AI laws in Brazil are still taking shape. Brazil’s comprehensive AI regulation is still on its way. The Senate passed the AI bill in December 2024, and the Chamber of Deputies is expected to vote on it after the October 2026 elections. Meanwhile, existing legislation on children online, election campaigns and data protection already covers important parts of AI, enforced by a data protection agency that gained new powers in 2026.
This guide explains what applies now and what is coming. Each rule links to its entry in our Brazil AI law tracker.
AI laws in Brazil: the short answer
- Apps used by children: the ECA Digital law has required reliable age checks and banned ad profiling of minors since 17 March 2026.
- Political campaigns: AI content must be labelled and deepfakes of candidates are banned.
- Businesses: people can ask for review of decisions made solely by automated processing.
- AI builders: watch PL 2338, which would add risk-based duties.
The AI bill (PL 2338/2023): a risk-based regulatory framework
PL 2338/2023, introduced in 2023 by Senator Rodrigo Pacheco, then President of the Senate, and drawing on a 2022 report by a commission of jurists, would give Brazil a framework for AI that follows a risk-based approach, similar in spirit to the EU AI Act but adapted to the Brazilian context. It would regulate AI systems by the risk they pose: banning some uses judged to carry excessive risk, setting stricter duties for high-risk systems, including an algorithmic impact assessment, and creating a National System for AI Regulation and Governance (SIA) to supervise the development and use of artificial intelligence. The country’s privacy regulator would coordinate it, working with sectoral regulatory bodies.
The bill also sets out rights for people affected by AI systems, such as explanation, contestation, human review and non-discrimination, including protection against algorithmic discrimination, to protect fundamental rights. The Senate text also has rules for general-purpose and generative AI models.
The Federal Senate approved it on 10 December 2024. A special committee of the Chamber of Deputies is now reviewing the draft bill. A vote planned for June 2026 slipped, and in August 2026 the rapporteur said it would come after the elections, towards the end of the year. If the Chamber changes the text, it goes back to the Senate before it can become law.
Children online: ECA Digital
Law 15.211/2025, known as ECA Digital, extends Brazil’s child protection statute to the digital world. It has applied since 17 March 2026 to technology products and services aimed at children, or likely to be used by them.
It requires reliable age verification rather than a simple “I am over 18” box, bans profiling minors for advertising and loot boxes in games, and requires parental tools. It also calls for a review of AI tools. The national data protection agency, ANPD, enforces it. Penalties are steep: fines of up to 10% of the group’s revenue in Brazil or, where there is no revenue, R$10 to R$1,000 per registered user, capped at R$50 million per infraction, plus court-ordered suspension or bans.
AI in elections
Brazil’s Superior Electoral Court (TSE) sets the rules for campaigns. Since 2024, its rules have required labels on AI-generated or altered campaign content and banned deepfakes.
For the October 2026 elections, Resolution 23.755 of 2 March 2026 went further:
- New AI content using a candidate’s image or voice was banned from 72 hours before voting until 24 hours after, even if labelled.
- Platforms selling boosts for political content had to let advertisers declare AI use.
- Judges could shift the burden of proof, so whoever published contested AI content had to show it was lawful and how AI was used.
- AI systems were not allowed to recommend candidates or how to vote, even when asked.
Fines range from R$5,000 to R$30,000, and serious abuse can cost a candidate their registration or mandate. The TSE issues fresh rules for each election.
Automated decisions under the LGPD, Brazil’s General Data Protection Law
Brazil’s General Data Protection Law (LGPD), its main data privacy law, has applied since September 2020. Article 20 gives people the right to request review of decisions made solely by automated processing of their personal data that affect their interests, including profiling for credit, consumer or professional purposes. They can also ask for clear information about the criteria used.
Where a business refuses to explain, citing trade secrets, the regulator can audit the system to check for discrimination.
The regulator: ANPD and AI governance
The former National Data Protection Authority became the National Data Protection Agency, a regulatory agency with more independence, under Law 15.352/2026, published on 25 February 2026. A key reason for the change was its new role as the main regulator and enforcer of ECA Digital. If the AI legislation passes, it is expected to coordinate AI governance and supervision too. Because AI regulation and data protection overlap so closely, its guidance is worth following.
What this approach to AI means for you
App and game makers
- If children in Brazil use your product, review age checks, advertising and parental tools now.
- Check whether any AI applications or features could profile or target minors.
Political communicators
- Label AI content in campaigns and never fake a candidate.
- Declare AI use when boosting political posts.
Businesses
- Be ready to explain and review automated decisions such as credit scores or account blocks.
- If you work on AI development, follow the AI bill: risk assessments and documentation are likely to become duties.
- Keep a record of what each AI system decides and the use of AI in your products, so you can answer questions from customers and regulators.
- Build ethical use of AI into product design now; it will make compliance easier if the bill passes.
Key dates
- 18 September 2020: the LGPD is in force.
- 10 December 2024: the Senate approves the AI bill.
- 17 March 2026: ECA Digital takes effect.
- 4 and 25 October 2026: general elections under the new AI rules.
- Still to come: the Chamber of Deputies vote on PL 2338.
Common questions about AI regulation in Brazil
Is there an AI law in Brazil?
Not yet a general artificial intelligence law. The AI bill, PL 2338/2023, has passed the Senate and is waiting for a vote in the lower house. Until it becomes law, the AI regulatory gap is filled by specific rules: ECA Digital for children online, the electoral court’s campaign rules and data protection rules.
When will Brazil’s AI bill become law?
There is no fixed date. The lower house was expected to vote towards the end of 2026, after the elections. If it changes the Senate’s text, the bill returns to the Senate, and the president can then sign or veto parts of it. Most provisions would also have a transition period before they apply.
Does the LGPD apply to AI?
Yes, whenever an AI system uses personal data, including the data used to train it. Businesses need a legal basis for that processing and must respect people’s rights over their data, and the ANPD can require a personal data protection impact report. Article 20 adds the right to review of solely automated decisions.
Does ECA Digital apply to foreign apps?
It applies to digital products and services aimed at children in Brazil, or likely to be used by them. That can include apps, games and platforms run from outside Brazil, so international companies with young Brazilian users should check it.
Can I use AI in political content in Brazil?
Yes, with limits. AI-generated or altered campaign content must be labelled, deepfakes of candidates are banned, and for the 2026 elections new AI content using a candidate’s image or voice was banned in the 72 hours before voting. Breaking the rules can lead to fines and, for candidates, much worse.
Last checked: 5 November 2026. This guide explains the law in plain English; it is not legal advice. Laws change quickly, so check the tracker entries and their official sources before you rely on them. Spotted an error? Tell us, and see how we check facts.
