority, the legislative process remains subject to political negotiation, technical debate, and alignment with existing regulatory structures.
• If approved, the law is expected to include phased implementation periods, allowing regulators and market participants time to adapt, similar to international models.

Legal Dilemmas of AI https://fasadv.com.br/en/bra/publication/legal-dilemmas-of-ai