Brazil LGPD + AI Bill (PL 2338/2023) — AI Provisions: AI Compliance Requirements
Brazil's Lei Geral de Proteção de Dados (LGPD, Law 13,709/2018) has been in force since September 18, 2020. Article 20 grants data subjects the right to request human review of any decision made solely on automated processing — including AI decisions — that affects them (profiling, scoring, creditworthiness, hiring, health assessments). Controllers must disclose the criteria and procedures used. The ANPD (National Data Protection Authority) enforces the LGPD with fines up to 2% of the company's revenue in Brazil, capped at R$50 million per violation. A comprehensive AI Bill (PL 2338/2023) passed the Senate in December 2024 and is pending Chamber of Deputies final vote (expected mid-2025 enactment).
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
September 18, 2020
2% of revenue in Brazil per violation, up to R$50,000,000 (approximately USD $10M); AI Bill will add sector-specific penalties when enacted
What Your Business Must Do
4 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
Automated Decision-Making Disclosure (LGPD Article 20)
CriticalWhen AI systems are used to make automated decisions that affect Brazilian data subjects (scoring, profiling, credit decisions, employment screening, health assessments, etc.): (1) Disclose that automated processing is used. (2) Explain the criteria and logic of the automated decision when requested. (3) Provide a mechanism for data subjects to request human review of any automated decision that significantly affects them.
Deadline: September 18, 2020
LGPD Art. 20Privacy Policy — AI and Automated Processing Section
High PriorityUpdate your privacy policy and data processing records to clearly describe: all AI systems that process personal data of Brazilian residents, the legal basis for each processing activity, and the automated decision-making processes that could significantly affect individuals.
AI Bill (PL 2338/2023) — High-Risk AI Preparation
High PriorityBrazil's AI Bill (PL 2338/2023) was approved by the Federal Senate on 10 December 2024 and remains pending in the Chamber of Deputies as of mid-2026 (a special committee was established in April 2025; no floor vote has occurred). It is NOT yet enacted. As drafted it would require: impact assessments for high-risk AI (healthcare, education, employment, credit, public safety); transparency obligations for generative AI including disclosure of AI-generated content; and prohibition of AI systems that manipulate behavior or enable mass surveillance. Begin impact-assessment documentation now to be ready, but treat the obligations as not-yet-in-force and subject to amendment.
Data Protection Officer — AI Oversight
Medium PriorityIf required by LGPD (companies processing large amounts of personal data), ensure your DPO (Encarregado) is informed about and overseeing all AI systems that process personal data. Document this oversight for ANPD accountability purposes.
Who Does This Apply To?
LGPD extraterritorial reach: applies to processing of personal data of persons located in Brazil, regardless of where the controller is established. Any organization with Brazilian users whose personal data is processed by AI systems must comply. The pending AI Bill (PL 2338/2023) will expand obligations with a risk-based framework similar to EU AI Act — high-risk AI in healthcare, education, employment, public safety, and critical infrastructure will face mandatory impact assessments and registration.
Recent Enforcement Actions
Against: Telekall Infoservice
ANPD issued Brazil's first LGPD fine against Telekall (a microenterprise) after a complaint that it offered a list of WhatsApp contacts of Ubatuba-SP voters for electoral campaign material — finding violations of LGPD Arts. 7 (lawful basis) and 41 (DPO designation), plus Art. 5 of the ANPD Enforcement Regulation for failing to respond to the investigation. While small, this established the ANPD's enforcement pattern: company size is not immunity, and lacking a DPO is a standalone, independently punishable infraction. Precedent: AI processing without adequate privacy notice and DPO oversight violates LGPD.
SourceAgainst: Meta Platforms (Instagram/Facebook Brazil)
ANPD issued a preventive measure on 2024-07-02 ordering Meta to immediately suspend processing Brazilian users' personal data for AI training, targeting Meta's May 2024 privacy-policy update that expanded AI training use of that data. ANPD upheld the order on 2024-07-10 after rejecting Meta's request to lift it. On 2024-08-30, ANPD announced it had suspended the preventive measures after approving a Compliance Plan submitted by Meta, allowing AI training to resume under the approved terms. Established that AI training on social media/platform data requires an LGPD Art. 7 lawful basis and Art. 20 automated-decision disclosure, and that ANPD will use preventive (interim) suspension powers against large AI deployers pending a compliance remedy.
SourceRecent Regulatory Guidance
ANPD Guidance on AI and LGPD Compliance
ANPD published guidance confirming: (1) LGPD Art. 20 right to human review applies to any AI that makes fully automated decisions affecting Brazilian data subjects — not just fully automated systems but also AI systems where human review is nominal; (2) LGPD Art. 18 access rights require organizations to disclose what personal data was used in AI decisions; (3) consent for AI training on Brazilian user data must be specific, informed, and withdrawable independently from general terms of service.
SourceAI Bill (PL 2338/2023) — Senate Approval
Brazil's Federal Senate approved PL 2338/2023 (Brazilian AI Act) on 10 December 2024 with a risk-based framework: prohibited practices (mass surveillance, social scoring, manipulation), high-risk AI obligations (impact assessments, transparency, human oversight), general AI obligations (transparency for generative AI, disclosure of AI-generated content), and foundation-model obligations for providers of systems underlying other AI products. It was forwarded to the Chamber of Deputies, where a special committee was established in April 2025; as of mid-2026 it remains pending in the Chamber of Deputies with no floor vote, and amendments (e.g. on biometric-surveillance carve-outs) are expected before any vote.
SourceKey Case Law & Precedent
ANPD v. Meta (AI Training Investigation)
ANPD Administrative Proceeding · 2024ANPD's investigation into Meta's AI training on Brazilian user data is the highest-profile LGPD AI enforcement action to date. ANPD issued a preventive measure suspending Meta's AI training on Brazilian data (2024-07-02) — establishing ANPD's authority to issue interim/preventive orders on AI data processing. Directly relevant to any company using Brazilian user data to train AI models.
Outcome: RESOLVED 2024-08-30: ANPD suspended the preventive measures after approving Meta's Compliance Plan; Meta resumed AI training on Brazilian data under the approved terms. Not an ongoing pause as of this cycle.
Case referenceQuarterly Enforcement Digest
CYCLE 4 UPDATE (2026-08-22): corrected two stale claims. (1) The Meta AI-training matter is RESOLVED, not ongoing: ANPD issued a preventive suspension 2024-07-02, upheld it 2024-07-10, then suspended the measures 2024-08-30 after approving Meta's Compliance Plan — Meta resumed AI training under the approved terms. It remains the clearest precedent that ANPD will use preventive/interim powers against large AI deployers, but it is not an open pause as of this cycle. (2) The prior "Chamber vote expected Q2 2025... effective Q2-Q3 2026" prediction chain did not hold — PL 2338/2023 was still pending in Chamber of Deputies committees as of the most recent confirmed report (May 2026), with an unconfirmed expectation of a vote before the August 2026 recess. Businesses with Brazilian users should: complete Art. 20 human review mechanism, update privacy policies to explicitly describe AI processing, and prepare impact-assessment templates for eventual AI Bill compliance without assuming a specific enactment date.
Digest covers enforcement actions, guidance, and regulatory developments. Last verified: 2026-08-22.
Industry Playbooks covering Brazil LGPD + AI Bill (PL 2338/2023) — AI Provisions
These industry playbooks include jurisdiction-specific checklist items and guidance for Brazil LGPD + AI Bill (PL 2338/2023) — AI Provisions.
Frequently Asked Questions
Does Brazil LGPD + AI Bill (PL 2338/2023) — AI Provisions apply to my business?
Brazil's Lei Geral de Proteção de Dados (LGPD, Law 13,709/2018) has been in force since September 18, 2020. Article 20 grants data subjects the right to request human review of any decision made solely on automated processing — including AI… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Brazil LGPD + AI Bill (PL 2338/2023) — AI Provisions is: 2% of revenue in Brazil per violation, up to R$50,000,000 (approximately USD $10M); AI Bill will add sector-specific penalties when enacted. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Brazil LGPD + AI Bill (PL 2338/2023) — AI Provisions?
The 4 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htmLast updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan