Brazil's AI Bill (PL 2338/2023)

Senate President Rodrigo Pacheco introduced PL 2338/2023 in May 2023, based on a draft prepared by a commission of legal experts after earlier, thinner bills were criticized. After a temporary Senate committee reworked it extensively, the full Senate approved a substitute text on December 10, 2024. Because Brazil's Congress is bicameral, the Chamber of Deputies must also approve it, and any changes there send it back to the Senate; it is not yet law. The bill sorts AI by risk. 'Excessive risk' uses are prohibited, including techniques that manipulate people into harmful behavior, exploiting vulnerabilities of groups such as children, government social scoring, systems used to produce or spread child sexual abuse material, and most real-time remote biometric identification in public spaces, subject to listed exceptions such as searching for missing persons. High-risk uses are listed by purpose, such as critical infrastructure, education and admissions, recruitment and worker evaluation, access to essential public and private services, criminal investigation, border control, health and autonomous vehicles. During negotiations some items, such as social media recommendation systems, were removed from the high-risk list. High-risk operators must document systems, test for bias, ensure human oversight and carry out algorithmic impact assessments. Affected people gain rights to information, explanation, contestation, human review and non-discrimination. The bill builds on the LGPD, Brazil's 2018 general data protection law, whose Article 20 already lets people request review of automated decisions. It proposes a National System for AI Regulation and Governance (SIA) coordinated by the data protection authority, ANPD, working with sector regulators. A misconception is that it is a copy of the EU AI Act; it shares the structure but places heavier emphasis on individual rights and includes copyright remuneration rules.