TerraLex AI Guide

Brazil is actively developing its regulatory framework for artificial intelligence. The primary legislative initiative is Bill No. 2338/2023, known as the Brazilian AI Legal Framework. Bill No. 2338/2023 was approved by the Senate on December 10, 2024, and is currently under discussion in the Chamber of Deputies.

Bill No. 2338/2023 defines an artificial intelligence system as a computational system with varying degrees of autonomy, designed to infer how to achieve a given set of objectives. It utilizes approaches based on machine learning and/or logic and knowledge representation, through input data from machines or humans, with the goal of producing predictions, recommendations, or decisions that can influence the virtual or real environment.

Bill No. 2338/2023 establishes general national norms for the development, implementation, and responsible use of AI systems in Brazil. Its core objective is to protect fundamental rights and ensure the implementation of safe and reliable systems, benefiting human beings, the democratic regime, and scientific and technological development.

The regulatory approach is risk-based and rights-based. It introduces governance tools and an institutional framework for oversight and supervision, aiming to create predictability in interpretation and legal certainty for innovation and technological development. Bill No. 2338/2023 emphasizes that protecting fundamental rights and freedoms, valuing work, and human dignity are not in conflict with economic order and the creation of new value chains; rather, its foundations and principles seek harmonization in accordance with the Brazilian Federal Constitution.

Bill No. 2338/2023 applies to "AI Agents," which are categorized into two main groups: providers and deployers. Providers are natural or legal persons, public or private, responsible for the development, creation, or marketing of an AI system (including importers and distributors). Deployers are natural or legal persons, public or private, who use or operate the AI system.

The regulation encompasses both public and private entities, regardless of whether the system creates results within Brazil or abroad, provided that the system is used or produces effects within the Brazilian national territory.

The Brazilian Data Protection Law (Law No. 13.709/2018) is directly applicable to AI systems, particularly concerning the use of personal data for training. The Brazilian Data Protection Law, inspired by the General Data Protection Regulation (GDPR), regulates personal data processing activities (collection, storage, use, sharing) to protect fundamental rights like freedom and privacy.

Regarding intellectual property, the Brazilian Copyright Law (Law No. 9.610/1998) defines authors as "natural persons". This implies that works purely generated by AI are not protected by copyright and fall into the public domain.

Bill No. 2338/2023 establishes general national norms for the development, implementation, and responsible use of AI systems in Brazil.

Bill No. 2338/2023 applies to both private and public entities and covers a wide range of sectors, including critical infrastructure, education, employment, essential public and private services, finance, emergency response, justice administration, autonomous vehicles, healthcare, biometrics, criminal investigation, and migration management.

The Executive Branch will designate a competent authority responsible for overseeing the implementation and enforcement of Bill No. 2338/2023. This authority will be the central body for applying the law and establishing norms and guidelines for its implementation. Its responsibilities include protecting fundamental rights, promoting the Brazilian AI Strategy, conducting studies, encouraging best practices, cooperating with international authorities, issuing regulations, coordinating with sectoral regulatory authorities, overseeing compliance, and applying sanctions.

Bill No. 2338/2023 establishes a coordinated regulatory system (asymmetric regulation). While a central "competent authority" coordinates the framework, sectoral regulatory agencies (such as the Central Bank of Brazil, CVM, ANVISA, and ANATEL) retain the power to regulate, supervise, and apply sanctions regarding AI systems within their specific industries.

AI agents who violate the norms of Bill No. 2338/2023 are subject to administrative sanctions applied by the competent authority. These sanctions, applied after an administrative procedure ensuring the right to a fair hearing, can be gradual, isolated, or cumulative, considering factors like gravity, nature of infractions, good faith, economic condition, and cooperation.