Brazil AI Regulation Bill (PL 2338/2023)

This provision outlines the overarching goals of Brazil's AI Bill No. 2338/2023. It aims to establish national standards for the responsible development and use of AI, balancing technological innovation with the protection of fundamental rights and democratic principles. The bill adopts a risk-based approach, categorizing AI systems to apply proportionate regulations. It seeks to create a predictable legal environment for AI in Brazil, ensuring ethical, transparent, and accountable deployment while safeguarding citizens' rights and promoting responsible innovation.

This section provides crucial definitions that underpin the entire regulatory framework. An 'AI system' is broadly defined by its functional ability to infer and generate outputs influencing environments. It distinguishes between 'providers' (those who develop and place AI on the market) and 'operators' (those who use AI under their authority). Crucially, it defines three risk categories: 'excessive-risk' (prohibited), 'high-risk' (subject to stringent requirements), and 'non-high/non-excessive risk' (general obligations). It also defines 'indirect discrimination' to address subtle biases in AI.

This provision details the core risk-based classification system, which dictates the level of regulatory scrutiny. It explicitly prohibits 'excessive-risk' AI systems, which are deemed too dangerous due to their inherent threat to fundamental rights or democratic principles. Examples of prohibited systems include those using subliminal techniques to induce harmful behavior, exploiting vulnerabilities of specific groups, or government use of AI for social scoring. 'High-risk' systems, which could significantly impact individuals' lives (e.g., in healthcare, justice, employment), are subject to strict compliance measures, while 'non-high/non-excessive risk' systems face general obligations.

For AI systems classified as 'high-risk,' this provision mandates a series of stringent obligations. Providers and operators must conduct Algorithmic Impact Assessments (AIAs) to identify, evaluate, and mitigate potential risks to fundamental rights and public safety. These systems also require rigorous testing for robustness, accuracy, reliability, and coverage to ensure they perform as intended without harmful biases. Furthermore, human supervision is mandatory, allowing for human intervention, override, or cessation of system operation to prevent risks. High-risk areas include critical infrastructure, law enforcement, justice, credit scoring, employment, education, and medical diagnoses.

This provision establishes the National AI Regulation and Governance System (SIA), which will serve as the central coordinating body for AI oversight in Brazil. The SIA is tasked with promoting cooperation among various regulatory agencies and ensuring compliance with the AI rules. While the specific structure and designated regulatory authority are to be detailed in subsequent regulations, the intent is to create a competent and independent body responsible for developing guidelines, conducting oversight, and enforcing penalties. This framework emphasizes a multi-stakeholder approach, encouraging collaboration between government, industry, academia, and civil society.

This provision underscores the bill's commitment to protecting fundamental human rights, including privacy, data protection, and non-discrimination. It explicitly aligns with Brazil's General Data Protection Law (LGPD), ensuring that all personal data processing by AI systems adheres to LGPD principles and legal bases. Individuals are granted rights such as the right to be informed about AI interactions, the right to an explanation of AI decisions, and the right to challenge or seek human intervention for decisions that significantly impact them. The bill also prohibits AI systems that exploit vulnerabilities or lead to indirect discrimination.

This provision mandates that AI system agents (providers and operators) must ensure transparency and explainability. They are obligated to provide sufficient, objective, clear, and accessible information about the AI system's operations and the procedures necessary for individuals to exercise their rights. This includes explaining how AI decisions are made, especially when those decisions have legal effects or significantly impact individuals. The goal is to make AI systems understandable, auditable, and traceable, facilitating accountability and user trust.

This provision outlines the consequences for non-compliance and the framework for civil liability. Penalties for violations can be substantial, reaching up to BRL 50 million (approx. USD 1.6 million) or 2% of the company's total turnover in Brazil, whichever is higher. For damages caused by AI systems, the provider or operator is required to provide integral repair. For high-risk AI systems, liability is generally considered strict, meaning fault does not need to be proven, to the extent of their participation. Exceptions exist for exclusive fault of the victim or third party, or force majeure. In consumer relations, Brazil's Consumer Defense Code applies alongside these new AI-specific rules.

This provision addresses the use of copyrighted material for AI training. It allows for the automated use of copyrighted works by AI systems for non-commercial purposes, such as research, education, and journalism, under certain conditions. However, it also grants authors the explicit right to prohibit the use of their works for AI training by large technology companies. This aims to strike a balance between fostering AI development and protecting the rights of creators, particularly against commercial exploitation by dominant market players.

To foster innovation and allow for the safe development of novel AI technologies, this provision supports the use of regulatory sandboxes. These are controlled environments where AI systems can be tested under relaxed regulatory requirements for a limited period. This approach enables developers to experiment, learn, and refine their AI systems before full market deployment, reducing the initial regulatory burden while still ensuring oversight. It aims to strike a balance between promoting technological advancement and ensuring eventual compliance with the full regulatory framework.

This provision clarifies that the AI Bill is designed to complement and integrate with existing Brazilian legal instruments, rather than supersede them. It explicitly aligns with the Lei Geral de Proteção de Dados Pessoais (LGPD) for data protection, ensuring consistent privacy safeguards. The Código de Defesa do Consumidor (Consumer Defense Code) remains applicable for civil liability in consumer relations, with the AI bill adding specific rules. The Lei dos Direitos Autorais (Copyright Law) is also referenced, particularly regarding AI training data. This approach ensures a coherent legal landscape, building upon established rights and protections.