Skip to main content

    AI by country · South America

    AI in Brazil: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Brazil know before starting with AI?

    Brazil has no AI law in force as of 29 October 2026. The General Data Protection Law (LGPD, Law 13.709/2018) is the law that applies to AI today, and the data protection agency ANPD has already used it against AI training. The AI bill PL 2338/2023 passed the Senate in December 2024 and is still waiting for a committee report in the Chamber of Deputies.

    At a glance

    Brazil at a glance

    Key facts about Brazil
    Data protection lawLei Geral de Proteção de Dados (LGPD), Law 13.709/2018, in force; sanctions apply since 1 August 2021
    RegulatorAgência Nacional de Proteção de Dados (ANPD)
    AI policyBrazilian AI Plan (PBIA) 2024 to 2028. No AI law in force as of 29 October 2026; bill PL 2338/2023 is in the Chamber of Deputies
    Time zoneBrasília time, UTC-3 (India is 8.5 hours ahead)
    CurrencyBRL (Brazilian real)
    Business languagePortuguese

    Why now

    Why Brazil is worth watching

    Each point links to the document it comes from.

    • The government presented the Brazilian AI Plan (PBIA) 2024 to 2028 on 30 July 2024, with about R$ 23 billion of planned investment, mostly public.[6]

    • On 2 July 2024 the ANPD ordered Meta to stop using Brazilian users' posts to train generative AI, under a daily fine of R$ 50,000, citing the legal basis, transparency and children's data.[7]

    • The AI bill PL 2338/2023 reached the Chamber of Deputies in March 2025. As of 29 October 2026 it is still awaiting the rapporteur's report in a special committee.[4]

    • The ANPD has issued binding rules on incident reporting (2024), international transfers with standard contractual clauses (2024) and data protection officers (2024).[2]

    • In January 2026 the ANPD recognised the European Union as having an adequate level of protection, which makes data transfers between Brazil and the EU simpler.[2]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Law (LGPD), Law 13.709/2018

    In force2018A person can ask for review of a decision made only by automated processing, and the controller must explain the criteria on request (article 20). Personal data can go abroad only on listed grounds (article 33), and the ANPD can order a data protection impact report (article 38). Fines reach 2% of revenue in Brazil, capped at R$ 50 million per infraction (article 52).[1]

    ANPD Resolution 15/2024 on security incident reporting

    In force2024A controller must report a qualifying security incident to the ANPD and to the affected people within three working days. Small processing agents get double the time. This covers AI systems that store or process personal data.[3]

    ANPD Resolution 19/2024 on international transfers

    In force2024It sets the rules and standard contractual clauses for sending personal data abroad. This matters if your AI model or cloud runs outside Brazil. The EU was recognised as adequate by Resolution 32/2026.[2]

    Bill PL 2338/2023 on artificial intelligence

    Draft2023The Senate approved it in December 2024 and sent it to the Chamber on 17 March 2025. It sits in a special committee awaiting the rapporteur's report. A tracker reports the rapporteur said in August 2026 that the vote would come after the October 2026 elections. If the Chamber changes it, it returns to the Senate.[4]

    CMN Resolution 4.893/2021 on cybersecurity and cloud for financial institutions

    In force2021Institutions authorised by the Central Bank must tell it when they contract relevant cloud or data processing services. For services abroad, the countries must be defined in advance and the Central Bank must be able to reach the data. This applies to AI hosted on cloud platforms.[8]

    Where AI fits first

    Where AI fits first

    Banking and payments

    Fraud detection, credit analysis support and Portuguese-language customer service.

    CMN Resolution 4.893/2021 governs cloud and data processing contracts. LGPD article 20 lets customers ask for review of fully automated credit decisions.[8]

    Health care

    Summarising clinical notes and triage support, with clinicians making decisions.

    Health data is sensitive data under the LGPD, with stricter legal bases. Check with your professional council for any AI-specific rules.[1]

    Retail and consumer services

    Product search, support chat and document handling in Portuguese.

    The ANPD's action against Meta shows that reusing customer data to train AI needs a sound legal basis and clear notice.[7]

    Public services

    Handling citizen requests and summarising case files.

    Public services is one of the funded areas of the Brazilian AI Plan. The LGPD applies to public bodies too.[6]

    Your first steps

    Your first steps

    1. Name a data protection officer (encarregado) and read ANPD Resolution 18/2024 on the role.
    2. Pick and record a legal basis for each AI use of personal data, especially if you plan to train or fine-tune models on customer data.
    3. List each decision your AI makes alone about a person, and set up a way to review it and explain the criteria under LGPD article 20.
    4. Map where data goes. If a model or cloud runs abroad, use a transfer ground under article 33, such as the ANPD standard contractual clauses.
    5. Prepare an incident process that can report to the ANPD and affected people within three working days.
    6. Write a data protection impact report for higher-risk AI uses before the ANPD asks for one.
    7. Follow PL 2338/2023 in the Chamber of Deputies, as its risk rules may change after the elections.

    AI services for Brazil

    AI consulting and development for teams in Brazil

    We work remotely with companies in Brazil, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Brasília is on UTC-3 and India on UTC+5:30, so India is 8.5 hours ahead. With a 9:00 to 18:00 day in Brazil and 9:30 to 18:30 in India, the overlap is only 1 hour: 09:00 to 10:00 in Brasília, which is 17:30 to 18:30 in India. So we agree a fixed early-morning (Brazil) and evening (India) call window, and send written updates at the end of each Indian day so work is ready when your morning starts.

    Questions

    Common questions about AI in Brazil

    Does Brazil have an AI law?

    Not as of 29 October 2026. PL 2338/2023 passed the Senate in December 2024 and is waiting for the rapporteur's report in a special committee of the Chamber of Deputies. Until it passes, the LGPD and sector rules apply.

    Can customers challenge a decision made by our AI?

    Yes. Under LGPD article 20, a person can ask for review of a decision made only by automated processing that affects their interests. You must give clear information about the criteria used when asked, subject to trade secrets.

    How large can LGPD fines be?

    A simple fine can reach 2% of the company's revenue in Brazil in the previous financial year, excluding taxes, up to R$ 50 million per infraction. The ANPD can also block or delete data and suspend processing.

    Can we use our customers' data to train an AI model?

    Only with a proper legal basis, clear notice and a real way to object. In 2024 the ANPD suspended Meta's AI training on Brazilian users' data on these points, and lifted the suspension only after Meta made commitments.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Câmara dos Deputados (Legislação Informatizada), 2026-02-25. Lei nº 13.709, de 14 de agosto de 2018 (LGPD), updated text(www2.camara.leg.br)
      Full title and what we used it for

      Lei nº 13.709, de 14 de agosto de 2018 (LGPD), updated text. Primary, consolidated law text. Used for articles 20, 33, 38, 52 and 65 (sanctions from 1 August 2021), and the ANPD's name as amended by Law 15.352/2026. The Planalto site blocked our access, so we used the Chamber's consolidated copy.

    2. [2] Agência Nacional de Proteção de Dados (ANPD), 2026-10-29. Regulamentações da ANPD(gov.br)
      Full title and what we used it for

      Regulamentações da ANPD. Primary. Used for the list of resolutions in force, including 15/2024, 18/2024, 19/2024 and 32/2026 (EU adequacy), and that none of them is specific to AI.

    3. [3] LegisWeb (reproduction of the Diário Oficial text), 2024-04-26. Resolução CD/ANPD nº 15, de 24 de abril de 2024(legisweb.com.br)
      Full title and what we used it for

      Resolução CD/ANPD nº 15, de 24 de abril de 2024. Full text of the regulation as published in the Diário Oficial on 26 April 2024. Used for the three working day deadlines in articles 6 and 9. The official gazette site did not load for us.

    4. [4] Câmara dos Deputados, 2026-10-29. PL 2338/2023, ficha de tramitação(camara.leg.br)
      Full title and what we used it for

      PL 2338/2023, ficha de tramitação. Primary. Used for the status 'awaiting the rapporteur's report' in the special committee and the rapporteur. Senate approval and the 17 March 2025 dispatch confirmed on the Senate page (https://www25.senado.leg.br/web/atividade/materias/-/materia/157233). The rapporteur's August 2026 remark about a post-election vote comes from the LCF Consulting legislative monitor, a secondary tracker.

    5. [5] LCF Consulting, 2026-10-29. PL 2338/2023: situação atual do Marco Legal da Inteligência Artificial(monitor.lcfconsulting.com.br)
      Full title and what we used it for

      PL 2338/2023: situação atual do Marco Legal da Inteligência Artificial. Secondary tracker, used only for interpretation: the rapporteur's 24 August 2026 statement that the vote would follow the October 2026 elections.

    6. [6] Agência Gov (federal government news agency), 2024-07-30. Plano Brasileiro de Inteligência Artificial 2024 to 2028 presented(agenciagov.ebc.com.br)
      Full title and what we used it for

      Plano Brasileiro de Inteligência Artificial 2024 to 2028 presented. Government news agency. Used for the plan's name, period, presentation date and the R$ 23 billion figure.

    7. [7] Agência Nacional de Proteção de Dados (ANPD), 2024-07-02. ANPD determina suspensão cautelar do tratamento de dados pessoais para…(gov.br)
      Full title and what we used it for

      ANPD determina suspensão cautelar do tratamento de dados pessoais para treinamento da IA da Meta. Primary. Used for the preventive measure, its grounds and the daily fine. The later lifting of the measure in August 2024 is from press reports (Convergência Digital).

    8. [8] Banco Central do Brasil, 2021-02-26. Resolução CMN nº 4.893, de 26 de fevereiro de 2021(bcb.gov.br)
      Full title and what we used it for

      Resolução CMN nº 4.893, de 26 de fevereiro de 2021. Primary. Used for the cloud contracting notice (article 15) and the conditions for services abroad (article 16). Marked in force, as amended in 2024 and 2025.

    This is general information, not legal advice. Laws and drafts change, and Brazil's AI bill may be rewritten before it passes. Check with a qualified Brazilian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Brazil?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score