Quick Answer:
Brazil's PL 2338/2023 would be Latin America's first comprehensive AI framework, built on a risk-based approach (excessive, high, and non-high), aligned with the LGPD and coordinated by the ANPD. The Senate approved it in December 2024, but it remains pending in the Chamber of Deputies: it is not law yet.
Key Takeaways:
- Legislative status: according to Nathaly Calixto's analysis, PL 2338/2023 was approved by the Senate on December 10, 2024 and remained pending in the Chamber of Deputies as of May 2026 — it is not yet enacted.
- Risk-based framework: according to Regulations.ai, it classifies AI systems into excessive, high, and non-high risk, with mandatory impact and conformity assessments for high-risk systems.
- Regulatory coordination: according to Data Privacy Brasil, the ANPD would coordinate the system alongside sectoral regulators, aligned with the LGPD (Law No. 13,709 of 2018).
- Penalties: according to Nathaly Calixto's analysis and Regulations.ai, fines would reach up to R$50 million per infraction or 2% of Brazilian revenue.
- Reference effect: according to AI Elsewhere, Brazil uses three risk categories versus the EU's four, and its policy could serve as a model for Latin America and the Global South.
Latin America is about to get its first comprehensive artificial intelligence law. As governments from Houston to Monterrey, and from Bogotá to São Paulo, debate how to govern a technology already reshaping commerce, employment, and healthcare, Brazil has moved further than any other country in the region with Bill 2338/2023. For any business that sells, serves, or advertises in Latin American markets, what happens in Brasília will set the direction.
But precision matters: this law does not exist yet. It is a bill in progress, not a statute in force. Understanding exactly where it stands — and what obligations it would bring — is the first step to keeping your business from getting caught flat-footed when the framework takes effect.
Where the bill actually stands
According to Nathaly Calixto's analysis, PL 2338/2023 was introduced on May 3, 2023 by Senator Rodrigo Pacheco and approved by the plenary of the Federal Senate on December 10, 2024. From there the text moved to the Chamber of Deputies, where — per the same analysis — it remained pending a vote as of May 2026.
AI Elsewhere confirms the same timeline, describing the Senate's December 2024 passage of an amended version of the text and placing the House debate in 2025, with a projected presidential signature in the first half of 2026. AI Elsewhere also notes that, once signed, some articles would take effect immediately while most provisions would carry an implementation window of six months to two years.
Important: none of the sources consulted state that PL 2338/2023 is already law. Any headline treating it as enacted is wrong. The process is still open in the Chamber of Deputies.
A risk-based framework, inspired by Europe
According to Regulations.ai, the bill establishes a horizontal, risk-based regulatory framework that classifies AI systems into three tiers: excessive, high, and non-high risk. Each category carries obligations proportional to potential harm, balancing innovation against the protection of fundamental rights.
For high-risk systems, Regulations.ai details that the bill mandates impact assessments, conformity assessment, documentation requirements, and strong alignment with data protection standards. The same analysis notes that the text draws inspiration from the European Union's AI Act and OECD recommendations, adopting mechanisms similar to the European regulatory model.
AI Elsewhere qualifies that comparison: the Brazilian bill uses three risk categories versus the EU's four and, unlike the European approach, its current draft does not emphasize model size as a regulatory variable. Even so, according to AI Elsewhere, it shares with Europe a preventive, harm-reduction approach grounded in transparency and fundamental rights, and even covers the systemic risks of general-purpose AI models.
What would be banned, and what would be high-risk
According to Data Privacy Brasil, the text prohibits a set of uses deemed intolerable. These include social scoring systems by public authorities, autonomous weapons, real-time remote biometric identification — with narrow exceptions for criminal investigations and situations of flagrant crime — systems that exploit vulnerabilities to cause harm, and those that predict the likelihood of criminal behavior based on personality.
At the high-risk tier, Data Privacy Brasil lists AI applied to critical infrastructure, employment decisions (hiring, promotion, and termination), educational and professional selection, eligibility for essential services such as social security, judicial fact-finding, and medical diagnosis and procedures, among others. For these cases, the bill grants affected individuals concrete rights: the right to information, the right to an explanation of decisions, the right to contest them, and the right to human review.
The governance system (SIA), according to Data Privacy Brasil:
- The National Data Protection Authority (ANPD) would act as the coordinating body
- Sectoral regulators (such as ANATEL, ANVISA, ANAC, and the Central Bank) would oversee their areas
- The text affirms the rights of data subjects set out in the LGPD (Law No. 13,709 of August 14, 2018)
Penalties, copyright, and a committee of jurists
According to Nathaly Calixto's analysis, maximum penalties would reach R$50 million per infraction or 2% of the company's revenue in Brazil. Regulations.ai cites a matching figure — up to R$50,000,000 or 2% of Brazilian turnover — alongside other possible sanctions such as warnings, suspension of operations, and prohibition from participating in regulatory sandboxes.
The bill also addresses intellectual property. According to Data Privacy Brasil, developers would have to disclose the protected content used to train their systems, rights holders could prohibit the use of their content when it contradicts their interests, and a fair remuneration system would be established. The same report recalls that the committee of jurists behind the text was led by Minister Ricardo Villas Bôas Cueva of the Superior Court of Justice and Professor Laura Schertel Mendes of the University of Brasília.
Why it matters beyond Brazil
The reach of this law does not stop at Brazil's borders. According to AI Elsewhere, multiple actors intend Brazil's AI policy to serve as an example for the rest of the world, particularly for countries in the Global South, potentially creating a reference effect — a "Brussels Effect" — for Latin America.
For businesses across the region, that means the Brazilian framework may become the template for future laws in Mexico, Colombia, Chile, or Argentina. Algorithmic transparency, data traceability, and the ability to explain how an AI tool reaches a decision will stop being optional best practices and become, sooner or later, requirements.
"Regulation rewards those who can show how and where their business appears in the AI era. If you do not control your own digital presence, you are not ready for what is coming."
- Diego Medina F, Founder of MerchandisePROS
What This Means for Your Business
The underlying message of PL 2338/2023 is clear: the AI era demands transparency, traceability, and the ability to explain your digital presence. And that is where regulation intersects with a far more immediate problem for your business — the way artificial intelligence finds you, understands you, and recommends you.
Every day, more customers do not search on Google: they ask ChatGPT, Perplexity, or Google's AI answer who offers the best service in their city. If your business is not structured, described, and cited consistently, those engines recommend someone else. Our AI Search Optimization (AEO) service targets exactly that: it structures your business data, your schema markup, and your citations so ChatGPT, Claude, Perplexity, and Google AI Overviews name you with confidence — and it documents how and where you appear, the same transparency regulation will begin to require.
The first step is knowing where you stand today. Our Free Audit evaluates, in under 60 seconds, which AI-visibility signals you have and which you are missing, with a 0-to-100 score and a PDF report sent straight to your inbox.
Frequently Asked Questions
Is Brazil's PL 2338/2023 already law?
No. PL 2338/2023 was approved by the Federal Senate on December 10, 2024 and, according to Nathaly Calixto's analysis, remained pending in the Chamber of Deputies as of May 2026. It has not yet been signed into law, so it should be understood as a pending bill, not an enacted statute.
What regulatory approach does Brazil's AI Act take?
According to Regulations.ai, the bill establishes a horizontal, risk-based framework that classifies AI systems into excessive, high, and non-high risks. Each tier carries different obligations; high-risk systems require mandatory impact assessments and conformity assessment.
Which AI uses would be prohibited?
According to Data Privacy Brasil, the text bans uses such as social scoring systems by public authorities, autonomous weapons, real-time remote biometric identification (with narrow exceptions), and systems that exploit vulnerabilities to cause harm.
Who would be the regulatory authority?
According to Data Privacy Brasil and Nathaly Calixto's analysis, the National Data Protection Authority (ANPD) would coordinate the system, working alongside sectoral regulators such as the Central Bank, ANATEL, and the health authority.
How does it compare to the European Union's AI Act?
According to Regulations.ai, the bill draws inspiration from the EU AI Act and OECD recommendations. AI Elsewhere notes that Brazil uses three risk categories versus the EU's four and could create a reference effect for Latin America and the Global South.