At present, Bill No. 2,338 of 2023 is under consideration before the Brazilian National Congress, proposing a framework for the development, promotion, and ethical and responsible use of artificial intelligence (AI), grounded in the principle of human-centricity. The bill seeks to reconcile incentives for technological innovation with the protection of fundamental rights and the guarantees afforded to data subjects, by establishing parameters aimed at legal certainty and the prevention of abusive practices involving AI. Inspired by the European Union’s regulatory model, the proposal adopts a risk-based approach, classifying AI systems according to the potential impact of their applications on human life and the degree of threat posed to fundamental rights, distinguishing between artificial intelligence and generative artificial intelligence.
Pursuant to Article 4 of the bill, an artificial intelligence system is defined as a machine-based system that, with varying degrees of autonomy and for different purposes, is capable of generating outputs — such as predictions, content, recommendations, or decisions — based on a set of input data or information, which may influence virtual, physical, or real environments. A general-purpose AI system, by contrast, is defined as one based on models trained on large-scale datasets, capable of performing a wide range of distinct tasks and serving multiple purposes, including those for which it was not specifically trained. Generative AI, in turn, is characterized as an AI model designed to generate or significantly modify, with varying levels of autonomy, text, images, audio, video, or software code.
The classification of AI systems is primarily based on the potential impact arising from their use, encompassing scenarios of excessive risk, subject to prohibition, and high-risk systems, which are subject to a more stringent regulatory regime. Systems that do not fall within these categories remain permitted, provided that general duties of governance, transparency, security, and accountability are observed, always in line with the protection of individuals’ fundamental rights and the ethical use of technology. The bill also provides, as a “best practice,” for the adoption of a preliminary assessment of the AI system to determine its level of risk, consisting of a simplified self-assessment procedure to be carried out prior to the system’s use or placement on the market. Although optional in certain situations to be defined by the relevant sectoral authority, the adoption of such an assessment may result in benefits for the AI agent, such as priority treatment in conformity assessment procedures relating to governance measures and internal processes required by regulatory authorities.
With the aim of promoting technological development, the bill also provides for the creation of the National System for the Regulation and Governance of Artificial Intelligence (SIA), intended to foster cooperation among regulatory bodies and other sectoral authorities, without any hierarchical relationship between them, as well as to harmonize regulatory action in order to ensure the effective implementation and enforcement of the law. The bill assigns coordination of the system to the National Data Protection Authority — established under the Brazilian General Data Protection Law (Law No. 13,709/2018) — designating it as the “competent authority,” conceived as a federal public administration entity endowed with technical and decision-making autonomy.
With respect to civil liability for damages caused by AI systems, the current wording of the bill provides that consumer relationships remain governed by the rules set forth in the Brazilian Consumer Protection Code. For AI systems developed or used by AI agents outside the consumer context, the Brazilian Civil Code and the applicable special legislation shall apply. In determining the liability regime applicable to a given case, factors such as the level of autonomy of the AI system, its degree of risk, the nature of the agents involved, and the existence of specific liability regimes already provided for by law must be taken into account. It is worth noting that, under the bill, participation in testing or sandbox environments does not exempt AI agents from liability for damages caused during experimentation. Furthermore, where, in the specific case, the victim is deemed vulnerable or where the burden of proving the elements of civil liability is excessively onerous due to the characteristics of the AI system’s operation, the judge may order a reversal of the burden of proof.
In the administrative sphere, the bill establishes a range of sanctions applicable to AI agents in the event of an infringement, ranging from warnings to administrative fines, which may reach up to BRL 50 million per violation or, in the case of private legal entities, up to 2% of their gross revenue. Other penalties include the public disclosure of the infringement, the temporary or permanent suspension of the operation of the AI system, and the prohibition on processing certain datasets. It is emphasized that the imposition of such sanctions is subject to the initiation of an administrative proceeding that ensures due process and full defense, and must observe proportionality criteria, such as the gravity of the violation, the infringer’s good faith, the extent of the harm caused, and the prior adoption of governance mechanisms or codes of ethics. Moreover, the application of administrative sanctions does not, under any circumstances, exclude the obligation to provide full compensation for the damages incurred.
Another relevant topic addressed by the bill concerns copyright and related rights. With respect to the use of protected works, AI system developers are subject to a duty of transparency, consisting of the obligation to publish, on a website, an informational summary of the copyrighted content used at all stages of the system’s development, including data mining, training, retraining, testing, validation, and deployment. The bill also provides for an exception for text and data mining carried out by scientific, research, and educational institutions, as well as museums, public archives, and libraries, provided that access to the works is lawful, the activity is non-commercial in nature, and it does not prejudice the normal exploitation of the work; in such cases, the copies used must be stored securely and only for the time strictly necessary for the activity. Furthermore, the bill ensures that copyright holders retain the right to prohibit the use of content under their ownership in the development of AI systems, and, if such prohibition occurs after the system has been trained, the AI agent will not be exempt from liability for any resulting moral or material damages. The proposal also provides that the use of protected content for mining or training purposes must be accompanied by appropriate remuneration to the rights holders, to be negotiated either directly or collectively, in accordance with proportionality criteria such as the size of the AI agent and the competitive impact on the original work. It is further emphasized that AI systems must comply with the personality rights provided for under the Brazilian Civil Code.
The regulation of artificial intelligence presents itself as a matter of considerable complexity, particularly in light of the rapid pace of technological advancement and its impacts across multiple spheres, whether economic, legal, or social. In this context, overly rigid and definitive legislation tends to become quickly obsolete and may discourage technological development in the country, whereas excessively flexible legislation that fails to ensure predictability in legal relationships may generate legal uncertainty and significant harm. The central challenge therefore lies in striking a balance between promoting innovation and protecting fundamental rights, ensuring a regulatory environment capable of keeping pace with technological evolution without relinquishing legal certainty or the protection of the human person.
Finally, it should be noted that Brazil has not confined the debate on artificial intelligence to the legislative arena, having also adopted concrete initiatives aimed at fostering and consolidating a national AI ecosystem. A notable example is the Brazilian Artificial Intelligence Plan (PBIA), a federal government strategy designed to guide the development, use, and investment in AI in the country between 2024 and 2028, with an emphasis on the ethical, safe, and inclusive use of the technology. Coordinated by the Ministry of Science, Technology and Innovation, the plan establishes nationwide guidelines, goals, and actions, and seeks to promote solutions capable of improving public services, increasing economic productivity, and reducing social and regional inequalities, providing for investments of up to BRL 23 billion in research, infrastructure, business innovation, and AI capacity-building. The objective is to position Brazil as a reference in innovation and efficiency in the use of artificial intelligence, particularly within the public sector. To achieve this goal, however, it is essential that policies aimed at fostering innovation be articulated with the development of an effective regulatory framework that, while ensuring legal certainty, remains capable of adapting to rapid technological transformations, thereby creating the conditions for the sustainable development of AI in the country.
