Brazil: AI and data protection regulation
Brazil has no AI law in force, but the LGPD already requires review of automated decisions, and specific ANVISA and CFM rules apply in healthcare.
GROU LLC · built on AI Business Core, by Vreinn · · How we verify sources
Summary
The LGPD, overseen by the ANPD, requires a legal basis, records of processing, a data protection officer, incident reporting within 3 business days and mechanisms for international transfers; its art. 20 lets people request review of automated decisions. In healthcare, AI software must be registered with ANVISA and, since August 26, 2026, the CFM sets rules for AI use by physicians and institutions. The AI framework bill (PL 2338/2023) awaits a vote in the Chamber of Deputies. Documents filed with Brazilian regulators must be in Portuguese.
- Binding AI law today?
- No
- Obligations verified in the official source
- 74 %
- Information as of
Authorities
- National Data Protection Authority (ANPD)
Data protection authority; would coordinate AI regulation if PL 2338 passes
- National Health Surveillance Agency (ANVISA)
Software as a medical device
- Federal Council of Medicine (CFM)
AI use in medical practice
Rules covered
| Rules | Status | Obligations and dates |
|---|---|---|
| Brazil's General Personal Data Protection Law (LGPD) LGPD | In force | 7 |
| ANPD security incident communication regulation ANPD Res. 15/2024 (incidents) | In force | 1 |
| ANPD data protection officer (encarregado) regulation ANPD Res. 18/2024 (DPO) | In force | 2 |
| ANPD international transfer regulation and standard clauses ANPD Res. 19/2024 (transfers) | In force | 1 |
| ANVISA resolution on software as a medical device ANVISA RDC 657/2022 (SaMD) | In force | 1 |
| Federal Council of Medicine resolution on AI use in medicine CFM Res. 2,454/2026 | In force | 3 |
| Brazil's AI framework bill PL 2338/2023 | Bill | 4 |
Key dates
Show past dates (16)
- Takes effect · CFM Res. 2,454/2026
- Rapporteur announces a vote after the elections · PL 2338/2023
- Published in the DOU · CFM Res. 2,454/2026
- EU recognized as adequate (Res. 32/2026) · ANPD Res. 19/2024 (transfers)
- Deadline to adopt standard clauses · ANPD Res. 19/2024 (transfers)
- Received by the Chamber of Deputies · PL 2338/2023
- Passed by the Senate · PL 2338/2023
- Published · ANPD Res. 19/2024 (transfers)
- Adopted · ANPD Res. 18/2024 (DPO)
- Adopted · ANPD Res. 15/2024 (incidents)
- Introduced in the Senate · PL 2338/2023
- Takes effect · ANVISA RDC 657/2022 (SaMD)
- Published in the DOU · ANVISA RDC 657/2022 (SaMD)
- Administrative sanctions apply · LGPD
- Takes effect · LGPD
- Published in the Official Gazette (DOU) · LGPD
Use cases with their own obligations in Brazil
- Hiring, evaluation or termination of staff
- Algorithmic worker management (shifts, tasks, pay)
- Worker monitoring
- Credit or creditworthiness scoring
- Insurance pricing or underwriting
- Diagnosis, triage or clinical support
- Admissions, grading or exam proctoring
- Biometrics, facial or emotion recognition
- Training or fine-tuning models on own data
- Access to public services or benefits
- Other automated decisions with significant effects (housing, pricing, access to services)
Regulatory change alerts by country
Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.
- Changes to the rules of the countries you pick, when we add them to the registry.
- New application dates.
- No more than one email a week. Unsubscribe at any time.
It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.