Brazil AI Regulation Overview

Overview

Brazil's national approach to artificial intelligence regulation reflects a dual model transitioning from non-binding strategic frameworks to binding domain rules and pending horizontal legislation. The foundation of federal policy was laid by the Estratégia Brasileira de Inteligência Artificial (EBIA), established under Portaria MCTI nº 4.617/2021 and updated by Portaria MCTI nº 4.979/2021, which articulates core principles and thematic axes for AI research, development, and ethics. Executive coordination is orchestrated through Decree No. 12.308/2024, which instituted the Interministerial Committee for Digital Transformation (CITDigital), and implementing acts such as Resolução CITDIGITAL nº 2/2025 and Portaria nº 8/2025 establishing the Group of Work (GT-PBIA) to manage the Plano Brasileiro de Inteligência Artificial (PBIA).

While general statutory regulation remains under review in the National Congress through Projeto de Lei nº 2.338/2023, specific state branches have introduced binding requirements. Most prominently, the Brazilian Judiciary established a comprehensive governance and risk-based control framework through Resolução CNJ nº 615/2025 and Portaria CNJ nº 270/2025, which mandates algorithmic impact assessments, risk classification, and central registration on the Sinapses platform for all court AI systems. Municipal deployments, such as São Paulo's Programa Smart Sampa (Decree Nº 63.552/2024), demonstrate the operational deployment of municipal AI surveillance under strict personal data protection safeguards.

Regulatory Approach

Brazil employs a hybrid regulatory approach combining horizontal strategic guidance, risk-based sectoral directives, and pending cross-sector legislation. Soft-law policy measures—exemplified by EBIA and the PBIA operationalized through CITDigital—focus on fostering technological innovation, capacity building, research infrastructure, and public service modernization. These policies rely on interministerial coordination led by Casa Civil and the Ministry of Science, Technology and Innovations (MCTI) without imposing direct statutory sanctions on private developers.

In contrast, binding regulatory regimes rely on a risk-based classification model. Under Resolução CNJ nº 615/2025, judicial AI applications are explicitly split into high-risk (such as evidence evaluation, legal conclusion formulation, and biometric identification) and low-risk categories, with absolute prohibitions on excessive-risk uses that preclude human oversight. This risk-tiered philosophy aligns with the main draft law, Projeto de Lei nº 2.338/2023, which proposes a comprehensive horizontal system categorizing AI into excessive-risk (prohibited), high-risk (subject to mandatory algorithmic impact assessments and auditing), and non-high-risk tiers.

Key AI Legislation

• Estratégia Brasileira de Inteligência Artificial (EBIA) (Portaria MCTI nº 4.617/2021 & nº 4.979/2021): National strategy defining nine thematic axes, 73 strategic actions, and guiding principles for responsible AI development and research.
• Decreto nº 12.308/2024: Institutes the Interministerial Committee for Digital Transformation (CITDigital) under Casa Civil to coordinate federal digital policy and data infrastructure.
• Resolução CITDIGITAL nº 1/2025, nº 2/2025 & Portaria nº 8/2025: Establishes the Internal Rules of CITDigital's Executive Committee and creates the GT-PBIA managed by MCTI to execute the Plano Brasileiro de Inteligência Artificial.
• Resolução CNJ nº 615/2025 & Portaria CNJ nº 270/2025: Comprehensive binding AI governance framework for the Brazilian Judiciary, establishing risk classifications, mandatory Sinapses registration, algorithmic impact reports, and the Comitê Nacional de Inteligência Artificial do Judiciário (CNIAJ).
• Projeto de Lei nº 2.338/2023 (Under Review): Consolidated draft national AI bill passed by the Senate in December 2024 and currently before a Special Committee in the Chamber of Deputies, proposing a risk-based framework, affected individuals' rights, and the System for AI Regulation and Governance (SIA).
• Programa Smart Sampa (Decree Nº 63.552/2024): Municipal AI public security initiative in São Paulo deploying facial recognition and video surveillance subject to LGPD compliance and management by SMSU and CGT-SMART SAMPA.
• Archived Legislative Proposals (PL 21/2020, PL 5.691/2019, PL 5.051/2019): Early legislative bills setting out principles and foundational rules, declared prejudiced and archived in December 2024 following Senate consolidation into PL 2338/2023.

Governance & Enforcement Bodies

Executive branch coordination for national AI policy and digital transformation is anchored in the Interministerial Committee for Digital Transformation (CITDigital), established by Decree No. 12.308/2024. Chaired by the Casa Civil, CITDigital operates through an Executive Committee (governed by Resolução CITDIGITAL nº 1/2025) and specialized bodies, including the Group of Work for the Management of the PBIA (GT-PBIA). Coordinated by MCTI pursuant to Resolução CITDIGITAL nº 2/2025 and Portaria nº 8/2025, GT-PBIA unites 16 federal entities—including BNDES, FINEP, CNPq, CAPES, EMBRAPII, and key ministries—to align investments, computing infrastructure, and public service AI projects.

Within the judicial branch, governance is centralized under the Conselho Nacional de Justiça (CNJ). Resolução CNJ nº 615/2025 instituted the Comitê Nacional de Inteligência Artificial do Judiciário (CNIAJ), formally designated by Portaria CNJ nº 270/2025. CNIAJ functions as an interdisciplinary oversight body comprising magistrates, public prosecutors, defenders, the Bar Association (OAB), technical staff, academia, and civil society. CNIAJ is tasked with monitoring system implementations, defining technical audit protocols, conducting risk reclassifications, overseeing the Sinapses public catalog, and ensuring LGPD compliance. At the national statutory level, Projeto de Lei nº 2.338/2023 proposes the System for AI Regulation and Governance (SIA), to be led by a central executive competent authority in close coordination with the Autoridade Nacional de Proteção de Dados (ANPD) and sectoral regulators.

Penalties & Enforcement

Enforcement modalities currently vary across binding administrative instruments and proposed statutory provisions. Under the Judiciary's Resolução CNJ nº 615/2025, administrative enforcement includes system risk reclassification, mandatory external audits, incident reporting to CNIAJ within 72 hours, and recommendations for system suspension or decommissioning. Tribunals failing to conform to Sinapses registration or impact assessment standards face corrective directives, internal administrative procedures, and potential contractual remedies against technology vendors.

For broader commercial and private sector deployments, significant administrative sanctions are set out in pending legislation. Projeto de Lei nº 2.338/2023 empowers a designated competent authority to issue administrative warnings, order partial or total suspension of AI operations, and impose monetary fines of up to R$ 50,000,000 or up to 2% of a company or group's annual turnover in Brazil. Executive strategic policy instruments (such as EBIA and CITDigital resolutions) carry no independent administrative fine structure, relying on existing legal mechanisms, including the Lei Geral de Proteção de Dados (LGPD).

Data Protection Framework

Personal data processing within AI systems in Brazil is strictly subject to the Lei Geral de Proteção de Dados (LGPD — Lei nº 13.709/2018), enforced by the Autoridade Nacional de Proteção de Dados (ANPD). Brazilian AI regulatory measures consistently incorporate LGPD principles, emphasizing privacy-by-design, privacy-by-default, data quality, representativeness, and explicit legal bases for training and operating algorithmic models across both public and private sectors.

Specific binding rules enforce data protection constraints on model usage. Under Resolução CNJ nº 615/2025, courts using third-party cloud solutions or commercial large language models (LLMs) are prohibited from processing secret or justice-protected data unless fully anonymized at origin, and vendor contracts must explicitly prohibit the unauthorized use of judicial data for model training. Municipal programs like São Paulo's Smart Sampa (Decree Nº 63.552/2024) similarly mandate strict LGPD alignment and CGT-SMART SAMPA council oversight to govern personal data collected via public facial recognition networks.

Sector-Specific Rules

Sector-specific AI regulation is most highly developed in the judicial domain through Resolução CNJ nº 615/2025. The resolution establishes clear risk tiers tailored to judicial work, categorizing evidence valuation (AR2), classification of criminal conduct (AR3), formulation of legal conclusions or damages quantification (AR4), and biometric identification or monitoring (AR5) as high-risk applications. These systems require preliminary evaluations, human-in-the-loop oversight, explainability mechanisms, and periodic audits.

In municipal public security and smart city operations, São Paulo's Programa Smart Sampa operates under Decree Nº 63.552/2024, deploying intelligent video surveillance and facial recognition to match fugitives and missing persons across municipal and private camera feeds. Where other specific sectors are concerned—such as healthcare AI, financial AI, autonomous vehicles, or employment—the corpus holds no separate standalone federal sector-specific codes, though sector representative bodies (such as the Ministry of Health under Resolução CITDIGITAL nº 3/2025) participate in national policy design through GT-PBIA.

International Alignment

Brazil's national strategy and legislative proposals draw heavily from international frameworks and benchmarks. The Estratégia Brasileira de Inteligência Artificial (EBIA) explicitly aligns its core principles with the OECD AI Principles, emphasizing inclusive growth, human-centered values, transparency, explainability, robustness, security, and accountability across its 73 strategic actions.

Draft national legislation, specifically Projeto de Lei nº 2.338/2023, reflects strong alignment with the European Union's AI Act and OECD guidance, adopting a risk-based classification architecture, mandatory algorithmic impact assessments, regulatory sandboxes, and affected parties' rights to explanation and contestability. Technical standards referenced in binding acts like Resolução CNJ nº 615/2025 similarly build upon international standard-setting bodies, including ISO/IEC and NIST.

Future Developments

The primary legislative focus in Brazil is the ongoing progression of Projeto de Lei nº 2.338/2023 in the National Congress. Following Senate plenary approval in December 2024, the consolidated bill was remitted to the Chamber of Deputies in March 2025, where a Special Committee was formally constituted in April 2025 to evaluate the text, refine regulatory details, and finalize the national governance structure (SIA).

On the executive and institutional front, the Group of Work for the Management of the PBIA (GT-PBIA), created under Resolução CITDIGITAL nº 2/2025 and Portaria nº 8/2025, is advancing execution of the Plano Brasileiro de Inteligência Artificial across national computing infrastructure, capacity building, and enterprise innovation. In the Judiciary, courts are working through a 12-month adaptation period ending in March 2026 to register existing systems on Sinapses and bring them into full compliance with Resolução CNJ nº 615/2025. Meanwhile, early legislative proposals (PL 21/2020, PL 5.691/2019, and PL 5.051/2019) were formally archived in December 2024 as part of the consolidation into PL 2338/2023.

Enforcement Bodies