AI regulation in Brazil: the approach in brief

Short answer: Brazil does not yet have an AI law in force, but it is building a horizontal, risk-based framework: bill PL 2338/2023. The Senate adopted the text on 10 December 2024; since 17 March 2025 it has been before the Chamber of Deputies. Only after the Chamber accepts it and it is enacted can the law take effect.

A horizontal framework on the European model

PL 2338/2023 was introduced by Senator Rodrigo Pacheco, then president of the Senate. Unlike vertical, sectoral approaches, Brazil opts for a horizontal law: a single framework that broadly governs the development and use of AI systems. The adopted text is a revised version (substitutivo) led by rapporteur Senator Eduardo Gomes. With the approval of PL 2338/2023, several earlier proposals — including PL 21/2020 and PL 5051/2019 — were set aside, making this bill the central regulatory line.

In structure the proposal leans recognisably on the EU approach: a combination of fundamental rights protection, a risk-based classification, and obligations that grow heavier as the application risk rises.

A risk-based classification

The core is a classification by risk. The bill distinguishes applications of excessive risk, which are in principle prohibited, and high-risk applications, which are permitted under stricter conditions such as governance, documentation and human oversight. This layering parallels the logic of the EU regulation, where prohibited practices and high-risk obligations likewise form the two heaviest categories. For the precise scope of categories, thresholds and exceptions the official bill text is authoritative; it may still change during the Chamber's deliberations.

Oversight and what this means for organisations

The bill provides for an oversight structure for compliance with the rules. The precise institutional design — which authority coordinates and how supervision is distributed — is among the elements that may still be refined in the legislative process and must therefore be read from the current official text, not from earlier versions.

For organisations supplying in or to Brazil, the key point is that the status is a bill: no binding AI obligations apply yet under this framework, and the final text may differ from the Senate version. What is clear is that Brazil is adopting the EU's risk-based grammar — a pattern visible elsewhere among emerging jurisdictions too. Those who want to work ahead now can already map their own AI applications against a risk classification; the instruments, thresholds and enforcement routes must be read on each legal order's own terms.

Read more: International AI governance. Take the scan.