Brazil’s AI bill is described in a great deal of writing as though it were in force. It is not, and the distinction is not pedantic: the risk tiers, the prohibitions and the regulator that summaries attribute to Brazilian law exist only in a text that one chamber of Congress has approved.
Where the bill stands
PL 2338/2023 was introduced in the Federal Senate in May 2023 by the then-President of the Senate, building on the report of a commission of jurists that had been convened to draft a substitute for earlier and much thinner AI bills. After committee work through 2024, the Senate plenary approved the bill on 10 December 2024 and sent it to the Chamber of Deputies, where it has been examined by a special committee rather than passed straight to a floor vote.
As at the date on this page, the bill has not been enacted. It has been approved by one chamber and remains before the other.
This is a status page about a live legislative process and it is written to be checked, not relied on. It is not legal advice. Before making any decision that depends on whether Brazil has an AI statute, verify the current stage on the official tracking pages linked below—a page written at any date can be overtaken the following week.
How a Brazilian bill becomes law
The reason “approved by the Senate” is so frequently misreported as “passed” is that the remaining route is substantial and can change the text materially. A bill originating in the Senate goes to the Chamber of Deputies as the revising chamber. If the Chamber amends it, the amended text returns to the Senate, which decides between its own text and the Chamber’s. Only when both chambers have settled on one text does it go to the President, who may sanction it in whole, or veto provisions in part, with vetoes subject to being overridden by Congress.
Each of those stages has changed the substance of comparable Brazilian technology legislation. The LGPD itself, Brazil’s data protection statute, was enacted in 2018 and then amended before it ever took effect, including changes to the very provision on automated decisions that is now the operative Brazilian rule—see what Article 20 of the LGPD requires today. Treating a one-chamber text as final has a poor record in this jurisdiction specifically.
What the Senate text contains
Described accurately—as the content of an approved-by-one-chamber text, not as law—the Senate version is a comprehensive, risk-tiered instrument with clear EU influence and several distinctly Brazilian departures. Its principal elements are:
- A tier of excessive-risk systems that would be prohibited, covering the familiar ground of behavioural manipulation exploiting vulnerability, social scoring by public authorities, and constrained treatment of biometric identification.
- A high-risk tier with obligations attached, including governance measures, documentation, human oversight and algorithmic impact assessment, with the listed high-risk domains covering areas such as employment, credit, education, essential services and justice.
- Rights for affected persons, including information about AI involvement, explanation of decisions, contestation, and human review in defined circumstances—drafted more generously than the LGPD’s existing right.
- A coordinated governance system in which the national data protection authority, the ANPD, takes the coordinating role alongside sectoral regulators, rather than a wholly new regulator being created from scratch.
- Copyright and remuneration provisions addressing the use of protected works in training, which have been among the most contested parts of the text and are the provisions most likely to move in the Chamber.
The resemblance to the EU AI Act’s risk tiers is real but should not be over-read. The Brazilian text approaches AI substantially through a rights and consumer-protection frame, drawing on the Consumer Defence Code tradition, where the EU instrument is built as product safety law. Obligations that look equivalent can be enforced through very different routes as a result.
What is genuinely unresolved
Three questions are open and none of them can be answered by reading the Senate text.
Whether it passes at all, and in what form. Brazilian industry associations have pressed for narrower scope and lighter obligations, and civil society organisations for stronger rights and tighter biometric limits. A special committee is exactly the venue in which a text is rewritten. Anyone telling you what the final Brazilian AI law will say is predicting, not reporting.
How enforcement would be allocated. Coordination between the ANPD and sectoral regulators is described at a level of generality that leaves the practical question—who inspects, who fines, who resolves a conflict between two regulators—to implementing rules that do not exist.
When any of it would apply. Comprehensive statutes of this kind normally carry a transition period, and the length of that period is one of the most heavily negotiated numbers in the text. Until enactment there is no commencement date to plan against.
How to check the status yourself
Brazilian legislative tracking is public and unusually good, and checking takes a minute.
- Open the Federal Senate’s tracking page for PL 2338/2023, which lists every procedural step with its date and links the text as approved by the Senate.
- Then check the Chamber of Deputies’ proposition search. A Senate bill is renumbered on arrival at the Chamber, so search by the original number and follow the link to the Chamber’s own record.
- If the Chamber has approved a text, check whether it returned to the Senate. Only a text settled by both chambers and sanctioned by the President is law, and the sanction is published in the Diário Oficial da União with a statute number.
- Read the enacted number, not the bill number. When Brazilian AI legislation exists it will be cited as a Lei with a year, and the disappearance of “PL” from the citation is the reliable signal that something has actually changed.
In the meantime, the Brazilian rules that do bind an AI deployment are the general ones: the LGPD, the Consumer Defence Code, the Civil Rights Framework for the Internet, sectoral financial regulation, and labour law. That is a smaller compliance surface than PL 2338 would create, and it is the one that exists.
Top comments (0)