Autonomous vehicles law and regulation in Brazil

There is currently no specific regulation in Brazil governing the testing or circulation of autonomous vehicles on any type of road. Nonetheless, technological advancements have already enabled tests on public roads as early as 2017, and today such vehicles are operating in private and controlled environments, such as port operations. In light of this scenario, the Bill of Law n. 1317/2023 is under consideration in the National Congress, aiming to initiate the regulation of autonomous vehicle testing and circulation by amending the Brazilian Traffic Code.

The proposal is broad in scope and assigns to the National Traffic Council the task of establishing technical requirements for the manufacturing, commercialization, and circulation of AVs. It already stipulates the requirement for specific licenses and the periodic reporting of testing and performance results to the competent authority. Although it does not specify safety measures, the bill adopts the brazilian legal concept of negligence (lack of due care or skill) to impose liability – either joint or exclusive – on the manufacturer and the owner for accidents caused by failures in the manufacturing, programming, or maintenance of AVs. It also mandates special third- party liability insurance coverage.

The bill defines autonomous vehicles as those that do not rely on a human driver and that utilize georeferencing technologies and decision-making processes based on artificial intelligence. Interestingly, however, it also requires the presence of a qualified safety driver with special authorization. The proposal does not yet provide any specifications regarding the circulation of autonomous vehicles across different types of public or private roads, but it expressly prohibits the use of such technology in “ambulances or equivalent vehicles.”

Another legislative proposal, Bill of Law n. 2338/2023, which is also under deliberation in the Brazilian legislature, briefly addresses self-driving cars by categorizing them as high-risk artificial intelligence systems (in a framework that distinguishes between high risk and excessive risk). This bill imposes specific licensing and authorization requirements, along with periodic reporting obligations and governance measures for AI systems. It places responsibility on manufacturers to ensure transparency, safety, and the implementation of risk prevention and mitigation strategies.

As mentioned above, although still at an early stage, the draft bill imposes liability to both the manufacturer and the owner for accidents resulting from negligence in the manufacturing, programming, or maintenance of the vehicle. Furthermore, it expressly provides for the liability of the manufacturer in cases where accidents stem from failures in programming or manufacturing, in addition to requiring special third-party insurance coverage.

What the bill (or any regulation) does not address – though it is already being debated in academic legal literature – are the legal consequences of accidents resulting from autonomous decisions made by the system, that is, algorithm-driven responses to accident scenarios, or crash-algorithms. There is a brief mention in the bill that the vehicle must be safe and compliant with traffic laws. However, drawing from portuguese, spanish, and especially german legal sources, the central concern lies in the challenge of ensuring and demonstrating that the vehicle is as safe as possible for passengers and third parties.

The duty to maintain the highest possible level of safety for all may be translated into programming aimed at accident prevention and harm reduction. A wide range of risks are inherent to the very nature of traffic ecosystems – environments that are fundamentally human and unsafe – which is why they are regulated by law, independent of the presence of AVs.

It is in this context that crash-algorithms are to be understood. These must be regarded as essential safety measures designed to avoid accidents and, if unavoidable, to guide decision-making toward minimizing harm in pursuit of the least harmful outcome or reduced-impact scenario. Although there is no definitive legal consensus, it is argued under brazilian law, particularly criminal and civil law, that when accident scenarios are unavoidable, the system should operate to achieve the least harmful and least severe outcome.

Accordingly, if an accident cannot be avoided, the expectation is that the decision – although autonomous – should be guided by programming that imposes the outcome involving the least amount of harm or injury to any party involved. In this sense, brazilian proposals, especially those inspired by german and portuguese law, support the legality of a system’s decision that, for instance, causes property damage or minor injuries to a passenger or a third party in order to avoid more serious harm or loss of life – that is, to bring about the reduced-impact scenario.

A different and more complex issue arises in so-called dilemmatic or moral dilemma scenarios, where an accident is inevitable and any system decision will result in the death of someone involved. That is, the specific situation imposes an equal risk of death to both passengers and third parties, reflected in the globally recognized Trolley Problem: for example, if faced with an obstacle, the system’s choice not to swerve results in the death of the passenger, whereas swerving would cause the death of a third party (such as a pedestrian or another driver).

In Brazil, recent studies – though divergent – seek legal grounds to support the lawfulness of crash-algorithms programmed to pursue the lesser harm and avoid the most harmful outcome. In principle, this would permit the programming of utilitarian algorithms. Hence, there is active debate over whether it would be lawful to program systems to prioritize saving the greatest number of lives. It is important to emphasize, however, that such discussions are still part of a nascent academic debate in Brazil and involve additional challenges, such as proving that the inevitable outcome resulted from reliable probability calculations and degrees of risk – as well as the processing of a vast number of scenarios in a matter of seconds – as a means of ensuring that the vehicle operates with the highest possible level of safety to avoid greater harm.

Another particularly sensitive issue is the potential preference given to passengers or third parties by the system. The controversy lies in the programming of algorithms that, in an unavoidable accident, might prioritize one party over another solely based on their legal relationship with the manufacturer (such as a consumer relationship with the passenger versus a general duty of care toward third parties). Given that the vehicle must be as safe as possible for everyone, whenever there is a conflict involving the life of one individual or another, the programming should reflect an expectation of equal distribution in the likelihood of survival among those involved.

These reflections must also consider the level of information provided to the passenger about the risks to which they are exposed. At present, it appears to be widely accepted that the general public is unaware of such risks. However, those who choose to acquire an autonomous vehicle should be adequately informed that the system's decisions may potentially endanger their physical integrity or even their lives. This point seems fundamental when addressing the liability of the manufacturer, particularly under criminal and consumer protection law. Specifically, Article 6, item III, of the Consumer Protection Code establishes the consumer’s right to clear and precise information, while Article 9 imposes a duty on the supplier to inform, in a prominent and adequate manner, about the product’s risks.

Moreover, considering that AVs must be as safe as possible for both passengers and the broader community, it is expected that manufacturers implement protective and monitoring systems against cyberattacks. This is because such incidents may cause anything from performance issues to serious accidents. Therefore, manufacturers are expected to undertake all reasonably available efforts to safeguard passengers and third parties from such events. Otherwise, they may, in principle, be held liable for damages arising from a failure to provide adequate protection. It is important to note that, under Articles 12 and 14 of the Consumer Protection Code, suppliers are subject to strict liability for damages, meaning they are civilly liable regardless of fault or intent – that is, liability is based solely on causation and damage, without the need to establish wrongful conduct.

Finally, as previously noted, the brazilian legal framework does not currently provide for specific insurance coverage to address risks related to liability for damages or the operation of autonomous vehicles in the country. In other words, there are no special regulations governing such matters beyond existing general rules.

Nonetheless, although no specific legislation exists on the subject, the insurance sector has been closely monitoring technological developments and the need to adapt its products. There are ongoing – albeit still very incipient – discussions about the creation of insurance modalities in Brazil tailored to the unique risks of autonomous vehicles. In practice, however, insurers operating in the country still rely on conventional standards and practices, adapting policy clauses according to the particularities of each case.

All of these considerations, it is important to reiterate, are based on academic proposals within the brazilian legal system and are inspired by portuguese, spanish, and german criminal law. As such, the aim is not to offer definitive answers but rather to provide a concise overview of the key issues being debated in the academic field, which may eventually inform future regulatory frameworks.

Although there is no specific regulation in Brazil regarding the testing and operation of autonomous vehicles, Law n. 13,709/2018 – the General Data Protection Law (LGPD) establishes the principles and legal grounds for the processing of personal data. This includes information collected by autonomous vehicles, whether during testing phases or commercial operations.

Under the LGPD, the processing of personal data – which encompasses activities such as collection and handling – may only occur when based on one of the lawful bases provided in Articles 7 and 9 of the Law, the latter being applicable in cases involving the processing of sensitive personal data.

When assessing the context of autonomous vehicles from the perspective of data protection, two distinct fronts become evident: passengers and third parties.

Processing passenger data appears to be less problematic, as it may be lawfully carried out, for instance, through the obtaining of consent (Art. 7, I), or based on the performance of a contract (Art. 7, V), in cases where the vehicle’s autonomous movement is understood as part of a contractual obligation undertaken by the manufacturer or service operator.

The situation is different, however, for pedestrians and other drivers, whose individual consent is operationally unfeasible.

In an initial analysis, in cases where consent cannot reasonably be obtained, the legal basis that seems most appropriate to justify the processing of third-party personal data – whether during testing or operation – appears to be the controller’s legitimate interest (Art. 7, IX). This is especially so where such processing is strictly necessary to support and promote the controller’s activities (Art. 10, I), namely, the safe development of autonomous vehicle technologies. However, this legal basis may only be sustained as long as the controller’s legitimate interest does not override the fundamental rights and freedoms of the data subjects that require protection of their personal data.

Data security is an equally crucial aspect of personal data processing in the context of AVs, particularly considering the massive collection of sensitive data and geolocation information. The LGPD requires the adoption of technical and administrative measures to protect personal data from unauthorized access and data breaches (Art. 46). Moreover, the anonymization of collected data may serve as an essential strategy to reduce risks and mitigate legal liabilities (Art. 12).

To date, Brazilian legislation and regulation do not explicitly require operators of autonomous vehicles to collect or provide operational data (such as telemetry) to public authorities or regulators. Nevertheless, data protection and privacy regulation are dynamic and is being developed under the guidance of the Brazilian National Data Protection Authority (ANPD).

In this regard, the ANPD has even highlighted priority topics in its Regulatory Agenda for the 2025–2026 biennium, which may have a direct impact on the processing of personal data related to AVs. These include discussions and potential regulation on topics such as: (i) artificial intelligence, through the establishment of interpretive parameters for the exercise of the right to automated decision review; (ii) standards and techniques used in anonymization and pseudonymization processes; (iii) requirements to be observed in the use of consent as a legal basis; among others.

As such, future regulations are expected to provide clearer guidelines on the collection and use of data by autonomous vehicles.

Therefore, although the operation of autonomous vehicles in Brazil still lacks specific regulation, the LGPD and the ANPD’s normative acts provide a relevant legal framework that must be carefully observed to ensure the proper protection of data collected by such technologies.

Although there are no specific programs dedicated to the development of autonomous vehicles in Brazil, at both the national and state levels there exists a network of incentive initiatives aimed at supporting technology companies. Examples include the Start-Up Brasil Program, Finep Startup, and the Financing Program for Startups and Technology Companies. In addition to these initiatives, Bill n. 2967/2024, currently under consideration in the National Congress, seeks to create new incentive schemes for technology enterprises. These various national-level initiatives offer diverse forms of support, ranging from direct investment and tax exemptions to acceleration and business growth plans for companies operating in the sector.

Within this developmental landscape, there are already companies in Brazil engaged in the production and operation of autonomous vehicle technologies. The first Brazilian autonomous car to circulate on interurban roads in 2017 was developed by the High- Performance Computing Laboratory of the Federal University of Espírito Santo, under the name IARA (Intelligent Autonomous Robotic Automobile). The expansion of that project led to the establishment of the startup Lume Robotics, which implemented the first Brazilian autonomous truck project for port operations at Portocel, also located in the State of Espírito Santo. The operation is based on a public-private partnership involving the municipal government of Aracruz (where the port is located), Vix Logística, and both Lume and Portocel.