The real state of regulation: there is no normative vacuum
The public debate on AI regulation in Brazil frequently reduces the topic to a single question: "will Bill 2,338/2023 be approved?" But AI regulation in Brazil already exists — it is fragmented, transversal, and is evolving independently of the approval of a specific legal framework.
The LGPD (Law 13,709/2018) already governs the use of AI systems involving personal data — which in practice is the overwhelming majority of commercial applications. Article 20 of the LGPD guarantees citizens the right to request a review of decisions made solely on the basis of automated processing. Article 37 mandates the creation of a data protection impact assessment in high-risk cases. These obligations are in effect today, with or without Bill 2,338.
December 2025: the month that redefined the landscape
In December 2025, two simultaneous moves changed the regulatory landscape:
ANPD publishes the Map of Priority Themes 2026-2027: The National Data Protection Authority included artificial intelligence and emerging technologies as one of the four inspection axes for the biennium — alongside data subject rights, child protection in the digital environment, and data processing by the government. This means 75 planned inspection activities, with AI as a transversal theme.
The Executive branch presents the SIA: The federal government submitted a supplementary bill creating the National System for the Development, Regulation, and Governance of Artificial Intelligence (SIA), formalizing the ANPD as the system's coordinator. The project also solves a constitutional problem identified in Bill 2,338/2023: by assigning normative competencies to the ANPD, the original bill had dealt with matters of exclusive initiative of the Executive — which exposed the text to a question of unconstitutionality in the STF.
February 2026: two new bills in the Chamber of Deputies
On February 24 and 25, 2026, two new bills were introduced in the Chamber of Deputies:
Bill 762/2026 introduces a specific regulatory framework for high-impact or critical AI systems, requiring them to undergo an Artificial Intelligence Impact Assessment (AIA). The core elements: rules on classification, security, privacy, governance, certification, oversight, and liability; mandatory certification and registration with the ANPD before operating in Brazil; data subject rights including explainability and human review of potentially harmful decisions; and cooperation between the ANPD, the Ministry of Science and Technology, and sector-specific agencies.
The second bill focuses on algorithmic transparency and log retention for auditing by digital platforms — directly influenced by the European Digital Services Act (DSA).
The ANPD's AI sandbox: what is happening in practice
In parallel to the legislative debate, the ANPD advanced its AI regulatory sandbox — an experimental environment where companies test AI applications under the regulator's supervision before a definitive regulation is established.
Three companies were selected for the testing phase: Synapse Inteligência Artificial Ltda. (score of 16.33), IA Greenworld Ltda. (score of 14.10), and a third company not publicly disclosed as of publication date.
In February 2026, the ANPD concluded the leveling phase and the companies entered the practical testing phase. The lessons learned during the sandbox will serve as a basis for definitive regulation by the ANPD.
The ANPD and Technical Note 12/2025
Before the sandbox, the ANPD had already signaled its regulatory direction with Technical Note No. 12/2025, which consolidated the contributions of the Call for Contributions on the regulation of Article 20 of the LGPD — the right to review automated decisions. The note reveals the approach the ANPD is developing: participatory, evidence-based, and aligned with international standards, especially the European AI Act.
What all this means for Brazilian companies right now
LGPD compliance is non-negotiable today: Article 20 of the LGPD is a current obligation. The ANPD has 75 planned inspection actions for 2026-2027, with AI as the axis. Companies that do not document their automated decisions are at immediate risk.
The structure of Bill 762/2026 will influence the final text: Regardless of which bill prevails, the convergence around mandatory AIA for high-risk systems, prior certification, and explainability is clear. Building this infrastructure now is a real competitive advantage.
The sandbox is a sign of regulatory maturity: The ANPD is not waiting for the legal framework to learn how to regulate AI. Companies that wish to influence the final regulation can participate in the public consultations opened by the authority.
The picture in July 2026
Brazil currently has a multi-layered AI regulatory landscape: the LGPD in effect with Article 20 being regulated; the ANPD with its sandbox in practical tests and 75 planned inspections; Bill 2,338/2023 in the Chamber awaiting a vote; the recently introduced Bill 762/2026; and the Executive's SIA still pending attachment. It is not the simplest scenario for compliance — but it is a much more concrete scenario than it was a year ago.
