What is PL 2338/2023?
PL 2338/2023, known as the Marco Legal da Inteligencia Artificial, is a bill that would establish a comprehensive legal framework for the development and use of artificial intelligence in Brazil. It originated in the Senate, where it was approved by symbolic vote on 10 December 2024.
The bill was then sent to the Chamber of Deputies. On 4 April 2025, the Chamber created a Special Commission to analyse the text. The official Chamber status page, checked on 4 August 2026, records that it is awaiting the rapporteur's report and lists 17 June 2026 as the latest legislative action. The Chamber may amend the text before voting; if it does, the bill returns to the Senate for conciliation.
The Senate-approved text phases entry into force, but the Chamber may modify the implementation timeline and penalties before enactment. Senado Federal: bill text and procedural history.
PL 2338/2023 is not yet law. The penalty ranges, risk classifications, and obligations described on this page reflect the Senate-approved text and may be modified by the Chamber of Deputies.
Risk classification under the Marco Legal
The Senate-approved text of PL 2338/2023 establishes three risk tiers. These broadly parallel the EU AI Act's risk pyramid but use different terminology and scope.
Excessive risk (risco excessivo) — prohibited
- Social scoring by government entities
- Indiscriminate biometric surveillance in public spaces (with law-enforcement exceptions)
- AI systems that exploit vulnerabilities of specific groups (children, elderly, persons with disabilities) in ways that cause harm
High risk (alto risco)
- AI used in employment decisions (recruitment, evaluation, dismissal)
- AI used in credit and insurance decisions
- AI used in education (admissions, grading, allocation)
- AI used in healthcare (diagnosis, treatment recommendations)
- AI used in criminal justice and law enforcement
- AI used in essential public services (welfare, utilities)
- AI used in autonomous vehicles
High-risk systems would be subject to impact assessments, human oversight requirements, transparency obligations, and documentation duties.
Non-high risk
All other AI systems would be subject to general transparency and good-practice obligations, including the right of users to know they are interacting with an AI system.
LGPD and AI: what applies today
While the Marco Legal works through the Chamber, the LGPD (Lei Geral de Protecao de Dados, Lei 13.709/2018) is already in force and already applies to AI systems that process personal data. Three articles are particularly relevant.
Article 20 — automated decision review
Data subjects have the right to request a review of decisions made solely by automated processing that affect their interests — including profiling, credit scoring, and hiring decisions. The data controller must provide clear and adequate information about the criteria and procedures used. Note: the original draft required human review, but a legislative amendment removed that requirement. Article 20 requires a review, but does not mandate that it be performed by a human. This applies to any AI system making decisions that affect individuals, regardless of whether the Marco Legal is enacted.
Article 38 — RIPD (data protection impact report)
The ANPD may require a Relatorio de Impacto a Protecao de Dados Pessoais (RIPD) for processing activities that present high risk to data subjects' fundamental rights and freedoms. AI-driven profiling, automated credit decisions, and large-scale processing of sensitive data are all candidates for a RIPD. This is Brazil's equivalent of a DPIA under the GDPR.
Article 11 — sensitive personal data
Processing of sensitive personal data (racial or ethnic origin, religious belief, political opinion, health data, biometric data, genetic data) requires explicit and specific consent or one of the narrow legal bases listed in Article 11. AI systems trained on or processing sensitive data face a higher compliance bar under the LGPD, regardless of the Marco Legal's status.
ANPD enforcement priorities 2026–2027
The Autoridade Nacional de Protecao de Dados (ANPD) has signalled that AI and automated decisions are among its enforcement priorities for the 2026–2027 cycle. This means that even without the Marco Legal, the ANPD is actively looking at how organisations use AI in ways that touch personal data.
Areas of particular ANPD focus include:
- Automated decision-making that affects individuals' rights (Article 20 enforcement)
- Transparency in algorithmic processing of personal data
- Impact assessments for high-risk automated processing
- Cross-border data transfers involving AI systems
Organisations deploying AI in Brazil should not wait for the Marco Legal to become law. The ANPD already has enforcement authority under the LGPD, and AI-related processing is squarely in its sights.
What developers should do now
Whether or not PL 2338/2023 is enacted this year, the following steps are worth taking today. All are grounded in obligations that already exist under the LGPD or that will apply under the Marco Legal regardless of final text.
- Inventory your AI systems. List every AI-powered feature in production: what data it processes, what decisions it makes or influences, and which user categories it affects. The LGPD already requires you to know this.
- Map your automated decisions. Identify every system that makes decisions solely by automated processing. Under LGPD Article 20, data subjects can request a review of these decisions. Document the criteria, the logic, and the review mechanism for each one. While Article 20 does not require human review specifically, implementing a human review path is a best practice that also prepares you for Marco Legal obligations.
- Assess whether you need a RIPD. If your AI system processes personal data at scale, profiles individuals, or handles sensitive data categories, you likely need a data protection impact report under LGPD Article 38.
- Review your sensitive data processing. AI systems trained on or inferring sensitive personal data (health, biometrics, racial/ethnic origin) face stricter requirements under LGPD Article 11. Confirm your legal basis.
- Prepare for Marco Legal high-risk obligations. If your system falls into any of the high-risk categories (employment, credit, education, healthcare, criminal justice, essential services, autonomous vehicles), start documenting risk assessments, human oversight provisions, and transparency measures now. You will need them if the bill passes.
- Track the bill. Follow the Special Commission proceedings at the Camara dos Deputados. The rapporteur's report will signal what the final text looks like.
How Regula helps
Regula is an open-source compliance CLI that combines code scanning with governance questionnaires for AI risk assessment. Its framework crosswalk already includes both the LGPD and the Marco Legal da IA, so you can map risk findings to the relevant Brazilian articles today.
For a team building AI for the Brazilian market, the practically useful commands are:
# Install
pipx install regula-ai
# Scan for risk indicators with Brazil-specific mapping
regula check --jurisdictions brazil . # Maps findings to LGPD articles
# Gap analysis against Brazilian frameworks
regula gap --framework lgpd # LGPD article-by-article gap assessment
regula gap --framework marco-legal-ia # Marco Legal gap assessment
# Inventory what you have
regula discover . # AI systems present in the project
regula inventory # AI library / model references
# Generate compliance evidence
regula conform # Conformity evidence pack
regula oversight # Human oversight detection
# Health and reproducibility
regula self-test
regula doctorThe framework crosswalk covers all 7 EU AI Act obligation articles (Articles 9–15), each mapped to both LGPD and Marco Legal articles. This means you can use the same scan to understand your compliance posture across the EU AI Act, the LGPD, and the Marco Legal simultaneously.
Regula is open source, written in Python with zero production dependencies, and the entire detection ruleset is in the repository. Brazilian teams can fork it, add Brazil-specific patterns, and contribute them back.
Frequently asked questions
What is PL 2338/2023 (Marco Legal da IA)?
PL 2338/2023, known as the Marco Legal da Inteligencia Artificial, is a bill that would establish a legal framework for AI in Brazil. The Senate approved it by symbolic vote on 10 December 2024. It was sent to the Chamber of Deputies, where a Special Commission was created on 4 April 2025. The official Chamber status page, checked on 4 August 2026, records that the bill is awaiting the rapporteur's report. It is not yet law.
Does Brazil have an AI law?
Not yet. PL 2338/2023 passed the Senate on 10 December 2024 but is still being considered by the Chamber of Deputies. The Senate-approved text phases entry into force: most provisions apply 730 days (two years) after publication, while rules on generative and general-purpose systems, prohibited practices and author rights apply after 180 days (Senado Noticias, 10 Dec 2024). The Chamber may modify this timeline. In the meantime, the LGPD (Lei 13.709/2018) already applies to AI systems that process personal data, including automated decision-making under Article 20.
How does the LGPD apply to AI systems?
The LGPD applies to any AI system that processes personal data of individuals in Brazil. Article 20 gives data subjects the right to request a review of decisions made solely by automated processing that affect their interests (note: the original draft required human review, but that requirement was removed by legislative amendment). Article 38 requires a RIPD (data protection impact report) for high-risk processing. Article 11 imposes stricter rules when sensitive personal data is involved. The ANPD has signalled that AI and automated decisions are enforcement priorities for 2026–2027.
What are the penalties under the Marco Legal da IA?
The Senate-approved bill specifies financial penalties, but those provisions may change during Chamber deliberation and are not current law. Senado Federal: bill text and status.
What risk categories does the Marco Legal define?
The bill as approved by the Senate establishes three risk tiers: excessive risk (prohibited uses such as social scoring by government and indiscriminate biometric surveillance), high risk (AI used in employment, credit, education, healthcare, criminal justice, essential services, and autonomous vehicles), and non-high risk (subject to general transparency and good-practice obligations). The Chamber may modify these categories.
What should Brazilian developers do now?
Inventory AI systems in production. Map every automated decision to its LGPD Article 20 review mechanism. Assess whether a RIPD is needed under Article 38. Review sensitive data processing against Article 11. Prepare documentation for Marco Legal high-risk obligations. Track the Special Commission proceedings at the Chamber of Deputies.
Can Regula scan for LGPD and Marco Legal compliance?
Yes. Regula's framework crosswalk includes both LGPD and Marco Legal da IA. The commands regula gap --framework lgpd and regula gap --framework marco-legal-ia map risk findings to the relevant articles of each framework. The command regula check --jurisdictions brazil applies LGPD-mapped rules to your scan results.
How does the Marco Legal compare to the EU AI Act?
Both use a risk-based approach, but their categories, institutions, and procedures differ. The Brazilian bill remains subject to Chamber amendment. Senado Federal bill record.
What we are tracking and what may change
The Marco Legal is still in committee. The final text may differ significantly from the Senate-approved version. Here is what we are watching as of 4 August 2026:
To verify on enactment
- High-risk category definitions. The Chamber may add, remove, or redefine high-risk categories. Autonomous vehicles, in particular, were a late addition and may be scoped differently.
- Penalty ranges. The Senate-approved provisions may be adjusted during Chamber deliberation.
- Supervisory authority. The Senate text assigns oversight roles but the final institutional arrangement (single authority vs sector-specific model) may change.
- Transition period. The Senate-approved text phases entry into force: 730 days for most provisions, 180 days for generative/prohibited-practice/author-rights rules (Senado Noticias, 10 Dec 2024; some analyses cite Art. 80 of the approved substitute). An earlier version of this page stated a single one-year window citing Art. 45 — that was wrong. The final timeline will be confirmed upon enactment.
- ANPD role. Whether the ANPD becomes the primary AI regulator or shares authority with sector-specific regulators.
- Senate conciliation. If the Chamber amends the text, it returns to the Senate. The final text may differ from both the Senate-approved and Chamber-amended versions.
We update this page as the bill progresses. If you want to be notified when the tracker changes, watch the repository.
Sources
Primary and secondary sources
- Senado Federal — PL 2338/2023 — full legislative text, voting record, and procedural history. senado.leg.br/materia/157233
- Camara dos Deputados — Special Commission creation (4 April 2025), rapporteur appointment, and procedural updates. www.camara.leg.br
- LGPD (Lei 13.709/2018) — full text of the Lei Geral de Protecao de Dados. Articles 11, 20, and 38 govern sensitive data, automated decisions, and data protection impact reports respectively.
- ANPD — Autoridade Nacional de Protecao de Dados — enforcement priorities and regulatory agenda. gov.br/anpd
- Securiti — analysis of PL 2338/2023 risk classification and penalty structure. Used as a secondary source for the risk tier summary.
- Baker McKenzie — legal analysis of the Marco Legal da IA and its interaction with the LGPD. Used as a secondary source for the framework comparison.
If you spot an error on this page, open an issue on github.com/kuzivaai/getregula or email a correction. We would rather be told than be wrong.
Where does your own system stand?
The browser assessment is free, needs no account, and runs on your device. When the answer turns on something it cannot see, it says so and names the fact, rather than rounding the gap into a score. That makes it a starting point for review, not a legal determination.
Start the free assessment →