Brazil AI Regulation: LGPD and the Proposed Marco Legal da IA (PL 2338/2023)

Brazil's AI governance framework is layered and still maturing. As of May 2026, the operational baseline is the Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018), which has been in force since September 18, 2020 and has been actively enforced by the Autoridade Nacional de Proteção de Dados (ANPD) since the first sanctions were imposed in late 2023. The LGPD is the operative statute that already applies to AI systems that process personal data of individuals in Brazil. Alongside the LGPD, the Marco Legal da IA (PL 2338/2023) passed the Federal Senate in December 2024 and is currently being considered by the Chamber of Deputies (Câmara dos Deputados). The bill, if enacted with its current text, would introduce an EU-AI-Act-style four-tier risk framework layered on top of the LGPD's data protection baseline.

Two framings matter for AI governance leaders. First, the LGPD is in force: ANPD sanctions can be imposed today, and AI processing that touches personal data must already satisfy the LGPD's lawful basis, transparency, and Article 20 automated decision review obligations. Second, PL 2338/2023 remains proposed: the Senate approved a substitute text in December 2024, but the bill has not yet passed the Chamber of Deputies. References to PL 2338/2023 obligations in compliance documents should be framed conditionally and revisited as the legislative process advances.

Brazil's approach sits at the intersection of GDPR-style data protection (the LGPD is closely modelled on the GDPR) and EU AI Act-style risk regulation (PL 2338/2023's four-tier framework draws explicitly from the EU AI Act). Sector regulators add further layers: the Banco Central do Brasil (BACEN) for financial-services AI under Resolução 4.658/2018 and the cyber-security framework for Open Finance; the Agência Nacional de Saúde Suplementar (ANS) for clinical AI in supplementary health; and the Comissão de Valores Mobiliários (CVM) for algorithmic trading disclosures. Organisations that operate in Brazil or that process personal data of Brazilian residents should treat LGPD compliance as the operational floor and prepare an adaptable AI control plane that can absorb PL 2338/2023 obligations when (or if) they are enacted.

Areebi is designed for exactly this layered context: LGPD-aligned consent, automated-decision-review, and DPO controls operate today, and Areebi's AI control plane architecture accommodates the additional risk-tiered obligations contemplated by PL 2338/2023 as the bill matures.

The Brazilian AI legal landscape consists of one in-force statute, multiple ANPD regulations and pareceres (technical opinions), a Senate-passed bill awaiting Chamber consideration, and several sector-specific overlays. Each layer carries different legal weight and should be tracked separately.

The LGPD applies broadly to processing of personal data of individuals in Brazil, regardless of where the controller or processor is headquartered. The Act's extraterritorial reach is structurally similar to the GDPR's.

LGPD covered entities (Article 3)

• Processing carried out in Brazilian territory: Any controller or processor (including AI vendors and integrators) whose data processing activities are conducted in Brazil.
• Processing aimed at offering goods or services to individuals located in Brazil: Global SaaS AI providers that serve Brazilian enterprise customers fall within scope, even where the technical processing happens abroad.
• Processing of personal data collected in Brazilian territory: Captures data collected from individuals located in Brazil at the time of collection, even if subsequently processed elsewhere.

Roles under the LGPD

• Controlador (controller): The natural or legal person who makes decisions about the processing of personal data. For AI, the controller typically defines the system's purpose, the training data sources, and the operative decisions.
• Operador (processor): The natural or legal person who processes personal data on behalf of the controller. AI vendors operating models on behalf of customer organisations typically sit in this category.
• Encarregado (DPO): The person designated by the controller to act as the channel of communication with data subjects and the ANPD. Article 41 makes DPO designation an obligation; the ANPD has clarified that small-scale processors may discharge the role with proportionality.
• Titular (data subject): The natural person to whom the personal data relates. Article 18 grants nine specific rights and Article 20 grants the right to review automated decisions.

Practical SaaS scope notes

• Global SaaS AI providers that sign Brazilian enterprise customers should expect to act as operadores under their data processing agreement and should be prepared to evidence the LGPD's operational requirements (security safeguards, breach notification cooperation, data subject rights support, Article 20 review-channel support).
• AI vendors that offer pre-trained models without customer-specific training should still document the legal basis used for training data acquisition, and should be prepared to answer ANPD inquiries about the provenance and lawful basis of training corpora.
• AI integrators (consultancies, system integrators, and partners that deploy AI on the controller's behalf) typically sit in the operador role. The Article 39 contract (contrato pertinente) defines the operational division of responsibility.

The LGPD does not single out AI by name, but its controller and operator obligations apply to any system that processes personal data. AI training, fine-tuning, and inference using personal data of Brazilian residents are all in scope.

1. Lawful basis selection (Article 7)

For most AI training and inference, the operative legal bases are consent (Article 7, I), legitimate interest with balancing test (Article 7, IX), or contract execution (Article 7, V). The lawful basis must be documented and revisited when the AI purpose changes. Re-purposing data collected under a generic privacy notice for new AI training typically requires a fresh basis. For sensitive personal data (Article 11), the more restrictive set of bases applies.

2. DPO (encarregado) appointment (Article 41)

The encarregado is the channel of communication with data subjects and the ANPD. Enterprise AI deployments typically require a designated DPO with knowledge of the LGPD and the technical AI stack. The encarregado's identity and contact information must be published in an accessible location on the controller's website.

3. RIPD for high-risk AI (Article 38)

The Relatório de Impacto à Proteção de Dados Pessoais documents the processing operations, the risks to fundamental rights, and the mitigation measures. The ANPD may require RIPD disclosure during an inquiry. For high-risk AI - particularly AI that makes consequential decisions, processes sensitive data, or processes large-scale personal data - the RIPD is in practice expected even where the ANPD has not specifically requested it.

4. Article 20 right to review of automated decisions

Where an AI system makes a decision solely on the basis of automated processing that affects the data subject's interests, the data subject can request review. The controller must provide clear and adequate information about the criteria and procedures used, observing commercial and industrial secrets. Article 20 has been the focus of growing ANPD attention through 2024 - 2026; the operational implication is that AI controllers must support a review channel, document the model's decision logic at a level interpretable to the data subject, and route reviewable decisions to a meaningful human review process. Automated decision-making is the LGPD's most direct AI-governance hook.

5. Data subject rights workflows (Article 18)

Controllers must operationally support all nine titular rights: confirmation of processing, access, correction, anonymisation, blocking, deletion, portability, information about sharing, and revocation of consent. AI systems that incorporate personal data into model weights face the practical challenge of honouring deletion requests; the operational response usually involves data lineage tracking, training set deletion, and (where required) model retraining.

6. Breach notification

The LGPD requires controllers to communicate the occurrence of a personal data breach that may generate relevant risk or damage to data subjects to the ANPD and to affected data subjects within a reasonable time. The LGPD does not fix a specific number of days; ANPD guidance issued in 2023 - 2024 indicates that the ANPD expects notification typically within two business days of awareness, and the dosimetry methodology treats prompt notification as a mitigating factor.

7. Article 39 DPA (contrato pertinente)

The controller-processor relationship must be formalised in a written contract that defines processing instructions, security obligations, breach notification, sub-processing, and termination. For AI deployments, the Article 39 contract should explicitly cover model training (if applicable), inference logging, model versioning, and the operational mechanics of supporting Article 18 and Article 20 requests.

The LGPD's enforcement model centres on the ANPD as the federal authority. The ANPD has the power to inquire into complaints, conduct supervisory activities, and impose administrative sanctions following due process. There is no private right of action for the administrative penalties themselves, but data subjects retain civil tort remedies under the Civil Code and the Consumer Defence Code.

Penalty tiers under LGPD Article 52

Dosimetry methodology (Resolution CD/ANPD Nº 4/2023)

The ANPD applies a structured methodology to calibrate sanctions. The methodology considers the seriousness and nature of the infraction, the good faith of the offender, the advantage obtained or intended, the economic condition of the offender, recidivism, the degree of damage, cooperation with the ANPD, the existence of internal mechanisms to prevent the infraction, and prompt adoption of corrective measures. The resolution gives clear signal that prior LGPD investment, documented controls, and cooperation are concrete mitigating factors that directly reduce calculated fines.

Enforcement procedure

1. A complaint, ANPD-initiated supervisory action, or referral triggers the ANPD's procedure.
2. A preliminary investigation determines whether to advance to a formal administrative procedure.
3. The ANPD issues a notice of infraction. The controller has the right to present defence and evidence.
4. The ANPD issues a decision applying the dosimetry methodology. The decision may impose any combination of the Article 52 sanctions.
5. Appeals lie within the ANPD's Conselho Diretor and ultimately to the federal judiciary.

Cumulative civil and consumer remedies

Independent of ANPD administrative sanctions, data subjects may pursue civil liability claims under the Brazilian Civil Code for moral and material damages, including collective actions through the Ministério Público (Public Prosecutor's Office) and consumer organisations. The Consumer Defence Code may also apply where the data subject is a consumer. Collective actions have produced multi-million BRL settlements in 2024 - 2025.

The ANPD moved from supervisory and educational activity to active enforcement starting in late 2023. Notable actions and trends:

• November 2023 - first sanction (Telekall Infoservice): The ANPD imposed its first administrative fine on a telecommunications services company, totalling approximately BRL 14,000 across three infractions, for failure to comply with data subject access requests, lack of legal basis, and lack of designated encarregado. Although modest in financial terms, the sanction signalled that the ANPD had moved into the enforcement phase.
• December 2023 - Serasa Experian: The ANPD sanctioned Serasa Experian approximately BRL 200,000 for sharing personal data of consumers without a valid legal basis. The decision was significant because it addressed a credit-bureau use case central to many AI-driven credit scoring deployments.
• 2024 - OpenAI Termo de Ajustamento de Conduta (TAC): The ANPD opened a procedure into OpenAI's compliance with the LGPD in relation to ChatGPT training and inference, resulting in commitments documented in a TAC. The procedure highlighted the ANPD's intent to actively supervise generative AI providers operating in Brazil.
• 2025 - generative AI training data focus: The ANPD's 2025 supervisory plan made generative AI training data a priority area, with consultations on legal basis, transparency, and data subject rights specifically applied to large language model training corpora.
• 2025 - establishment of AI Coordination Office: The ANPD established a dedicated AI Coordination Office in 2025 to consolidate technical opinions on AI, guide investigations, and prepare for PL 2338/2023 implementation.
• 2026 (year to date) - AI-driven credit and employment decisions: The ANPD's 2026 enforcement priorities have signalled focus on Article 20 reviewability of automated decisions in credit scoring and employment screening, with parecer activity expected to continue through the year.

The trend line is clear: the ANPD has moved from initial small fines into sector-specific supervisory activity, with generative AI and automated decision-making as priority focus areas. Multi-million BRL fines under Article 52 have not yet been published, but the dosimetry framework supports them, and the AI Coordination Office's 2026 - 2027 docket is expected to produce them.

The Marco Legal da Inteligência Artificial (PL 2338/2023) is Brazil's proposed AI-specific framework, drawing structurally from the EU AI Act while embedding Brazil-specific institutional architecture. The Federal Senate approved a substitute text on December 10, 2024; the bill is currently in the Chamber of Deputies. Enactment is not certain; the Chamber may amend the text or send it back to the Senate.

Four-tier risk classification

Fundamental rights impact assessment (avaliação de impacto algorítmico)

Mandatory for high-risk AI systems. Captures the system's purpose, training data and its lawful basis, the populations affected, the risks to fundamental rights (privacy, non-discrimination, freedom of expression, due process, consumer protection), the mitigations implemented, and the residual risk profile. The assessment is updated when the system materially changes. Where the system also processes personal data, the assessment may be integrated with the LGPD's Article 38 RIPD to avoid duplicate work.

Regulatory sandbox

PL 2338/2023 contemplates a regulatory sandbox administered by the ANPD in coordination with sector regulators. The sandbox allows controlled testing of innovative AI systems under regulator supervision, with relaxed but defined obligations during the testing period.

ANPD as central authority with sector-regulator coordination

The Senate-approved text positions the ANPD as the central authority coordinating AI regulation, while preserving sector regulators' specific powers (BACEN for financial services, ANS for health, CVM for securities, ANATEL for telecoms). The Sistema Nacional de Regulação e Governança da Inteligência Artificial (SIA) is the coordinating mechanism.

Penalties

Mirroring the LGPD's structure with AI-specific layers. Caps up to BRL 50 million per infraction, with multipliers for prohibited-use (excessive-risk) violations. Daily fines and operational suspension powers track the LGPD's framework.

Practical readiness

Organisations that already maintain LGPD-aligned controls (Article 7 lawful basis, Article 18 rights workflows, Article 20 review channels, Article 38 RIPDs, Article 41 encarregado) have the bulk of the foundation required by PL 2338/2023. The principal new build is the risk-tier classification process and the fundamental rights impact assessment template extending the RIPD beyond personal data to broader fundamental rights.

For multinational enterprises that operate in both the EU and Brazil, PL 2338/2023 is structurally close to the EU AI Act but not identical. The differences matter for programme design.

Similarities

• Both adopt a four-tier risk classification with prohibited, high-risk, limited-risk, and minimal-risk categories.
• Both prohibit social scoring by public authorities and real-time biometric identification in publicly accessible spaces (with comparable narrow exceptions).
• Both require fundamental rights / conformity impact assessment for high-risk systems.
• Both require transparency disclosure for AI systems that interact with humans and labelling of generative outputs.
• Both contemplate regulatory sandboxes for innovative AI.

Differences

• Extraterritorial scope: The EU AI Act has broader extraterritorial reach (applies to providers and deployers where AI outputs are used in the EU). PL 2338/2023's extraterritorial reach is narrower and largely tied to the LGPD's Article 3 thresholds (processing of personal data in Brazil, offering goods or services to individuals in Brazil, or collection in Brazilian territory).
• Automated decision review: Brazil has a stronger individual right of review under LGPD Article 20 than the EU does under GDPR Article 22, because the LGPD does not require the decision to "produce legal effects" or "similarly significantly affect" the data subject - the LGPD threshold is decisions that "affect the data subject's interests." Brazilian data subjects can invoke Article 20 more readily than EU data subjects can invoke Article 22.
• Central authority: The EU AI Act distributes enforcement among Member State authorities, the AI Office, and the European AI Board. PL 2338/2023 designates the ANPD as central authority with sector-regulator coordination through the SIA.
• Generative AI / general-purpose AI: The EU AI Act introduces specific obligations for general-purpose AI models (Article 51 onwards). PL 2338/2023's Senate text addresses generative AI but is less prescriptive on general-purpose model documentation.
• Penalty caps: The EU AI Act's caps are higher (up to EUR 35 million or 7% of global turnover for prohibited practices). PL 2338/2023 mirrors the LGPD's BRL 50 million per-infraction structure.

Programme design implication

A unified AI governance programme can satisfy both regimes by using the EU AI Act as the baseline (it is generally more prescriptive) and bolting on Brazil-specific layers: LGPD Article 20 review-channel implementation, ANPD operating-procedure requirements (particularly the dosimetry-aware corrective measures workflow), and Portuguese-language documentation for notice and consent. A control plane that abstracts policy from compliance regime allows the same operational controls to satisfy both.

Areebi maps directly to LGPD and (anticipated) PL 2338/2023 obligations. The platform's control plane is designed so the same operational primitive can satisfy multiple LGPD articles and PL 2338/2023 risk-tier obligations once enacted.

The control plane architecture decouples policy from compliance regime, so an organisation that runs a single Areebi tenant can satisfy LGPD today, layer PL 2338/2023 obligations when enacted, and reuse the same evidence for EU AI Act, NIST AI RMF, and ISO/IEC 42001 audits.

Organisations that operate in Brazil or that process personal data of Brazilian residents should treat LGPD compliance as the operational floor and stage additional controls for PL 2338/2023. A practical six-step plan:

1. LGPD baseline audit

• Inventory all AI systems that process personal data of Brazilian residents, including shadow AI tools.
• For each system, document the lawful basis under Article 7, the purpose, the categories of personal data processed, and the data subjects affected.
• Flag any system relying on a generic privacy policy or non-specific consent for AI training or inference.

2. Appoint an encarregado (DPO) if not yet done

• Designate an encarregado with knowledge of the LGPD and the technical AI stack. Publish the encarregado's identity and contact information.
• Establish the channel of communication for data subjects and the ANPD. Document the response service levels.

3. Implement Article 20 automated-decision review process

• For every AI system that makes consequential decisions, build the review request channel.
• Define the human review path: who reviews, against what criteria, with what evidence, and within what timeframe.
• Document the explainability artefacts shared with data subjects, observing commercial and industrial secrets.

4. Build the AI inventory and RIPD library (Article 38)

• Maintain a current AI inventory mapping each system to lawful basis, data categories, risk profile, and Article 20 review status.
• Produce RIPDs for high-risk AI use cases. Where PL 2338/2023 is enacted, extend the RIPD scope to fundamental rights impact assessment.
• Cross-map the RIPD to NIST AI RMF MAP function evidence and (where applicable) ISO/IEC 42001 management system documentation.

5. Train the workforce on AI-specific LGPD obligations

• Train product, engineering, data science, and customer-facing teams on LGPD Article 7 lawful basis selection for AI, Article 18 rights workflows, and Article 20 review.
• Establish a clear escalation path to the encarregado for AI-specific questions.
• Include LGPD content in onboarding and annual refresher training.

6. Monitor PL 2338/2023 and prepare layered controls

• Track the Chamber of Deputies' review of PL 2338/2023. Subscribe to ANPD pareceres and the AI Coordination Office's outputs.
• Maintain a PL 2338/2023-readiness register: risk-tier classification candidate use cases, fundamental rights impact assessment templates, regulatory sandbox candidates.
• Run a tabletop exercise simulating an ANPD inquiry that combines an LGPD violation with an AI-specific aggravating factor (deepfake, denied Article 20 request, undisclosed automated decision).

Organisations seeking to accelerate Brazil AI compliance can request a demo to see how Areebi operationalises LGPD obligations alongside the broader AI control plane.