Last updated:
PL 2338/2023 is Brazil's proposed legal framework for artificial intelligence. It classifies AI systems by risk, grants rights to explanation and human review, and creates a national oversight system coordinated by the data protection authority. The Senate approved it in December 2024 and it remains before the Chamber of Deputies, so it is not yet law.
Is PL 2338/2023 law in Brazil yet?
No. The Federal Senate approved the bill in December 2024, and it is now under review in the Chamber of Deputies. It must pass there and receive presidential assent before taking effect, and the text can still change materially in the process. Any compliance planning should treat the Senate-approved version as the most likely shape of the final law, not as settled obligation. Organizations describing themselves as compliant with a Brazilian AI law are describing something that does not exist yet.
How does the bill classify AI systems?
The bill uses three tiers. Excessive risk systems are prohibited outright, covering uses judged incompatible with fundamental rights. High risk systems carry the substantive compliance burden, including algorithmic impact assessment, documentation, human oversight and record-keeping. Everything else sits in a general category with lighter transparency duties. The structure follows the EU AI Act closely enough that organizations already preparing for the EU regime will recognize most of the machinery, though the classification lists and the rights attached to them differ.
Who would supervise it?
The bill creates the National System for the Regulation and Governance of AI, known by its Portuguese initials SIA. The National Data Protection Authority (ANPD) coordinates the system, and sectoral regulators participate for their own domains, including the central bank for financial services and the health and telecoms authorities for theirs. This matters for scoping: a Brazilian bank would answer to both the ANPD-coordinated system and its prudential regulator, in the way that AI governance in most jurisdictions ends up shared between a horizontal authority and sector supervisors.
What rights does it give individuals?
The bill establishes a civil rights framework around AI decisions. People affected by an AI system are entitled to be told that AI was involved, to receive an explanation of the decision, to contest it, and to request human review where the decision has significant legal or comparable effect. It also assigns liability for damage caused by high-risk systems, which shifts the practical burden onto operators to show their controls were adequate.
What are the penalties?
Administrative sanctions run from warnings through to suspension of the system. Fines are capped at 50 million reais per infraction, and for a private legal entity at 2 percent of its Brazilian revenue, or that of its group, in the last financial year excluding taxes. The revenue-linked cap follows the pattern set by Brazil's data protection law, so firms already modeling LGPD exposure can extend the same approach.
Real world example:
A Brazilian retail bank uses a machine learning model to screen consumer credit applications. Under the Senate-approved text this is a high-risk system, so the bank would run an algorithmic impact assessment before deployment, document the training data and performance characteristics, and keep records adequate for supervisory review. A rejected applicant would be entitled to know an AI system was used, to receive an explanation of the basis for the decision, and to ask for human review. Because it is a financial institution, the bank would expect oversight from both the ANPD-coordinated SIA and the central bank. Since the bill is still before the Chamber of Deputies, the bank builds the capability now but dates its obligations from enactment.
