Brazil: Privacy Leadership, Accountability, and an Emerging AI Framework

Brazil is on the cusp of enacting Latin America's most comprehensive AI legislation. The AI Act (PL 2338/2023), which passed the Senate in December 2024 and entered the Chamber of Deputies in March 2025, establishes a risk-based framework drawing on both the EU AI Act and Brazil's own LGPD data protection tradition. Meanwhile, the country's National Data Protection Authority (ANPD) — fully independent since September 2025 — already exercises significant AI-adjacent enforcement powers through the LGPD. Brazil's BRL 23 billion national AI investment plan (PBIA), the ANPD's regulatory sandbox running from June 2025 to December 2026, and the landmark Estatuto da Criança e do Adolescente Digital (ECA Digital) effective March 17, 2026, signal an ambitious approach that will shape AI governance across the entire Latin American region.

• The AI Act (PL 2338/2023) passed the Brazilian Senate in December 2024 and has been under review in the Chamber of Deputies since March 2025. It introduces a tiered risk classification system (unacceptable, high, general, low risk) with mandatory impact assessments for high-risk AI systems.
• ANPD became a fully independent autarquia in September 2025, significantly strengthening its enforcement capacity for both LGPD and forthcoming AI-specific obligations.
• The ANPD-EU data adequacy agreement finalised in January 2026 streamlines cross-border data transfers between Brazil and the European Economic Area.
• ANPD launched a regulatory sandbox in June 2025 (running through December 2026) allowing companies to test AI applications under supervised conditions with temporary compliance flexibility.
• The ECA Digital (Estatuto da Criança e do Adolescente Digital) became effective on March 17, 2026, imposing strict obligations on platforms using AI to serve or target minors, including algorithmic transparency and age-verification requirements.
• Brazil co-signed the BRICS AI Governance Declaration in October 2024, committing to multilateral AI safety coordination.
• The PBIA (Plano Brasileiro de Inteligência Artificial) allocates BRL 23 billion through 2028 for AI research, infrastructure, and workforce development.

• Technology companies developing or deploying AI systems in Brazil, particularly those classified as high-risk under the forthcoming AI Act (including facial recognition, automated credit scoring, and employment screening).
• Social media platforms and digital services targeting minors, now subject to ECA Digital obligations on algorithmic transparency and child safety.
• Financial institutions using AI for credit decisions, fraud detection, and customer profiling, subject to both LGPD automated decision-making rules and ANPD enforcement.
• Healthcare providers and insurers deploying AI for diagnostics, treatment recommendations, and claims processing.
• Public-sector agencies using AI for citizen services, law enforcement, and social benefit administration.
• International companies processing personal data of Brazilian residents, particularly those benefiting from the ANPD-EU adequacy agreement.
• AI startups and researchers participating in the ANPD regulatory sandbox.
• Agricultural technology companies using AI in Brazil's agribusiness sector, one of the largest AI adoption areas in the economy.

• Risk-based regulation: The AI Act establishes four risk tiers (unacceptable, high, general, low) with proportionate obligations, banning systems that pose unacceptable risks to fundamental rights while imposing impact assessments and transparency requirements on high-risk applications.
• Human oversight and accountability: High-risk AI systems must maintain meaningful human oversight, with clear liability chains linking developers, deployers, and operators.
• Transparency and explainability: Both the LGPD and the proposed AI Act require that individuals be informed when AI systems make or substantially influence decisions affecting them, with a right to request explanation and human review.
• Data protection integration: Brazil's AI framework builds explicitly on LGPD foundations, requiring lawful data processing, purpose limitation, and data minimisation for AI training and deployment.
• Child and adolescent protection: The ECA Digital establishes Brazil as a global leader in protecting minors from algorithmic harms, requiring age-appropriate design, parental consent mechanisms, and restrictions on behavioural profiling of children.
• Innovation and development: The PBIA and ANPD sandbox reflect a deliberate balance between regulation and support for Brazil's AI ecosystem, with BRL 23 billion in public investment targeting research, infrastructure, and talent development.
• International alignment: Brazil positions its framework between EU-style rights-based regulation and the more flexible approaches of other BRICS nations, pursuing adequacy agreements and mutual recognition frameworks.

Companies operating in Brazil should begin preparing for the AI Act now, even before final Chamber approval. The risk classification framework will require comprehensive audits of existing AI systems — particularly those involved in credit scoring, HR screening, facial recognition, and healthcare decisions. Firms already compliant with the LGPD have a strong foundation, but the AI Act introduces additional obligations around algorithmic impact assessments, transparency documentation, and incident reporting that go beyond data protection. Platforms serving minors face immediate compliance requirements under the ECA Digital, including algorithmic audits and age-verification systems. The ANPD's growing enforcement capacity means that non-compliance carries real financial and reputational risk. International companies should leverage the ANPD-EU adequacy agreement to streamline data flows, but must ensure their AI systems meet Brazilian standards independently. The ANPD regulatory sandbox offers a valuable opportunity for companies to test innovative AI applications in a supervised environment through December 2026. With BRL 23 billion in public AI investment flowing through 2028, Brazil presents significant market opportunities for companies that demonstrate responsible AI practices.

• Chamber of Deputies vote on the AI Act (PL 2338/2023), expected by late 2026 or early 2027, which will establish Brazil's first comprehensive AI governance law.
• ANPD's publication of implementing regulations under the AI Act, including detailed risk classification criteria and impact assessment templates.
• Results and lessons from the ANPD regulatory sandbox (June 2025 - December 2026), which will inform final regulatory design.
• First major ANPD enforcement actions under the strengthened LGPD automated decision-making provisions and ECA Digital.
• Progress on PBIA investment milestones, including AI research centre expansions and workforce development programmes.
• Development of sector-specific AI guidelines by the Central Bank (Banco Central), securities regulator (CVM), and health authority (ANVISA).
• Brazil's engagement in BRICS AI governance coordination, including proposed mutual recognition of AI safety standards.
• Impact of the ANPD-EU adequacy agreement on cross-border AI service delivery and international competitiveness.