Projeto de Lei nº 21/2020 (Foundations, principles and guidelines for development and application of AI in Brazil)

Overview

Projeto de Lei nº 21/2020 (PL 21/2020) is an early federal legislative proposal that aimed to create a national legal and governance framework for artificial intelligence in Brazil. The bill was authored by Deputy Eduardo Bismarck and presented to the Chamber of Deputies on 4 February 2020; its text defines AI systems, the AI lifecycle, and the roles of development and operation agents, and sets out foundational objectives and guiding principles for AI deployment in public and private spheres. Key features include rights for affected parties to obtain information about AI systems, duties for agents (transparency, cybersecurity, compliance with the LGPD), and mechanisms for public authorities to request AI impact reports and recommend standards. The text influenced later Senate consolidation efforts on AI regulation but did not itself become an enacted law; it was archived after subsequent Senate substitutes consolidated related proposals. See the official bill text (PL 21/2020 - full text (Câmara PDF)) and the Chamber’s proposition page for procedural history. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Definitions

PL 21/2020 introduces specific technical-legal definitions to delimit scope and obligations: "system of artificial intelligence" (a computational system that, for objectives defined by humans, can make predictions/recommendations or take decisions affecting real or virtual environments); "AI lifecycle" (phases including planning and design, data collection and model construction, verification and validation, deployment, and operation/monitoring); "agents of AI" (development and operation agents); "stakeholders" (those affected directly or indirectly); and "AI impact report" (documentation describing lifecycle, safeguards, risk management and mitigation measures for each phase). These definitions anchor downstream duties (documentation, transparency, risk assessment) and legal rights for individuals and organizations that may be affected by AI systems. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Governance and Institutional Framework

Although PL 21/2020 primarily establishes principles and duties rather than creating a single centralized regulator, it articulates a multi-institutional governance approach: the Union, States, Federal District and Municipalities are granted competence to act as AI developers/operators under the same rules as private actors, and public authorities are empowered to request AI impact reports and issue recommendations and best-practice guidance. The bill explicitly links to Brazil’s broader policy architecture, including the Brazilian Artificial Intelligence Strategy (EBIA) coordinated by the Ministry of Science, Technology and Innovation (MCTI), which is tasked with governance, capacity building and strategic implementation of AI policy at the federal level (MCTI / EBIA). The Autoridade Nacional de Proteção de Dados (ANPD) is not named as the sole regulator in the PL text, but the bill requires compliance with the LGPD and data-protection obligations, connecting the regulatory remit of ANPD to many obligations under the bill (ANPD). These arrangements imply layered oversight: sectoral and municipal authorities can exercise supervisory functions in their spheres while federal agencies coordinate national standards, interoperability and capacity measures. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Key Focus Areas

PL 21/2020 organizes regulatory attention around several interlocking priorities. 1) Principles and Rights: The bill lists foundational aims—innovation, free initiative and competition, respect for human rights and democratic values, equality and non-discrimination, and privacy/data protection—and enumerates human-centric principles (purpose, human centrality, non-discrimination, transparency/explainability, safety and accountability). 2) Transparency and Participation: It creates entitlements for affected parties to learn which institution is responsible for a system and to access clear information about criteria or procedures used by systems affecting them, subject to trade-secret protections. 3) Risk Management and Documentation: The concept of an AI impact report is central: agents must document lifecycle stages, safeguards, mitigation measures, and risk-management practices. Public authorities may request publication of such reports and recommend standards. 4) Data Protection and Interoperability: The bill explicitly references compliance with the LGPD (Law No. 13.709/2018) and directs public procurement and deployment to favor open standards and interoperability. 5) Public Sector Use: The law mandates capacity-building in public services, encourages AI adoption to improve efficiency, and requires guidance for transparent and ethical public-sector use. These focus areas create a mixed regulatory regime combining rights protection with pro-innovation directives. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Implementation Framework

Implementation under PL 21/2020 would rely on a combination of legislative articulation and administrative guidance: obligations rest on AI agents (developers and operators) to perform prior evaluation of objectives, benefits and risks; to prepare and, when required, publish AI impact reports; to ensure LGPD compliance; to maintain traceability of processes and decisions during the lifecycle; and to protect systems versus cybersecurity threats. Public procurement guidance and incentives (open formats, standards) are tools the bill recommends to catalyze adoption. Implementation therefore demands (i) administrative rules or normative acts to elaborate procedural expectations; (ii) technical standards for documentation and interoperability; and (iii) capacity-building programs for both public administrators and private operators—tasks consistent with the MCTI-led EBIA governance architecture and with ANPD’s data-protection remit. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Monitoring and Evaluation

PL 21/2020 provides for monitoring primarily through the requirement that AI agents prepare AI impact reports and make documentation available to authorities on request, enabling supervisory review. The bill delegates enforcement and evaluation to existing legal remedies and to sectoral public authorities that can recommend standards and request reports. For meaningful monitoring, the text implies the need for registries, audit capacities and public reporting practices—functions that typically would be implemented via delegated regulation or administrative instruments. Complementary national strategies such as the EBIA (MCTI) provide the strategic oversight and periodic evaluation mechanisms that would be required to measure adoption, assess systemic risks and update guidance. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Penalties, Liability, and Appeals

PL 21/2020 articulates duties and rights but does not establish an exhaustive, standalone sanctioning regime within its main text. The bill affirms that agents must "respond, in accordance with the law, for decisions taken by an AI system," indicating civil liability principles and the availability of judicial relief for affected parties. Enforcement and penalties would therefore be executed under existing frameworks (civil liability, consumer protection, administrative law and the LGPD) and through judicial actions rather than through a novel fines-and-sanctions matrix in the bill itself. The absence of detailed sanctioning rules in PL 21/2020 was one of the aspects debated during legislative review and later Senate consolidation. As a result, implementers would need enabling regulations or complementary statutes to define administrative penalties, remediation procedures and appeals channels. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

Relationship to Other Instruments

PL 21/2020 situates itself alongside Brazil’s LGPD (Law No. 13.709/2018) and the national AI strategy (EBIA). It was part of a larger legislative ecosystem: other bills addressing AI and digital governance were considered in the Chamber and the Senate and were later consolidated into substitute texts (notably PL 2338/2023 and associated proposals), which absorbed or reworked many provisions from PL 21/2020. The bill’s textual references to data protection link it directly to the ANPD’s supervisory remit and to existing consumer-protection and civil-liability instruments. Internationally, the bill’s principles reflect OECD, G20 and UNESCO recommendations on human-centric AI. ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))

International Alignment

PL 21/2020 emphasizes convergence with global technical standards and cooperation: it calls for adherence to international technical standards to permit interoperability and for international cooperation and knowledge-sharing. The bill’s human-centric principles (transparency, robustness, accountability) align closely with OECD AI principles and with initiatives such as the EU AI Act discussions, UNESCO guidance and OECD policy instruments. These cross-border alignments are intended to facilitate trade, research collaboration and the adoption of global best practices, while leaving space for Brazil-specific calibrations, including the primacy of LGPD protections for personal data. ([gov.br](https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/estrategia-brasileira-de-inteligencia-artificial?utm_source=openai))

Implementation Timeline

Milestone	Date	Notes
Introduction to Chamber (presentation)	2020-02-04	Authored by Deputy Eduardo Bismarck; full text published by Câmara. Full text (PDF). ([camara.leg.br](https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1853928&filename=PL+21%2F2020))
Chamber approval (text-base)	2021-09-29	House approved substitute text; sent to Senate for consideration. ([camara.leg.br](https://www.camara.leg.br/noticias/811365-aprovado-texto-base-de-projeto-que-regulamenta-uso-da-inteligencia-artificial-acompanhe/?utm_source=openai))
Senate consolidation / substitute adoption	2023-2024	Senate considered consolidated proposals (including PL 21/2020) and produced substitute drafts; process culminated in substitution/archiving of older bills. ([www25.senado.leg.br](https://www25.senado.leg.br/web/atividade/materias/-/materia/151547?utm_source=openai))
Archived / prejudiced in the Senate	2024-12-10	PL 21/2020 marked prejudiced/archived after Senate substitute adoption; content influenced subsequent legislative initiative(s). ([camara.leg.br](https://www.camara.leg.br/propostas-legislativas/2236340))

Compliance Checklist

Requirement	Who	Evidence/Artifacts
Define AI system and lifecycle roles	Developers/Operators	Internal policies; procurement documents; architecture diagrams
Conduct prior evaluation of objectives, benefits and risks	Developers/Operators	Risk-assessment memos; meeting minutes; decision logs
Prepare AI impact report	Developers/Operators	AI impact report (lifecycle description, safeguards, mitigation measures)
Provide affected parties with clear information	Developers/Operators	User notices; transparency statements; communications
Assure LGPD compliance for data used	Developers/Operators	Data protection impact assessments; DPO records; processing records
Maintain cybersecurity protections and traceability	Developers/Operators	Security audits; logs; patch management records
Publish responsible institution information	Developers/Operators	Public registry entries; published contact details

Sources and References

Source	Type
Projeto de Lei n. 21/2020 - Full text (Câmara dos Deputados PDF)	Primary Source
PL 21/2020 - Proposition page (Câmara dos Deputados)	Primary Source (procedural history)
Projeto de Lei n° 21/2020 - Senado Federal (matter page)	Primary Source (Senate procedural history)
MCTI - Brazilian Artificial Intelligence Strategy (EBIA)	Official policy/strategy
ANPD - Autoridade Nacional de Proteção de Dados	Regulatory authority (data protection)

Brazil's proposed AI law, Projeto de Lei nº 21/2020 (PL 21/2020), aimed to establish foundational principles and rules for the development and use of artificial intelligence systems across the country, applying to both public and private sector developers and operators. While this specific bill was ultimately withdrawn and archived in the Senate, its core ideas significantly influenced subsequent legislative efforts to regulate AI in Brazil.

The bill sought to define what constitutes an AI system and its lifecycle, outlining key responsibilities for those who create and operate them. Its main obligations for AI agents included: - Ensuring transparency by providing affected individuals with clear information about how AI systems make decisions. - Conducting prior risk assessments and preparing "AI impact reports" that document the system's lifecycle, safeguards, and risk mitigation measures. - Upholding robust cybersecurity protections and ensuring full compliance with Brazil's General Data Protection Law (LGPD) for any personal data used. - Holding developers and operators accountable for decisions made by their AI systems under existing legal frameworks.

Crucially, PL 21/2020 never became law, so it did not take effect. Instead, its provisions were absorbed into later, consolidated proposals in the Senate. Had it passed, the bill did not introduce a new, dedicated penalty system. Instead, enforcement would have relied on existing legal remedies, such as civil liability, consumer protection laws, and the LGPD, meaning affected parties would pursue redress through established channels rather than a new AI-specific regulator. A practical pitfall for businesses is that while this specific bill is gone, its principles—especially around transparency, risk management, and data protection—remain highly relevant and are likely to reappear in any future enacted AI legislation in Brazil.

Brazil - AI Development Framework (21/2020)

Summary

Plain English