Brazil - National AI Regulation (2.338/2023)

Overview

Projeto de Lei nº 2.338/2023 is a proposed national framework intended to regulate the development, deployment and use of artificial intelligence systems across Brazil. The bill sets out principles (human centrality, non‑discrimination, transparency, robustness and security), substantive rights for persons affected by AI (information, explainability, contestability and human review) and a risk‑based regulatory architecture with differentiated obligations for systems classified as high or excessive risk. The text approved by the Senate and made available publicly consolidates earlier committee substitutive measures; the official consolidated text can be consulted in the Senate's published PDF (see PL 2338/2023 — consolidated text (Senate PDF)). The bill foresees a national governance structure (the System for AI Regulation and Governance — SIA) to coordinate rulemaking and supervision and contemplates the role of sectoral authorities, a committee of specialists and mechanisms such as sandboxes to balance oversight with innovation.

Definitions

PL 2338 provides specific statutory definitions that structure its obligations. Core definitions include "system of artificial intelligence" (computer systems designed to produce predictions, recommendations or decisions that can affect the virtual or real environment), "supplier" (natural or legal person that develops AI systems) and "operator" (user or deployer that employs AI for its own benefit). The draft also defines "authority competent" (to be designated by the Executive, with duties to implement and enforce the law), "risk classification" categories and terms such as "mining of texts and data" and "discrimination" (a broad definition aligned with constitutional non‑discrimination norms). These definitions anchor responsibilities and procedural guarantees throughout the bill.

Governance and Institutional Framework

The bill establishes a multi‑tier governance model named SIA (System for AI Regulation and Governance). The SIA is composed of the designated authority ("authority competent"), sectoral regulators, a permanent Council of Regulatory Cooperation (CRIA) and a Committee of Experts and Scientists on Artificial Intelligence (CECI A). While the Executive is tasked with designating the authority competent, public commentary and technical commentary from the Autoridade Nacional de Proteção de Dados (ANPD) have recommended that ANPD assume a central regulatory coordination role, particularly where AI intersects with personal data and LGPD obligations (see ANPD's Note Technical contributions at ANPD — second analysis of PL 2338/2023). The authority competent will adopt regulations, lead consultations, coordinate with sectoral authorities and oversee public registries, sandboxes and conformity assessment processes. The law anticipates public consultation and regulatory impact analysis in secondary rulemaking.

Key Focus Areas

PL 2338 concentrates obligations across several core domains: rights of affected individuals (information, explanation, contestability and human review); transparency (disclosure of automated interactions, explicit notices for biometric and emotion‑recognition systems, metadata requirements); governance (internal programs of governance, codes of conduct, traceability and logging); risk management (classification, algorithmic impact assessments and mitigation measures); conformity assessment and certification for high‑risk systems; incident reporting of serious incidents to the authority competent; market surveillance powers for enforcement; liability and redress rules including objective liability presumptions for high‑risk systems; and administrative sanctions ranging from warnings to significant fines and operational suspensions. Special attention is given to vulnerable populations, minors and to situations where AI produces effects with legal or significant factual impacts on rights and interests.

Implementation Framework

Implementation is intended to be carried out by the authority competent (designated by the Executive) in coordination with sectoral regulators. The bill delegates many technical and procedural specifications to regulation: the criteria for risk classification, the content and frequency of algorithmic impact assessments, audit and documentation formats, requirements for conformity assessment and the operational rules for sandboxes. The text allows voluntary codes of good conduct and contemplates accreditation and certification mechanisms; adherence to approved codes may be considered as evidence of good faith during enforcement proceedings. The Executive must publish a list of SIA members and the authority will publish annual reports on its activities. The law also foresees differentiated processes and communication channels for micro and small enterprises and startups to avoid disproportionate burdens.

Monitoring and Evaluation

Monitoring mechanisms combine mandatory reporting (serious incidents must be reported to the authority competent) with regulatory supervision, periodic audits, public registries and market surveillance authority powers. The authority may request technical information from public bodies operating AI and may coordinate joint inspections with sectoral agencies. The bill requires the authority to issue annual activity reports and to use public consultation and regulatory impact assessment before issuing norms. Sandboxes are explicit instruments to be monitored and may be conditioned to reporting obligations. Conformity assessment reports, impact assessments and audit trails are expected to form the evidentiary basis for supervision and corrective measures.

Penalties, Liability, and Appeals

PL 2338 sets an administrative sanctioning regime that includes warnings; fines up to R$50,000,000 per infraction (or up to 2% of the company's Brazilian turnover for private legal persons, subject to limits); publicization of infractions; suspension or prohibition from sandboxes; temporary or definitive suspension of development, supply or operation; and prohibition of treatment of certain data sets. Sanctions must observe due process, proportionality and the opportunity for defense. On civil liability, the draft provides objective liability for providers/operators of high‑risk or excessive‑risk systems and presumes the victim's position in many cases (including inversion of the burden of proof) to facilitate redress. The bill preserves judicial and administrative appeals and aligns consumer‑sector claims with the Consumer Protection Code.

Relationship to Other Instruments

The bill explicitly references alignment with the Lei Geral de Proteção de Dados (LGPD) and the Consumer Protection Code. It is designed to operate as a sector‑neutral national framework that coordinates with sectoral regulators (e.g., health, financial, communications and safety regulators) and avoids supplanting sectoral competence. The SIA's model contemplates coordination channels and a forum for sector regulators. The text also anticipates the need for additional executive regulations to operationalize definitions and assessment methodologies.

International Alignment

PL 2338 is explicitly influenced by comparative regulatory models, notably the EU AI Act; it reflects international practices on risk‑based classification, transparency duties and conformity assessment while adapting enforcement and liability rules to Brazil's legal environment. The bill contemplates cross‑border cooperation and international technical cooperation, and delegates to the authority competent the power to coordinate with foreign regulators and international bodies. ANPD contributions have compared the PL's architecture to EU experiences and recommended institutional arrangements that replicate the benefits of centralized coordination in other jurisdictions (see ANPD analysis at ANPD — PL analysis).

Implementation Timeline

Event	Date
Project filed in Senate	2023-05-03
Senate consolidated report and plenary approval (substitutive text)	2024-12-10
Transmitted to Chamber of Deputies (received)	2025-03-17
Referral to Special Committee, Chamber of Deputies	2025-04-04 (committee established)

Compliance Checklist

Requirement	Who	Action
Risk classification	Suppliers/Operators	Assess and classify system risk level; document methodology
Algorithmic Impact Assessment	Suppliers/Operators	Conduct and retain assessments for high‑risk systems
Governance Program	Suppliers/Operators	Implement internal governance, audits, mitigation plans
Transparency Notices	Suppliers/Operators	Provide prior information, icons and explanations to users
Incident Reporting	Suppliers/Operators	Report serious incidents to authority competent within regulatory timeframe
Conformity Assessment / Certification	Suppliers/Operators	Obtain required conformity/certification for high‑risk systems

Sources and References

Source	Type
Projeto de Lei nº 2.338/2023 — Consolidated text (Senate PDF)	Primary Source
Congress of Brazil — PL 2338/2023 record (transmission & tramitation)	Primary Source
ANPD — Second analysis / Nota Técnica on PL 2338/2023	Primary Source