Regulationsby GlyphBrazil AI Bill (PL 2338/2023)
Proposed Brazil · no upcoming deadlines
Deadlines
Approved by the Federal SenateSenate approves the consolidated text and sends it to the Chamber of Deputies.
Summaries for reference, not legal advice. Check the official text.
What it does
Risk-based AI framework inspired by the EU AI Act: prohibited (excessive-risk) uses, high-risk system obligations, algorithmic impact assessments, rights for affected persons and copyright remuneration provisions, coordinated by a national AI regulation system (SIA) led by the ANPD.
- Who it applies to
- Developers, distributors and deployers of AI systems in Brazil (per Senate text).
- Penalties
- Senate text: fines up to BRL 50 million per infraction or up to 2% of group revenue in Brazil; suspension of development or supply.
- Enforced by
- ANPD as coordinator of the National AI Regulation and Governance System (SIA) (proposed)
- Official name
- Projeto de Lei nº 2338/2023 (Brazilian AI Legal Framework)
- Citation
- PL 2338/2023
- Topics
- AI
Verified 2026-09-22 camara.leg.br
Research notes
As of September 2026 the Chamber's tramitação page shows the bill still awaiting the rapporteur's opinion in the Special Commission; a plenary vote reported for late May 2026 did not occur. If the Chamber amends it, the bill returns to the Senate. Penalty figures are from the Senate-approved text as reported, not re-verified.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025
Brazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025Peru AI Law and RegulationPeru's AI law and its 2025 regulation set a risk-based framework with prohibited uses and high-risk uses (for example in credit, employment, health and education access). Developers and deployers of high-risk systems must run impact assessments, keep human oversight and give transparency. Obligations phase in by sector and company size over one to four years.Next: Sep 10, 2027 Private sector: transport, commerce, labour · in 10 months
Questions about Brazil AI Bill (PL 2338/2023)
- What are the Brazil AI Bill (PL 2338/2023) compliance deadlines?
- Dec 10, 2024: Approved by the Federal Senate.
- Who does Brazil AI Bill (PL 2338/2023) apply to?
- Developers, distributors and deployers of AI systems in Brazil (per Senate text).
- What are the penalties under Brazil AI Bill (PL 2338/2023)?
- Senate text: fines up to BRL 50 million per infraction or up to 2% of group revenue in Brazil; suspension of development or supply.