No. As of October 2026, Brazil has no AI law in force. The AI bill, PL 2338/2023, passed the Senate on 10 December 2024 and is still waiting for its rapporteur's report in a special committee of the Câmara dos Deputados, the lower house. What applies to enterprise AI today is the general data protection law, the LGPD (Lei 13.709/2018), enforced by the ANPD, which since February 2026 has been called the Agência Nacional de Proteção de Dados. If an AI tool processes personal data of people in Brazil, the LGPD already governs it.
That covers most enterprise AI.
Prompts carry customer names and tax numbers, and scoring models decide who gets credit. None of this waits for the AI bill, and the regulator has already acted against a company training generative AI on Brazilian users' data.
Last verified: 19 October 2026, against the LGPD, Lei 15.352/2026 and the 2019 veto message on planalto.gov.br, ANPD Resolution 15/2024 (signed text in the Ministry of Justice digital library), Resolutions 19/2024 and 32/2026 on the ANPD's pages (Resolution 32 in its English version), ANPD consultation, sandbox and enforcement documents, and the Câmara and Senate records for PL 2338/2023. The Diário Oficial website could not be reached, so no gazette page was read directly.
Which rules apply to AI in Brazil right now?
| Instrument | Status as of October 2026 | Who it binds | What you need to evidence |
|---|---|---|---|
| PL 2338/2023, the AI bill | Passed the Senate 10 December 2024; awaiting the rapporteur's report in a Câmara special committee | No one yet | Nothing yet. If enacted as passed by the Senate: risk classification and governance for high-risk systems |
| LGPD, Lei 13.709/2018 | In force | Anyone processing personal data in Brazil, offering goods or services to people in Brazil, or handling data collected in Brazil (Art. 3) | A record of processing for each AI use, a named data protection officer, security measures |
| LGPD Art. 20, automated decisions | In force | Controllers whose decisions rest solely on automated processing | Which decisions are solely automated, the criteria you can explain, and how review requests are handled |
| ANPD Resolution 19/2024, international transfers | In force; the 12-month window to adopt the standard clauses has closed | Exporters of personal data from Brazil | A transfer mechanism for every AI vendor abroad, with the ANPD clauses adopted unaltered |
| ANPD Resolution 32/2026, EU adequacy | In force | Transfers to the EU and EEA | That the vendor actually processes the data in the EU or EEA |
| ANPD Resolution 15/2024, incidents | In force | Controllers | Notice within three business days where required, and a record of every incident kept for five years |
| Lei 15.352/2026 | In force since 25 February 2026 | The regulator's own status | No new duty for companies |
| Draft ANPD agenda 2027-2028 | Consultation closed 16 October 2026; not adopted | No one | Nothing yet |
What does LGPD Article 20 require for automated decisions?
Article 20 of the LGPD gives the data subject (the titular) a right to request review of decisions taken "unicamente com base em tratamento automatizado", solely on automated processing, that affect their interests. The article names decisions that define a person's personal, professional, consumer or credit profile, or aspects of their personality. A credit score, a CV filter and a fraud flag can all fall inside it if no person takes part in the decision.
Two duties sit beside the review right. Under paragraph 1, the controller must give, on request, "clear and adequate" information about the criteria and procedures used, subject to trade secrets. Under paragraph 2, if that information is withheld on trade-secret grounds, the authority may audit for discriminatory aspects.
Does the review have to be done by a person?
The statute no longer says so. The 2018 text granted review "por pessoa natural", by a natural person. Those words were removed by a provisional measure, MP 869/2018, and the 2019 conversion law, Lei 13.853/2019, kept them out. Congress then added a paragraph 3 requiring review by a natural person. The President vetoed it in Mensagem nº 288 of 8 July 2019, arguing that it would make many business models unviable, startups in particular, and hurt credit risk analysis. The current text reads "§ 3º (VETADO)".
So the law guarantees a review, not a human reviewer. That may change: the ANPD's draft agenda for 2027-2028 lists "Revisão de decisões automatizadas" as an item, and one of its stated challenges is setting criteria for "a eventual exigência de intervenção humana", the possible requirement of human intervention.
Is an impact assessment mandatory?
Not as a standing duty for every project. Article 38 says the ANPD "poderá determinar", may order, a controller to prepare a data protection impact report (relatório de impacto), and Article 10 lets it request one where processing relies on legitimate interest. For any AI use that profiles people or touches sensitive data, have the report ready before anyone asks.
The stakes are set in Article 52. A simple fine can reach 2% of the revenue of the company, group or conglomerate in Brazil in its last fiscal year, net of taxes, "limitada, no total, a R$ 50.000.000,00", capped at R$50 million per infraction. The ANPD can also block or delete the data concerned and suspend or prohibit the processing.
Can staff send personal data to a foreign AI tool?
Only through a route the LGPD allows. Resolution 19/2024, the ANPD's international transfer regulation, defines a transfer as an operation in which one processing agent "transmite, compartilha ou disponibiliza acesso", transmits, shares or gives access to, personal data to another agent. A company in Brazil sending customer records to an AI provider abroad fits that description.
Article 33 of the LGPD then permits a transfer only in listed cases. The two that matter for most AI vendors are an adequacy decision and contractual guarantees.
- Adequacy. The ANPD's Resolution 32 of 26 January 2026 recognizes the European Union, plus Iceland, Liechtenstein and Norway, as adequate. Its transfer page says that so far the EU is the only body recognized this way.
- Standard contractual clauses. For a provider in the United States or anywhere else outside the EU and EEA, there is no adequacy decision, so the transfer needs another mechanism. The usual one is the ANPD's standard clauses, which Article 16 of the regulation says must be adopted "integral e sem alteração", in full and unaltered.
Resolution 19 gave companies already using contractual clauses up to 12 months from publication to incorporate the ANPD's clauses. The ANPD gives the publication date as 23 August 2024; by our arithmetic the window closed on 23 August 2025. A vendor contract that relies only on GDPR clauses is worth checking with counsel, since foreign clauses count only if the ANPD recognizes them as equivalent.
A transfer clause covers only the vendors you know about. An employee who opens a free chatbot account has created a transfer with no contract at all.
What if an AI tool exposes personal data?
Article 48 requires the controller to notify the ANPD and the data subject of a security incident "que possa acarretar risco ou dano relevante", one that may cause relevant risk or harm. Resolution 15/2024 sets the clock: three business days, counted from when the controller learns the incident affected personal data. Notice to affected people runs on the same three business days.
Relevant risk has a test. Under Article 5, the incident must be able to significantly affect people's interests and fundamental rights and also involve at least one listed criterion: sensitive data, data of children, adolescents or older people, financial data, authentication data, data under legal or professional secrecy, or data at large scale. Whether a paste into an unapproved AI tool is an incident at all is a judgment for your data protection officer, but the regulation defines one broadly as "qualquer evento adverso confirmado", any confirmed adverse event affecting confidentiality, integrity, availability or authenticity.
One duty applies even when no notice is due. Article 10 requires the controller to keep a record of every security incident, including those not reported, for at least five years.
What has the ANPD done on AI so far?
Four things matter.
The new name. Lei 15.352 of 25 February 2026 converted provisional measure MP 1.317/2025 into law. The ANPD is now the Agência Nacional de Proteção de Dados, a special autarchy (an independent federal body) under the regulatory agencies law, with technical, administrative and financial autonomy among others. The acronym stays the same. The law does not mention artificial intelligence, so it gives the ANPD no new AI powers; the AI bill would do that.
The Meta case. On 1 July 2024, according to the ANPD's own technical note, its board issued a preventive measure (medida preventiva) suspending, in Brazil, the part of Meta's new privacy policy that allowed personal data to be used to train generative AI, and the processing itself, under a daily fine of R$50,000. The rapporteur's vote cited signs of no appropriate legal basis, too little transparency, limits on rights, and children's data processed without safeguards. The ANPD then reviewed a compliance plan from the company. The LGPD reached AI training with no AI statute in place.
The sandbox and guidance. The ANPD runs a pilot regulatory sandbox on AI and data protection and has published three partial monitoring reports. The third volume of its Radar Tecnológico series covers generative AI, including web scraping and synthetic content; an English version was released in July 2026.
The agenda. The consultation on the ANPD's 2027-2028 regulatory agenda accepted contributions until 16 October 2026 and is now closed. The draft includes "IA generativa e proteção de dados", whose listed challenges start with when legitimate interest can justify training and operating generative AI, and the review of automated decisions discussed above. It binds no one yet.
What would the AI bill change?
A lot, eventually. The text the Senate sent to the Câmara is risk-based. Article 13 prohibits "excessive risk" uses, such as exploiting people's vulnerabilities to cause harm. Article 14 lists high-risk uses, including recruitment and evaluation of workers and decisions on access to essential services. Article 45 would make the ANPD the authority coordinating a national AI regulation system, and Article 50 copies the LGPD's fine ceiling. Most of the law would take effect 730 days after publication.
None of that is law. The Senate approved its substitute text on 10 December 2024, according to the Senate record, and sent it to the Câmara in March 2025. The Câmara created a special committee in April 2025 and named a rapporteur on 20 May 2025. Its tracking page shows "Aguardando Parecer do(a) Relator(a)", awaiting the rapporteur's report. The latest step, on 2 September 2026, was a procedural notice about attached bills.
What should a company operating in Brazil do now?
- Build the inventory. List every AI tool and agent in use, approved or not, and mark which receive personal data of people in Brazil.
- Write the rule first. Accountability and transfers both start with a written decision about which AI tools may receive which personal data. Our AI acceptable use policy template is useful here because it gives you that rule in a form you can map to Article 33 mechanisms and your record of processing.
- Check each vendor's transfer route. EU or EEA processing can rely on Resolution 32; anything else usually needs the ANPD clauses, unaltered.
- Find the solely automated decisions. Write down the criteria you would disclose and who handles review requests.
- Prepare the impact report before it is requested. Start with AI uses that profile people or touch sensitive data.
- Update the incident runbook. Three business days, the Article 5 criteria, and a five-year record of every incident.
What can software do, and what stays with people?
Software cannot write your impact report, draft a transfer clause, or decide whether a decision is solely automated. Those are calls for the encarregado, the data protection officer every controller must name, and for counsel. No tool makes a company compliant with the LGPD.
What software can carry is the evidence underneath those calls. AccuroAI discovers 1,400+ AI tools, including the ones staff adopted without asking, which is where most unmanaged transfers begin. It inspects prompts and uploads with 40+ data classifiers and redacts or blocks personal data in line before it reaches an unapproved tool. It enforces at the point of use without TLS interception, and it logs every event against a user and a tool, so you can show the ANPD what left and what was stopped. For the fields such a log should hold, see our AI agent audit log guide.
Frequently asked questions
Does the LGPD require a human to review automated decisions?
The current text grants a right to request review but does not say it must be done by a person; the paragraph that required that was vetoed in 2019. The ANPD's draft agenda raises whether human intervention should be required in some cases.
Do we have to notify the ANPD if an employee pastes customer data into a public chatbot?
Only if it is an incident that may cause relevant risk or harm under the Article 5 test. You must record it either way, and keep that record for five years.
Is the ANPD a different regulator now?
Same regulator, new name and stronger legal status. Since Lei 15.352/2026 it is the Agência Nacional de Proteção de Dados, with financial autonomy as a special autarchy.
How does Brazil compare with Europe and Canada?
Like Canada, Brazil governs AI through privacy law while an AI bill waits. For Europe, see our GDPR and enterprise AI guide; the AI compliance hub tracks other jurisdictions.
This is not legal advice. Statutory text is quoted from planalto.gov.br as consolidated on 19 October 2026; confirm against the Diário Oficial and ask Brazilian counsel before relying on it.
Sources
- Lei nº 13.709/2018, Lei Geral de Proteção de Dados Pessoais, consolidated text, Planalto
- Mensagem nº 288, de 8 de julho de 2019, partial veto of Lei 13.853/2019
- Lei nº 15.352, de 25 de fevereiro de 2026, Planalto
- Resolução CD/ANPD nº 15/2024, Regulamento de Comunicação de Incidente de Segurança (Ministry of Justice digital library copy); Diário Oficial entry
- Resolução CD/ANPD nº 19/2024, Regulamento de Transferência Internacional de Dados
- Resolution CD/ANPD No. 32/2026, EU adequacy (ANPD English version), and the ANPD international transfer page
- Regulamentações da ANPD, index of resolutions and their status
- ANPD consultations and the draft 2027-2028 regulatory agenda
- ANPD regulatory sandbox on AI and data protection
- Radar Tecnológico: Inteligência Artificial Generativa, English version announcement, July 2026
- ANPD Voto nº 11/2024/DIR-MW/CD and Nota Técnica nº 39/2024/FIS/CGF/ANPD (Meta)
- PL 2338/2023, Câmara dos Deputados tracking page, and the text approved by the Senate
- PL 2338/2023, Senado Federal record