Brazil's AI bill (PL 2338/2023): what it proposes and how to prepare
PL 2338/2023 is the bill proposing a general framework for the development and use of artificial intelligence in Brazil, with a risk-based approach, rights for affected people and governance duties for those who provide and those who operate AI systems. It is still in progress, so the text may change; sensible preparation is not anticipating articles but organising the information any final version will require.
Central lines of the proposal
The bill scales obligations by the risk of the system and distributes duties between developers and operators. This summary is informational and replaces neither the text in progress nor legal advice.
- Classification of systems by degree of risk, with proportional duties.
- Prohibition of uses considered of excessive risk.
- Rights for affected people, such as information and contestation of automated decisions.
- Governance, documentation and impact assessment duties for high-risk systems.
- Human oversight and responsibility of the agents involved.
- Supervision and penalties.
Relationship with the LGPD and the EU AI Act
Brazil's data protection law already applies today to any AI use that processes personal data — purpose, legal basis, transparency and data-subject rights do not wait for a new statute. The EU AI Act reaches Brazilian organisations offering systems or outputs on the European market and is often used as a structural reference, though the framing differs.
What to do before approval
Keep a current inventory of AI uses with purpose, data, affected people, degree of automation and owner. It is the base any version of the text will require, and it is already useful for data protection and contracts.
Frequently asked questions
Is PL 2338 already in force?
No. It is a bill in progress; the text and deadlines can change before final approval. This content is informational and not legal advice.
Does it reach organisations that only adopt third-party AI?
The proposal distributes duties between those who develop and those who operate AI systems. Adopting a contracted tool does not fully transfer responsibility for the purpose and effect of the use.