Americas
🇧🇷LGPDANPDBill 2338
AI governance in Brazil.
Brazil has Latin America's most active AI governance landscape. LGPD — a comprehensive GDPR-modelled privacy law — is in force and enforced. An AI Bill has passed the Senate and is moving through the House. Brazil set G20 AI principles during its 2024 Presidency. This is a jurisdiction in active development, not a blank slate.
Key facts for organisations
- ▸Brazil is the most active AI governance jurisdiction in Latin America — with LGPD in force, an AI Bill in advanced Congressional stages, and a mature data protection authority.
- ▸The LGPD creates specific rights around automated decision-making — individuals can request review of decisions made solely by automated means that affect their interests, and organisations must explain the criteria and procedures involved.
- ▸Bill 2338, which passed the Brazilian Senate in 2024, creates a risk-based AI framework with prohibited practices, conformity assessment for high-risk AI, transparency obligations, and liability rules. It was still progressing through the House as of mid-2026.
- ▸Brazil is a member of the Global Partnership on AI (GPAI) and has engaged in international AI governance discussions, including the G20 AI principles under Brazil's 2024 G20 presidency.
- ▸Australian organisations with Brazilian customers, employees, or operations are subject to LGPD when processing personal data of individuals in Brazil — including through AI systems.
- ▸ANPD has actively enforced LGPD including on automated decision-making — making Brazil one of the few jurisdictions outside Europe with active enforcement of AI-adjacent data protection obligations.
Regulatory frameworks
LGPDIn force
Lei Geral de Proteção de Dados — Brazil's comprehensive data protection law, modelled largely on GDPR. In force since 2020, with enforcement by ANPD. Applies to AI systems processing personal data of people in Brazil.
Bill 2338/2023In Congress
Brazil's AI Bill — passed the Senate in 2024 and is progressing through the House of Representatives. Creates a risk-based AI framework, prohibits certain high-risk AI applications, and establishes transparency and accountability requirements. Expected to pass in 2025–26.
ANPDActive
Autoridade Nacional de Proteção de Dados — Brazil's national data protection authority. Enforces LGPD, has issued AI-specific guidance, and is expected to have a central role in AI law enforcement when Bill 2338 passes.