Brazil’s AI bill is described in a great deal of writing as though it were in force. It is not, and the distinction is not pedantic: the risk tiers, the prohibitions and the regulator that summaries attribute to Brazilian law exist only in a text that one chamber of Congress has approved.
PL 2338/2023 was introduced in the Federal Senate in May 2023 by the then-President of the Senate, building on the report of a commission of jurists that had been convened to draft a substitute for earlier and much thinner AI bills. After committee work through 2024, the Senate plenary approved the bill on 10 December 2024 and sent it to the Chamber of Deputies, where it has been examined by a special committee rather than passed straight to a floor vote.
As at the date on this page, the bill has not been enacted. It has been approved by one chamber and remains before the other.
This is a status page about a live legislative process and it is written to be checked, not relied on. It is not legal advice. Before making any decision that depends on whether Brazil has an AI statute, verify the current stage on the official tracking pages linked below—a page written at any date can be overtaken the following week.
The reason “approved by the Senate” is so frequently misreported as “passed” is that the remaining route is substantial and can change the text materially. A bill originating in the Senate goes to the Chamber of Deputies as the revising chamber. If the Chamber amends it, the amended text returns to the Senate, which decides between its own text and the Chamber’s. Only when both chambers have settled on one text does it go to the President, who may sanction it in whole, or veto provisions in part, with vetoes subject to being overridden by Congress.
Each of those stages has changed the substance of comparable Brazilian technology legislation. The LGPD itself, Brazil’s data protection statute, was enacted in 2018 and then amended before it ever took effect, including changes to the very provision on automated decisions that is now the operative Brazilian rule—see what Article 20 of the LGPD requires today. Treating a one-chamber text as final has a poor record in this jurisdiction specifically.
Described accurately—as the content of an approved-by-one-chamber text, not as law—the Senate version is a comprehensive, risk-tiered instrument with clear EU influence and several distinctly Brazilian departures. Its principal elements are:
The resemblance to the EU AI Act’s risk tiers is real but should not be over-read. The Brazilian text approaches AI substantially through a rights and consumer-protection frame, drawing on the Consumer Defence Code tradition, where the EU instrument is built as product safety law. Obligations that look equivalent can be enforced through very different routes as a result.
Three questions are open and none of them can be answered by reading the Senate text.
Whether it passes at all, and in what form. Brazilian industry associations have pressed for narrower scope and lighter obligations, and civil society organisations for stronger rights and tighter biometric limits. A special committee is exactly the venue in which a text is rewritten. Anyone telling you what the final Brazilian AI law will say is predicting, not reporting.
How enforcement would be allocated. Coordination between the ANPD and sectoral regulators is described at a level of generality that leaves the practical question—who inspects, who fines, who resolves a conflict between two regulators—to implementing rules that do not exist.
When any of it would apply. Comprehensive statutes of this kind normally carry a transition period, and the length of that period is one of the most heavily negotiated numbers in the text. Until enactment there is no commencement date to plan against.
Brazilian legislative tracking is public and unusually good, and checking takes a minute.
In the meantime, the Brazilian rules that do bind an AI deployment are the general ones: the LGPD, the Consumer Defence Code, the Civil Rights Framework for the Internet, sectoral financial regulation, and labour law. That is a smaller compliance surface than PL 2338 would create, and it is the one that exists.