Legislative Journey of Brazil’s AI Bill (PL 2338/2023)
The Projeto de Lei (PL) 2338/2023, introduced by Senator Rodrigo Pacheco (PSD/MG) on May 3, 2023, was designed to establish a legal framework for the use of artificial intelligence in Brazil. Its primary objective was to regulate AI applications across sectors, ensuring alignment with broader constitutional and legal principles.
The bill underwent review by the Comissão Temporária Interna sobre Inteligência Artificial no Brasil (Temporary Internal Commission on Artificial Intelligence in Brazil), led by Senator Eduardo Gomes (PL/TO). The final version was approved by the Senate Plenary on December 26, 2024, and subsequently forwarded to the Chamber of Deputies on March 17, 2025, for further deliberation.
The legislative process reflects a structured approach to AI governance, with the Senate’s approval marking a significant milestone. The bill’s transition to the Chamber of Deputies indicates ongoing parliamentary scrutiny, where it will be examined by a special committee before potential final approval or revision.
Key Provisions and Regulatory Framework
PL 2338/2023 proposes a risk-based classification system for AI applications, similar to the European Union’s AI Act. This system categorizes AI technologies based on their potential impact on individuals and society, ranging from minimal to unacceptable risk. The bill mandates impact assessments for high-risk AI systems, ensuring transparency and accountability in their development and deployment.
A central feature of the proposed framework is the establishment of a national AI regulatory system under the authority of the Autoridade Nacional de Proteção de Dados (ANPD), Brazil’s data protection authority. The ANPD would oversee compliance, enforcement, and the implementation of regulatory measures, including fines of up to 2% of a company’s annual revenue for non-compliance.
The bill also addresses specific concerns related to AI-generated content, including deepfakes and synthetic media.
Comparative Analysis with Other AI Regulations
PL 2338/2023 draws parallels with international AI governance models, particularly the EU’s AI Act, which employs a tiered risk classification system. However, the Brazilian proposal distinguishes itself by integrating AI regulation within the existing data protection framework, leveraging the ANPD’s infrastructure and expertise.
Stakeholder Involvement and Legislative Challenges
One of the challenges in the legislative process is ensuring broad consensus among deputies in the Chamber of Deputies. Given the bill’s comprehensive scope, it may face amendments or opposition from factions advocating for stricter or more lenient regulations. Additionally, the ANPD’s capacity to enforce the proposed measures will be critical, as its current mandate under the LGPD may require expansion to effectively oversee AI compliance.
The bill’s progression also reflects broader debates in Brazil about the role of technology in society.
Potential Impact on AI Development and Compliance
The risk-tiered approach would encourage responsible innovation by requiring assessments for high-impact AI systems, similar to requirements in the EU and other jurisdictions. Companies operating in Brazil would need to align their AI practices with the ANPD’s guidelines, potentially influencing global compliance strategies.
The proposed fines of up to 2% of annual revenue serve as a deterrent for non-compliance, comparable to penalties under the LGPD. This financial incentive may drive greater adherence to regulatory standards, particularly among large enterprises with significant revenue exposure.
By mandating impact assessments and clear disclosure requirements, PL 2338/2023 may reduce risks associated with AI bias, discrimination, or unintended consequences.
Required actions
- Would ban unacceptable-risk uses such as social scoring and subliminal manipulation - Would require algorithmic impact assessments, governance measures and human oversight for high-risk systems - Would establish a national AI regulation system (SIA) coordinated by the data protection authority ANPD, with rights to explanation and contestation and copyright remuneration for training data