Brazil's Senate approves AI bill PL 2338/2023

What it is

Brazil's Federal Senate approved Bill No. 2338/2023, a comprehensive national framework for regulating artificial intelligence, on December 10, 2024.

The measure still needs approval from the Chamber of Deputies and the president before it can take effect as law.

What it requires

The bill sets out rules for developing and using artificial intelligence in Brazil, following a tiered, risk-based structure.

It would generally prohibit the use, development, and deployment of AI systems classified as excessively risky.

For AI generally, the bill would set civil liability for harms caused by AI and create a supervisory and inspection system for AI use.

The bill would also allow developers to use copyrighted material to train AI models if that material was obtained for non-profit purposes.

Non-compliance penalties under the bill can reach BRL 50 million or a percentage of a company's turnover.

What security leaders should do

Security and compliance teams operating in or selling into Brazil should start mapping AI systems and use cases against the bill's excessive-risk and high-risk categories now, since the Senate text already defines what falls into each tier. Because the bill ties civil liability directly to harms caused by AI and sets up a dedicated supervisory and inspection regime, organizations should build records showing risk classification, impact assessment, and oversight decisions for any AI system that could reach Brazilian users. Given the bill still needs Chamber of Deputies and presidential approval, leaders should track the text as it moves rather than assume the Senate-passed version is final, and should align any Brazil-specific controls with existing data protection obligations under Brazilian law so the two regimes do not conflict.