Brazil - AI Development Framework (21/2020)

Overview

Projeto de Lei nº 21/2020 (PL 21/2020) is an early federal legislative proposal that aimed to create a national legal and governance framework for artificial intelligence in Brazil. The bill was authored by Deputy Eduardo Bismarck and presented to the Chamber of Deputies on 4 February 2020; its text defines AI systems, the AI lifecycle, and the roles of development and operation agents, and sets out foundational objectives and guiding principles for AI deployment in public and private spheres. Key features include rights for affected parties to obtain information about AI systems, duties for agents (transparency, cybersecurity, compliance with the LGPD), and mechanisms for public authorities to request AI impact reports and recommend standards. The text influenced later Senate consolidation efforts on AI regulation but did not itself become an enacted law; it was archived after subsequent Senate substitutes consolidated related proposals. See the official bill text (PL 21/2020 - full text (Câmara PDF)) and the Chamber’s proposition page for procedural history. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Definitions

PL 21/2020 introduces specific technical-legal definitions to delimit scope and obligations: "system of artificial intelligence" (a computational system that, for objectives defined by humans, can make predictions/recommendations or take decisions affecting real or virtual environments); "AI lifecycle" (phases including planning and design, data collection and model construction, verification and validation, deployment, and operation/monitoring); "agents of AI" (development and operation agents); "stakeholders" (those affected directly or indirectly); and "AI impact report" (documentation describing lifecycle, safeguards, risk management and mitigation measures for each phase). These definitions anchor downstream duties (documentation, transparency, risk assessment) and legal rights for individuals and organizations that may be affected by AI systems. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Governance and Institutional Framework

Although PL 21/2020 primarily establishes principles and duties rather than creating a single centralized regulator, it articulates a multi-institutional governance approach: the Union, States, Federal District and Municipalities are granted competence to act as AI developers/operators under the same rules as private actors, and public authorities are empowered to request AI impact reports and issue recommendations and best-practice guidance. The bill explicitly links to Brazil’s broader policy architecture, including the Brazilian Artificial Intelligence Strategy (EBIA) coordinated by the Ministry of Science, Technology and Innovation (MCTI), which is tasked with governance, capacity building and strategic implementation of AI policy at the federal level (MCTI / EBIA). The Autoridade Nacional de Proteção de Dados (ANPD) is not named as the sole regulator in the PL text, but the bill requires compliance with the LGPD and data-protection obligations, connecting the regulatory remit of ANPD to many obligations under the bill (ANPD). These arrangements imply layered oversight: sectoral and municipal authorities can exercise supervisory functions in their spheres while federal agencies coordinate national standards, interoperability and capacity measures. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Key Focus Areas

PL 21/2020 organizes regulatory attention around several interlocking priorities. 1) Principles and Rights: The bill lists foundational aims—innovation, free initiative and competition, respect for human rights and democratic values, equality and non-discrimination, and privacy/data protection—and enumerates human-centric principles (purpose, human centrality, non-discrimination, transparency/explainability, safety and accountability). 2) Transparency and Participation: It creates entitlements for affected parties to learn which institution is responsible for a system and to access clear information about criteria or procedures used by systems affecting them, subject to trade-secret protections. 3) Risk Management and Documentation: The concept of an AI impact report is central: agents must document lifecycle stages, safeguards, mitigation measures, and risk-management practices. Public authorities may request publication of such reports and recommend standards. 4) Data Protection and Interoperability: The bill explicitly references compliance with the LGPD (Law No. 13.709/2018) and directs public procurement and deployment to favor open standards and interoperability. 5) Public Sector Use: The law mandates capacity-building in public services, encourages AI adoption to improve efficiency, and requires guidance for transparent and ethical public-sector use. These focus areas create a mixed regulatory regime combining rights protection with pro-innovation directives. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Implementation Framework

Implementation under PL 21/2020 would rely on a combination of legislative articulation and administrative guidance: obligations rest on AI agents (developers and operators) to perform prior evaluation of objectives, benefits and risks; to prepare and, when required, publish AI impact reports; to ensure LGPD compliance; to maintain traceability of processes and decisions during the lifecycle; and to protect systems versus cybersecurity threats. Public procurement guidance and incentives (open formats, standards) are tools the bill recommends to catalyze adoption. Implementation therefore demands (i) administrative rules or normative acts to elaborate procedural expectations; (ii) technical standards for documentation and interoperability; and (iii) capacity-building programs for both public administrators and private operators—tasks consistent with the MCTI-led EBIA governance architecture and with ANPD’s data-protection remit. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Monitoring and Evaluation

PL 21/2020 provides for monitoring primarily through the requirement that AI agents prepare AI impact reports and make documentation available to authorities on request, enabling supervisory review. The bill delegates enforcement and evaluation to existing legal remedies and to sectoral public authorities that can recommend standards and request reports. For meaningful monitoring, the text implies the need for registries, audit capacities and public reporting practices—functions that typically would be implemented via delegated regulation or administrative instruments. Complementary national strategies such as the EBIA (MCTI) provide the strategic oversight and periodic evaluation mechanisms that would be required to measure adoption, assess systemic risks and update guidance. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Penalties, Liability, and Appeals

PL 21/2020 articulates duties and rights but does not establish an exhaustive, standalone sanctioning regime within its main text. The bill affirms that agents must "respond, in accordance with the law, for decisions taken by an AI system," indicating civil liability principles and the availability of judicial relief for affected parties. Enforcement and penalties would therefore be executed under existing frameworks (civil liability, consumer protection, administrative law and the LGPD) and through judicial actions rather than through a novel fines-and-sanctions matrix in the bill itself. The absence of detailed sanctioning rules in PL 21/2020 was one of the aspects debated during legislative review and later Senate consolidation. As a result, implementers would need enabling regulations or complementary statutes to define administrative penalties, remediation procedures and appeals channels. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Relationship to Other Instruments

PL 21/2020 situates itself alongside Brazil’s LGPD (Law No. 13.709/2018) and the national AI strategy (EBIA). It was part of a larger legislative ecosystem: other bills addressing AI and digital governance were considered in the Chamber and the Senate and were later consolidated into substitute texts (notably PL 2338/2023 and associated proposals), which absorbed or reworked many provisions from PL 21/2020. The bill’s textual references to data protection link it directly to the ANPD’s supervisory remit and to existing consumer-protection and civil-liability instruments. Internationally, the bill’s principles reflect OECD, G20 and UNESCO recommendations on human-centric AI. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

International Alignment

PL 21/2020 emphasizes convergence with global technical standards and cooperation: it calls for adherence to international technical standards to permit interoperability and for international cooperation and knowledge-sharing. The bill’s human-centric principles (transparency, robustness, accountability) align closely with OECD AI principles and with initiatives such as the EU AI Act discussions, UNESCO guidance and OECD policy instruments. These cross-border alignments are intended to facilitate trade, research collaboration and the adoption of global best practices, while leaving space for Brazil-specific calibrations, including the primacy of LGPD protections for personal data. ([gov.br](https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/estrategia-brasileira-de-inteligencia-artificial?utm_source=openai))

Implementation Timeline

Sources and References