PL 2338: Brazil Advances in AI Regulation and What Changes for Technology Companies
In December 2024, the Brazilian Senate approved PL 2338/2023, which establishes the regulatory framework for AI in the country. In March 2025, the text was forwarded to the Chamber of Deputies. The law adopts a risk-based approach, with three categories: excessive risk (prohibited), high risk (with stringent requirements), and other systems (general obligations). For developers and operators, the impacts are immediate and structural.
On 10 December 2024, the Brazilian Federal Senate approved Bill 2338/2023, which establishes the rules for the development and use of artificial intelligence in Brazil. On 17 March 2025, the text was forwarded to the Chamber of Deputies for review. For it to become law, it requires approval from the Chamber and presidential sanction.
The Brazilian legislative process follows, with local adaptations, the logic of the EU AI Act: a risk-based approach that does not broadly block innovation but imposes obligations proportional to the severity of the potential impacts of each system.
The Risk Structure
Excessive risk: systems prohibited due to their potential to irreparably violate fundamental rights. The text includes, as examples, comprehensive social scoring systems that affect civil rights, subliminal behavioural manipulation, and the exploitation of vulnerabilities of specific groups for harmful behaviours.
High risk: systems that affect sensitive areas such as critical infrastructure, education, employment, credit, health, essential services, judicial processes, and law enforcement. In these cases, developers and operators must maintain detailed documentation of risk assessments, implement human oversight, ensure the explainability of automated decisions, establish incident reporting mechanisms, and cooperate with authorities in audits.
Systems not classified as high risk: subject to general transparency obligations, including the requirement to inform the user that they are interacting with an AI system when this is not evident from the context.
The Impact on Companies
For AI developers, the requirements include documentation of architecture, training data, bias mitigation measures, and testing procedures before each deployment in high-risk use. For operators, the obligation of human oversight may necessitate a review of processes that are currently fully automated.
The impact on startups is disproportionately greater. While large corporations can absorb compliance costs as part of existing regulatory operations, startups developing AI for health, credit, or employment will need to allocate significant resources for documentation and governance before scaling.
International Relevance
Brazil is the largest market in Latin America and carries diplomatic weight in the construction of international standards for AI governance. The Brazilian law, once approved, will serve as a reference for countries in the region that do not yet have specific legislation, including Colombia, Argentina, and Chile. For companies with operations in multiple countries in Latin America, this means that compliance with the Brazilian framework is a starting point, not a ceiling.
Approval in the Chamber should be closely monitored. Amendments may significantly alter the scope and specific requirements of the current text.