AI Law in Brazil
Introduction
Artificial intelligence law in Brazil is an emerging field that draws upon existing legal frameworks — particularly the Marco Civil da Internet (Law 12.965/2014), the General Data Protection Law (Law 13.709/2018, LGPD), and the Consumer Protection Code (Law 8.078/1990) — while new legislation specifically addressing AI is under active development. Brazil has positioned itself as a leader in Latin American digital regulation, and its approach to AI governance reflects a balance between fostering innovation and protecting fundamental rights.
Current Regulatory Framework
Data Protection and AI
The LGPD is the primary legislation governing AI systems that process personal data. It establishes principles relevant to AI, including purpose limitation, data minimization, transparency, and non-discrimination. Article 20 of the LGPD grants data subjects the right to request review of automated decisions affecting their interests, and the 2024 amendments explicitly address algorithmic profiling and require meaningful transparency about the criteria used in automated decision-making.
The National Data Protection Authority (ANPD) has issued guidelines on AI and automated decision-making, emphasizing the need for human review of decisions that significantly affect data subjects and requiring controllers to provide clear information about the logic of automated systems.
Consumer Protection
The CDC applies to AI systems deployed in consumer relations. Courts have held companies liable for algorithmic errors in credit scoring, pricing algorithms, and recommendation systems. The CDC’s provisions on product liability (responsabilidade pelo fato do produto) and service liability (responsabilidade pelo vício do serviço) create a strict liability regime for defective AI systems that cause harm to consumers.
Internet Regulation
The Marco Civil da Internet establishes principles for internet governance in Brazil, including neutrality (neutralidade de rede), privacy, and freedom of expression. Its provisions on intermediary liability (Article 19) require court orders for removal of third-party content, creating a framework that affects how AI content moderation systems operate in Brazil.
Proposed AI-Specific Legislation
Bill 2338/2023
The most significant proposed AI legislation is Bill 2338/2023 (PL 2338/2023), currently under consideration by the National Congress. Modeled in part on the European Union’s AI Act, the bill adopts a risk-based approach to AI regulation, classifying AI systems into:
- Low risk: subject to transparency obligations only
- High risk: subject to conformity assessment, human oversight, accuracy, and cybersecurity requirements
- Prohibited: AI systems that employ subliminal techniques, exploit vulnerabilities, or enable social scoring by public authorities
The bill establishes an AI regulatory authority to oversee compliance, impose administrative sanctions, and issue guidance. It also creates a sandbox regime (ambiente regulatório experimental) to allow testing of innovative AI applications under regulatory supervision.
Ethics Framework
In 2021, the Brazilian federal government published the Brazilian AI Strategy (EBIA), which outlines ethical principles for AI development and use, including transparency, fairness, accountability, and human-centered values. The strategy emphasizes the role of AI in promoting social inclusion and sustainable development.
The National Council of Justice (CNJ) has issued guidelines on AI use in the judiciary, addressing algorithmic transparency, prevention of bias, and human oversight of AI-assisted judicial decisions.
Sectoral AI Regulation
Healthcare AI
The National Health Surveillance Agency (ANVISA) and the Federal Council of Medicine (CFM) regulate AI applications in healthcare. CFM Resolution 2.314/2022 establishes requirements for telemedicine and AI-assisted diagnosis, requiring physician oversight of all AI-generated diagnostic recommendations.
Financial AI
The Central Bank of Brazil (BACEN) and the Securities and Exchange Commission (CVM) regulate AI use in financial services. BACEN’s Resolution 4.658/2018 requires financial institutions to implement governance frameworks for automated decision-making, including credit scoring and risk assessment algorithms.
Judicial AI
The Superior Court of Justice (STJ) and the Federal Supreme Court (STF) have implemented AI systems for case management and jurisprudential analysis. The SOCRATES and VICTOR projects use AI to classify cases and identify procedural patterns, raising questions about algorithmic transparency and the limits of AI in judicial decision-making.
Challenges and Debates
Algorithmic Discrimination
Brazilian courts have begun addressing algorithmic discrimination claims. The STJ has recognized that algorithmic bias in credit scoring systems may constitute a violation of the CDC and the LGPD, and has held companies liable for discriminatory outcomes even absent intentional discrimination.
Liability for AI Harm
The question of who bears liability when AI systems cause harm remains contested. Brazilian scholars and courts are developing frameworks based on product liability, vicarious liability for AI agents, and potential electronic personality theories, though no consensus has emerged.
International Alignment
Brazil is an observer to the OECD AI Principles and participates in Global Partnership on AI (GPAI) discussions. The proposed PL 2338/2023 seeks to align Brazilian AI regulation with international standards while accommodating national specificities.
Conclusion
Brazilian AI law is at a formative stage, combining application of existing legal frameworks with development of dedicated AI legislation. The LGPD and CDC provide substantial protection against AI-related harms, while PL 2338/2023 promises comprehensive regulation. As AI technologies continue to evolve, Brazilian courts and regulators will play a critical role in shaping the governance landscape.