Americas
🇧🇷LGPDANPDBill 2338
AI governance in Brazil.
Brazil has Latin America's most active AI governance landscape. LGPD, a comprehensive GDPR-modelled privacy law, is in force and enforced. An AI Bill has passed the Senate and is moving through the House. Brazil set G20 AI principles during its 2024 Presidency. This is a jurisdiction in active development, not a blank slate.
Key facts for organisations
- ▸Brazil is the most active AI governance jurisdiction in Latin America, with LGPD in force, an AI Bill in advanced Congressional stages, and a mature data protection authority.
- ▸The LGPD creates specific rights around automated decision-making, individuals can request review of decisions made solely by automated means that affect their interests, and organisations must explain the criteria and procedures involved.
- ▸Bill 2338, which passed the Brazilian Senate in 2024, creates a risk-based AI framework with prohibited practices, conformity assessment for high-risk AI, transparency obligations, and liability rules. It was still progressing through the House as of mid-2026.
- ▸Brazil is a member of the Global Partnership on AI (GPAI) and has engaged in international AI governance discussions, including the G20 AI principles under Brazil's 2024 G20 presidency.
- ▸Australian organisations with Brazilian customers, employees, or operations are subject to LGPD when processing personal data of individuals in Brazil, including through AI systems.
- ▸ANPD has actively enforced LGPD including on automated decision-making, making Brazil one of the few jurisdictions outside Europe with active enforcement of AI-adjacent data protection obligations.
Regulatory frameworks
LGPDIn force
Lei Geral de Proteção de Dados, Brazil's comprehensive data protection law, modelled largely on GDPR. In force since 2020, with enforcement by ANPD. Applies to AI systems processing personal data of people in Brazil.
Bill 2338/2023In Congress
Brazil's AI Bill, passed the Senate in 2024 and is progressing through the House of Representatives. Creates a risk-based AI framework, prohibits certain high-risk AI applications, and establishes transparency and accountability requirements. Expected to pass in 2025–26.
ANPDActive
Autoridade Nacional de Proteção de Dados, Brazil's national data protection authority. Enforces LGPD, has issued AI-specific guidance, and is expected to have a central role in AI law enforcement when Bill 2338 passes.