Skip to content
AI Policy Generator

ESWhat applies

Diagnosis, triage or clinical support in Brazil: related rules

AI that helps diagnose, prioritize patients, recommend treatments, read medical images or draft clinical notes. Errors affect health, so clinical validation, medical oversight, patient transparency and, if it is a medical device, sanitary registration are required.

Risk classification

JurisdictionLevelDateNote
BrazilSector rulesAugust 26, 2026CFM Resolution 2,454/2026: risk classification, continuous auditing, medical oversight committee and ban on delegating diagnosis communication to AI; ANVISA RDC 657/2022 for medical software.

Obligations related to this use case

Data protection impact report (RIPD)

LGPDLGPD, arts. 10 §3 y 38In force

Already applicable

When it relates
If you carry out high-risk processing: automated decisions, biometrics, sensitive or children's data, monitoring or model training.
What the rule provides
  • Have the RIPD ready to hand over when the ANPD requests it.
  • Follow ANPD guidance (2023), which lists solely automated decisions among high-risk criteria; the specific regulation is still pending.
Typical evidence
  • Dated RIPD per system.
Verification
Verified in the official source on November 4, 2026Checked against the consolidated text of Law 13,709/2018 published by the Chamber of Deputies (Legislação Informatizada), arts. 10 § 3 and 38 (the ANPD may request the RIPD). That the specific RIPD regulation is still pending comes from the ANPD agenda and secondary sources (Mattos Filho, Confidata). Planalto did not respond in this review.

Appoint and publish the data protection officer

ANPD Res. 18/2024 (DPO)LGPD, art. 41; Res. CD/ANPD 18/2024, arts. 3, 8 a 10 y 18In force

Already applicable

When it relates
If you are not a small-scale agent, or if you are but carry out high-risk processing (sensitive data, automated decisions, biometrics, monitoring).
What the rule provides
  • Formally appoint the officer and publish their identity and contact details on the website.
  • Give them autonomy, resources and access to senior management; avoid conflicts of interest.
Typical evidence
  • Appointment act and website disclosure.
Verification
Verified in the official source on November 4, 2026Checked against the LGPD (art. 41, Chamber of Deputies text) and the text of CD/ANPD Res. 18/2024 published by the ANPD on gov.br: art. 3 (formal appointment), 9 (publish identity and contact on the website), 10 (resources and technical autonomy) and 18 (conflict of interest).

Register AI medical software with ANVISA

ANVISA RDC 657/2022 (SaMD)RDC ANVISA 657/2022In force

Already applicable

When it relates
If you develop, import or distribute AI software for diagnostic, therapeutic or clinical support purposes in Brazil.
What the rule provides
  • Classify the software by risk and notify or register it before marketing.
  • Document and justify the AI technique, training and validation data, and performance.
  • Keep post-market surveillance of the product.
Typical evidence
  • Technical file with AI justification.
  • ANVISA notification or registration.
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Effective date (July 1, 2022) and the duty to justify the AI technique per secondary sources (Mattos Filho) and an ANVISA presentation to the Chamber (2025). The official text of RDC 657/2022 could not be opened: antigo.anvisa.gov.br, bvsms.saude.gov.br and the DOU did not respond. A revision of the RDC with AI-specific rules is on the 2026-2027 regulatory agenda.

Clinical use rules: physician decision, patient notice and records

CFM Res. 2,454/2026Res. CFM 2.454/2026In force

Applies from August 26, 2026

When it relates
If physicians use AI to support care, diagnosis or treatment.
What the rule provides
  • Keep the final decision with the physician, who may accept or reject suggestions and refuse unvalidated systems.
  • Inform patients when AI is a relevant support and respect their informed refusal.
  • Do not delegate communication of diagnoses, prognoses or treatment decisions to AI.
  • Record AI use as decision support in the medical record.
Typical evidence
  • Clinical use policy and medical record entries.
Verification
Verified in the official source on November 2, 2026Checked on the CFM's official portal: published in the DOU on Feb 27, 2026 and in force on Aug 26, 2026 (180 days). Adopted Feb 11, 2026 and corrected Mar 5, 2026 per secondary sources. Correction to the notes: the CFM requires an AI and Telemedicine Commission only for institutions that adopt their own AI systems. Ten health organizations asked for it to be suspended; no ruling suspending it was found as of Nov 2, 2026.

Related base documents

Related kits

Includes 5 documents

Healthcare Kit

Technical and clinical validation, DPIA for health data, clinician oversight, in-use monitoring and a model card for clinical AI tools.

USD 139USD 215

Complete kit · available to buy

Find out what applies to you (free)Brazil