LGPD e Governança de IA no Brasil 2026: Prioridades da ANPD e Fiscalização
A LGPD do Brasil aplica-se totalmente a sistemas de IA. A ANPD tornou-se agência reguladora independente em 2026. IA é prioridade de supervisão para 2026-2027.
Key Takeaways
Brazil's LGPD (Lei Geral de Proteção de Dados) applies fully to AI systems processing personal data of Brazilian residents. The ANPD has made AI governance a top enforcement priority for 2026-2027.
In September 2025, through Provisional Measure No. 1.317/2025, the ANPD became an independent regulatory agency with significantly strengthened enforcement powers — including the ability to order businesses to cease operations.
ANPD's 2026-2027 Priority Themes Map explicitly identifies AI and emerging technologies as a supervision priority, covering facial recognition, recommendation systems, and automated decision-making.
Brazil's Digital Child and Adolescent Statute (Law 15.211/2025), in force from March 2026, creates new obligations for platforms and AI systems processing children's data.
Brazil's federal AI Bill (PL 2338/2023) is progressing through Congress but not yet enacted. LGPD remains the primary binding legal framework for AI governance in Brazil.
"Apenas para fins informativos. Este artigo não constitui aconselhamento jurídico, regulatório, financeiro ou profissional. Consulte um especialista qualificado para orientação específica."
Brazil's AI governance landscape in 2026
Brazil has emerged as Latin America's most active jurisdiction for AI governance enforcement, driven by a strengthened data protection authority and an explicit regulatory commitment to supervising AI systems. Understanding Brazil's AI governance framework requires understanding three layers: the LGPD as the foundational binding law; the ANPD's rapidly evolving enforcement posture; and the proposed federal AI Bill that is progressing through Congress.
The LGPD and AI: binding obligations now
Brazil's General Data Protection Law applies to any processing of personal data of individuals located in Brazil, regardless of where the processing occurs or where the organisation is based. This extraterritorial scope means that international organisations with Brazilian users or customers are within scope. The LGPD's principles — purpose limitation, data minimisation, transparency, and accountability — apply to AI systems that process personal data with the same force as to any other data processing activity.
Automated decision-making is specifically addressed in Article 20 of the LGPD, which gives data subjects the right to request review of decisions made solely on the basis of automated processing that affect their interests. This creates a direct obligation for organisations using AI in consequential decisions — credit, employment, insurance, access to services — to establish meaningful review mechanisms. The right to explanation and contestation under the LGPD is one of the most operationally significant AI governance obligations in Brazil.
The ANPD: newly independent, newly powerful
In September 2025, through Provisional Measure No. 1.317/2025, Brazil transformed the ANPD into a full independent regulatory agency — the National Data Protection Agency — with its own assets, administrative autonomy, and significantly expanded enforcement powers. The ANPD can now order establishments to cease operations, seize goods, and request police assistance in cases of obstruction. This represents a fundamental shift from an advisory to an enforcement-oriented posture.
The ANPD's 2026-2027 Priority Themes Map, published December 2025, explicitly identifies AI and emerging technologies as a top enforcement priority. Supervised areas include facial recognition systems, recommendation and ranking algorithms, and automated decision-making systems — particularly where children's data is involved. Organisations using AI to process personal data of Brazilians should treat this as a signal of imminent enforcement activity.
The Digital Child and Adolescent Statute (ECA Digital)
Law 15.211/2025, signed September 2025 and in force from March 2026, creates sweeping new obligations for platforms and AI systems that may reach children and adolescents in Brazil. The statute introduces privacy by default requirements, age verification obligations, and enhanced ANPD authority over child data protection online. AI systems — particularly recommendation algorithms, content moderation AI, and personalisation systems — that may be used by or affect Brazilian minors face significant new compliance obligations.
Brazil's proposed federal AI Bill
Federal Bill PL 2338/2023 proposes a dedicated AI regulatory framework for Brazil, modelled loosely on the EU AI Act's risk-based approach. The bill was progressing through the Brazilian Congress as of early 2026, with the ANPD expected to be designated as the primary supervisory authority. Full adoption and implementation timeline remains uncertain, but the direction is clear: Brazil is moving toward a dedicated AI governance framework that will layer on top of existing LGPD obligations. Organisations building compliance for the LGPD's current requirements are building the foundation that the proposed AI Bill will extend.