Brazil AI Act: Key Provisions, Risk Tiers, and Business Compliance
Updated: July 2026
Brazil stands at a critical juncture in AI regulation, with its Artificial Intelligence (AI) Act moving through the legislative process. After extensive deliberation spanning two years, the Senate passed a modified version of the bill in December 2024, which was sent to the Chamber of Deputies in March 2025 and remains under review. The proposed law establishes a comprehensive regulatory framework for AI development, deployment, and use, while protecting fundamental rights and ensuring the implementation of secure and reliable AI systems that uphold human dignity, democratic values, and scientific and technological development.
Following a risk-based approach similar to the EU AI Act, it establishes three tiers of AI systems:
• excessive risk (prohibited),
• high risk (heavily regulated), and
• other systems (basic requirements).
The Act will be enforced by a designated authority with the power to impose significant penalties: up to R$50 million per violation or 2% of a company’s revenue in Brazil. If enacted, implementation is expected to follow a staged timeline, with no effective date yet confirmed. The law emphasises human-centric values, mandates algorithmic impact assessments for high-risk systems, establishes civil liability frameworks, and promotes innovation through regulatory sandboxes. Notable provisions include mandatory human oversight, rights to explanation and to contest AI decisions, and strict requirements for public-sector AI use.
This act places Brazil among the first Latin American countries to introduce comprehensive AI regulation, joining the global conversation on AI governance alongside the EU and other jurisdictions developing AI regulatory frameworks.
What is the legislative journey of Brazil’s AI Act?
The journey began in February 2022 when Senate President Rodrigo Pacheco formed a committee of legal experts to draft guidance for AI legislation. The experts delivered their report in December 2022, recommending a risk-based approach. This led to Pacheco’s bill proposal in May 2023, followed by the creation of a temporary commission for artificial intelligence that conducted 24 meetings and 14 public hearings over 19 months.
The Senate’s December 2024 approval came with notable modifications from the original proposal. While Data Privacy Brazil affirmed that “The legislation remains protective of fundamental rights,” several key provisions were altered or removed due to industry pressure. Most notably, algorithms for social media content curation and recommendation were removed from the high-risk category, reducing platform scrutiny requirements.
The bill reached the Chamber of Deputies in March 2025, where it was referred to a special committee. As of mid-2026, it remains pending, with amendments under discussion on biometric surveillance carve-outs and transparency requirements for foundation models. A committee vote is expected before the August 2026 congressional recess.
What is the scope of Brazil’s AI Act?
The Brazilian AI Act adopts a risk-based approach, similar to the EU AI Act, categorising AI systems based on the risks they pose to individuals, society, and institutions. The law applies to all stages of the AI lifecycle, covering development, deployment, and post-market monitoring. It targets a broad audience, including:
• Domestic and international companies offering AI services in Brazil.
• Developers, deployers, and operators of AI systems.
• Organisations that use AI to make decisions that affect individuals or public interest.
The scope of the Act is comprehensive, covering both public and private entities, including natural persons and legal entities involved in the development, provision, deployment, or use of AI systems. However, it does not apply to AI used for non-professional personal activities.
The law also introduces the concept of regulatory sandboxes, encouraging innovation by allowing controlled experimentation under regulatory oversight. It also incorporates provisions for a risk-based approach, meaning different obligations apply depending on the level of risk posed by AI systems, ranging from minimal to high. Special provisions are set for government use, and additional requirements are outlined for high-risk AI applications to ensure they are deployed safely and ethically.
This broad and flexible scope is designed to ensure the regulation of AI in a way that is adaptable to emerging technologies while maintaining fundamental rights, human oversight, and public safety.
What are the main provisions of Brazil’s AI Act?
The proposed Brazilian AI Act emphasises a comprehensive framework that balances innovation with the protection of rights and management of risks. It covers key areas such as risk management, transparency, human oversight, accountability, and consumer protection.
Risk Management: AI systems must undergo a preliminary risk assessment and be categorised into three levels:
• excessive risk (prohibited applications),
• high risk (additional requirements), and
• other risks (basic requirements).
The law mandates risk assessment and mitigation processes based on these classifications to ensure that AI systems are safe for public use.
Transparency: The Act requires AI systems to be explainable and auditable. Companies must ensure that users can understand how AI systems make decisions. This includes:
• the Right to prior information,
• the Right to an explanation of AI decisions, and
• the Right to contest decisions.
Human Oversight: The law mandates effective human supervision throughout the AI lifecycle. This includes the Right to human intervention and emphasises non-discrimination in the use of AI systems.
Accountability: Legal persons behind AI systems are held accountable for compliance with the law and for addressing any resulting harms. This includes establishing liability frameworks, with strict liability for high-risk systems, as well as providing defences and exceptions for responsible actors.
Consumer Protection: Users are granted privacy, data protection, and the Right to challenge AI-driven decisions. The Act also outlines specific rights to protect individuals, such as the Right to non-discrimination and the Right to privacy and data protection.
In addition to these key principles, the Act includes specific provisions for governance, civil liability, oversight, innovation support, and compliance mechanisms. These include documentation requirements, incident reporting, and the promotion of best practices.
Special provisions for public sector AI use and regulatory sandboxes allow for controlled experimentation under oversight. Through these measures, the Brazilian AI Act ensures the responsible use of AI systems while encouraging innovation and protecting fundamental rights.
What values and principles does Brazil’s AI Act establish?
What values underpin Brazil’s AI Act?
The Brazilian AI Act strongly emphasises foundational values that underpin AI development, deployment, and use in Brazil.
These values include:
| Values |
|---|
| 1. Human-centric approach |
| 2. Respect for human rights and democratic values |
| 3. Free development of personality |
| 4. Environmental protection and sustainable development |
| 5. Equality, non-discrimination, plurality, and respect for labour rights |
| 6. Technological development and innovation |
| 7. Free enterprise, free competition, and consumer protection |
| 8. Privacy, data protection, and informational self-determination |
| 9. Promotion of research and development to stimulate innovation in productive sectors and public administration |
| 10. Access to information, education, and awareness about AI systems and their applications |
By explicitly outlining these values, the Act offers clear guidance for legal professionals, businesses, and society at large on the ethical priorities that AI systems should follow. These values are critical for establishing an AI ecosystem that is competitive, responsible, inclusive, and respectful of individual rights.
The importance of these values lies in their role in combating the growing trend of ‘AI exceptionalism,’ where AI technologies are often treated as exceptions to traditional legal frameworks. By prioritising these core values, the Brazilian Act establishes a clear ethical basis for AI governance and ensures that AI systems are deployed in ways that serve broad societal benefit. Unlike the EU AI Act, which reflects similar values, Brazil’s Act includes a more explicit and detailed list that can help businesses align their AI policies more clearly with these ethical guidelines.
What principles guide AI governance under Brazil’s Act?
The principles outlined in Brazil’s AI Act are key guidelines for designing, implementing, and operating AI systems.
These principles include:
| Principles |
|---|
| 1. Inclusive growth, sustainable development, and well-being |
| 2. Self-determination and freedom of decision and choice |
| 3. Human participation and effective human supervision in the AI cycle |
| 4. Non-discrimination |
| 5. Justice, equity, and inclusion |
| 6. Transparency, explicability, intelligibility, and audibility |
| 7. Reliability, robustness of AI systems, and information security |
| 8. Due process, contestability, and contradictory |
| 9. Traceability of decisions as a means of accountability |
| 10. Accountability, responsibility, and full reparation of damages |
| 11. Prevention, precaution, and mitigation of systemic risks |
| 12. Non-maleficence and proportionality |
They call for fairness, reliability, and robustness in AI systems, alongside human oversight throughout the AI lifecycle. By focusing on these principles, the Act ensures that AI systems are safe, effective, just, and accountable.
These principles are significant because they help provide a concrete framework for interpreting and applying the law in various AI-related scenarios. They are a practical guide for businesses and AI developers to align their operations with the Act’s regulatory requirements. The principles are also meant to instil trust in AI technologies by ensuring their deployment respects individual rights and societal values.
Compared with the EU AI Act, the Brazilian Act’s principles are more comprehensive and specific. While the EU AI Act includes similar principles, it is less detailed and does not provide the same level of explicit guidance on what constitutes responsible AI. Brazil’s inclusion of detailed principles provides a more actionable framework for AI governance, particularly for businesses seeking to ensure their AI systems comply with both legal and ethical standards.
What are the real-world implications of Brazil’s AI Act for businesses?
For companies operating in Brazil, the AI Act presents both challenges and opportunities. Consider a recruitment firm using AI-driven tools to screen job applicants. Under the new legislation, the firm must:
• Ensure Transparency: Inform candidates when AI is used in the evaluation process.
• Provide Human Oversight: Offer applicants the option to have decisions reviewed by a human recruiter.
• Mitigate Bias: Regularly assess AI systems to identify and eliminate any discriminatory biases.
By adhering to these requirements, businesses can build trust with stakeholders and demonstrate a commitment to ethical AI practices.
How should businesses prepare for compliance with Brazil’s AI Act?
To stay ahead, companies should consider the following steps:
| Comprehensive AI Audits | Identify all AI systems in use and assess their risk classifications under the new law. |
|---|---|
| Policy Development | Establish clear guidelines that meet the AI Act’s provisions, ensuring all AI applications adhere to ethical standards. |
| Employee Training | Educate staff on the implications of the AI Act and best practices for responsible AI use. |
| Stakeholder Engagement | Maintain open communication with stakeholders, including customers and partners, about the company’s AI practices and compliance efforts. |
How will Brazil’s AI Act be enforced, and what are the fines?
The National Data Protection Authority (ANPD) — Brazil’s existing data protection regulator under the LGPD — will oversee enforcement of the Brazilian AI Act, ensuring compliance through audits, reporting mechanisms, and investigation of violations. Its remit will cover regulation development, implementation oversight, and sanction application. Non-compliance with the provisions of the Act could result in substantial administrative sanctions, including fines of up to R$ 50 million (approximately US$ 10 million) per violation. For private companies, fines may reach up to 2% of revenue in Brazil, excluding taxes.
The enforcement of these provisions is designed to ensure accountability and compliance with the law, similar to the financial deterrence measures in the EU’s GDPR. In addition to fines, violators may face publication of the violation, prohibition or restriction from participating in regulatory sandboxes for up to five years, temporary or permanent suspension of AI system operations, and prohibition of processing certain databases.
The application of sanctions follows administrative due process. It considers factors such as the severity of the violation, the economic benefit gained, the level of cooperation, and the promptness of corrective measures.
Special provisions apply to excessive-risk systems, which are subject to mandatory minimum penalties, including fines and suspension of activities for legal entities. Sanctions do not exclude other civil or criminal liabilities, and sanctions under consumer protection law remain applicable. An appeals process is available, and the regulatory authority must provide a detailed justification for the sanctions to ensure fairness in the enforcement process.
How does Brazil’s AI Act compare with the EU AI Act?
Brazil’s AI Act draws heavily from the EU AI Act, reflecting the “Brussels Effect.” Both laws follow a risk-based approach, human oversight, and transparency. However, there are notable differences:
Principle-Based Framework
Brazil’s Act provides a comprehensive list of values and principles, offering clarity and interpretative guidance. The EU AI Act, while implying similar principles, lacks an explicit and enforceable list.
| Principle | Description |
|---|---|
| Simplicity and Accessibility | The Brazilian draft is more succinct and organised, avoiding the verbosity of the EU AI Act, which can lead to complexity and enforcement challenges. |
| Local Adaptation | While inspired by the EU framework, Brazil’s Act incorporates domestic priorities, such as environmental sustainability and respect for labour rights. |
Conclusion
Brazil’s AI Act is a significant step in shaping the future of AI governance in Latin America. By blending global best practices with local priorities, the legislation provides a strong basis for trustworthy and ethical AI. For businesses operating in Brazil, meeting these new regulations is both a compliance requirement and a chance to contribute to a human-centric, sustainable AI ecosystem.
As countries worldwide draft their AI regulations, Brazil’s principle-based approach offers useful insights, demonstrating how to balance global standards with domestic needs effectively.
The coming months will be important in determining whether Brazil can maintain its comprehensive approach to AI regulation or if industry pressure and international political shifts will lead to further modifications. The outcome may be a key indicator of how US tech companies, with renewed political backing, approach global AI regulation.
Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.