By Taylor Adriano Chaves
An artificial intelligence regulation affecting Brazilian companies came into effect on August 2nd. It was drafted in Brussels.
The Brazilian legal framework is still awaiting a report from the rapporteur in a special committee of the Chamber of Deputies, with the election calendar ahead.
For those already using AI in production, this reversal sets the agenda for the coming months.
Brazil does not yet have a general law on artificial intelligence in force. What exists is a bill under consideration, PL 2.338/2023, in addition to regulations that already apply to the use of AI without having been written specifically for it, starting with the General Data Protection Law. On the European side, the AI Act applies to suppliers and operators regardless of their place of establishment, whenever the system is made available on the European market or when its results are used within the territory of the Union.
What came into effect on August 2nd
The transparency obligations of Article 50 came into effect on that date, and they are not limited to systems classified as high-risk.
The central requirement is straightforward. Anyone offering a chatbot, virtual assistant, or generative AI tool with their own brand needs to clearly inform the user that they are interacting with an artificial intelligence system, and ensure that the content produced is technically machine-identifiable.
Machine-readable markup is the point that most companies underestimate. A warning on the interface is not enough. The generated file needs to carry the source information in a format that another system can read.
For generative models that were already on the market before August 2nd, there is a deadline of December 2nd, 2026 to specifically comply with this labeling requirement.
The rules also apply to open-source systems when they fall under the provisions of Article 50, which eliminates the interpretation that an open license removes the obligation.
It's worth noting the impact this obligation has on daily corporate life. Automated customer service on the website, initial resume screening by conversational assistants, generation of advertising material, and automatic meeting summaries all fall into the same category when the results are disseminated to a European audience.
The July postponement is not an extra deadline.
Just a few days earlier, the European regulation underwent its first formal review since its adoption in 2024. The Digital Omnibus on AI, published as Regulation (EU) 2026/1744 in the Official Journal on July 24, entered into force on July 27.
The regulation postponed the most demanding obligations, aimed at high-risk systems, from August 2026 to December 2027, arguing that this would give the Union itself time to finalize the oversight structure for these systems.
The postponement stopped there. The transparency deadlines, the obligations of the general-purpose models in effect since August 2025, the prohibited practices in effect since February 2025, and the monitoring and sanctions regime remain unchanged.
The interpretation of the experts who analyzed the package is the one that matters to corporate legal counsel: the postponement affects only some high-risk obligations. Anyone treating December 2027 as the new general deadline will discover the error upon the first notification.
The sanctioning regime varies according to the type of infraction and can reach percentages of total annual revenue, which shifts the topic from the innovation table to the risk table.
Why does this affect a company that has never operated in Europe?
The criterion for application is not the company's headquarters. It is the destination of the system or its output.
This means that a communications agency in São Paulo that produces content aimed at a European audience, a software house that licenses solutions to clients in Germany, or an exporter that uses AI to serve buyers in the bloc could fall under the scope of transparency obligations.
A common mistake in Brazilian legal departments is treating the regulation as a European problem. The correct question is not where the company is located, but rather which of its systems reach users, candidates, partners, or suppliers within the territory of the European Union.
There is a chain effect that amplifies the problem. A company that provides software to a client with European operations effectively carries the client's requirement, which will be passed on in a contractual clause even without a direct legal obligation on the Brazilian supplier. It is through this channel that the foreign standard reaches those who have never read the regulation.
Answering this requires a survey that almost no company has done, because the information is distributed among product, marketing, and sales teams.
Meanwhile in Brazil
Bill 2.338/2023, authored by Senator Rodrigo Pacheco, was approved by the Senate on December 10, 2024, after more than a year of work in the temporary internal committee on artificial intelligence, with Senator Eduardo Gomes as rapporteur.
Submitted to the Chamber in March 2025, the text went to a special committee under the rapporteurship of Congressman Aguinaldo Ribeiro. Between May 20 and September 30, 2025, the committee held twelve public hearings. The processing record continues to register the proposal as awaiting the rapporteur's opinion.
In December 2025, the Executive Branch submitted its own bill to address the procedural flaw and design the institutional architecture. The proposal structures the National System for the Development, Regulation, and Governance of Artificial Intelligence, creates the Brazilian Council for Artificial Intelligence bringing together the ANPD (National Data Protection Authority) and ministries, and assigns to the data protection agency the role of residual regulator, with normative, supervisory, and sanctioning powers in sectors without specific AI regulation.
The design keeps sectoral agencies responsible for the rules within their own domains, and provides for advisory bodies involving civil society, the productive sector, and independent researchers.
Regarding the timeline, prudence dictates caution. The issue went through 2025 without a vote, and 2026 is an election year, with a compressed congressional calendar.
What is already required here, without a legal framework.
This is the part that resolves the false dilemma between waiting for the law and acting now.
The LGPD (Brazilian General Data Protection Law) applies to all use of AI involving personal data, and Article 20 specifically regulates decisions made based on automated processing, with the right to request a review. Credit, resume screening, pricing, and customer service prioritization fall under this provision without requiring a new regulation.
Legal bases for processing, stated purpose, and minimization still apply to data used in training and prompts, a point that often goes unnoticed when the tool is contracted as a service.
There is also sector-specific regulation already in place. The National Council of Justice regulated the use of artificial intelligence in the Judiciary through Resolution 615/2025, and the Electoral Court established its own rules for labeling synthetic content in advertising for 2026.
Add to this the Consumer Protection Code, which covers offers, advertising, and adequate information about the product or service, without requiring that the technology used have a specific name in the law. Automated service that leads the consumer to believe they are speaking with a person is a consumer relations problem before it is an AI regulation problem.
The practical result is that the company waiting for Bill 2338 to begin operations is already failing to comply with an existing obligation.
The inventory that precedes any adaptation.
The work sequence is known and does not depend on which text is ultimately approved.
Systems analysis. Mapping where AI is in use within the organization, including tools contracted as a service and functionalities embedded in software the company already used.
Risk classification. Apply the European taxonomy and the Brazilian project taxonomy to each system, identifying those that qualify as high-risk and focusing adaptation efforts on them.
Due diligence on extraterritorial exposure. Verify which systems reach people or markets in the European Union, because these fall under the scope of the AI Act regardless of the company's location.
Documented impact assessment. For sensitive systems, record training data, bias metrics, robustness, transparency, and human oversight, with documented decision-making and identified responsible party.
Document governance. Defining who approves the deployment of a system into production, using what criteria, and where the tests that supported the decision are recorded. This is the set of documents that responds to an audit, and it is not produced after the fact.
None of these steps are lost if the Brazilian legal framework arrives with a design different from the Senate's text. They all produce reusable documentation.
What is not yet defined
The institutional architecture is the most open point. The rapporteur presented adjustments to the definition of high-risk systems, impact assessment criteria, and civil liability parameters, which indicates that the final text may differ from the version approved in the Senate.
Also still under discussion is how the central authority will coordinate with sectoral regulators that already issue AI regulations in their respective domains, a matter of competence that often leads to overlap in practice.
From the European perspective, the July review itself shows that the timetable could change again, and that enforcement is the real bottleneck in technology regulation.
What is not in dispute is the direction. Transparency regarding synthetic origin, documentation of automated decisions, and identifiable accountability appear in all versions, both Brazilian and foreign.
For those who need to convince management to release budget funds, there's a more effective argument than the risk of a fine. Large corporate clients are already asking, during the purchasing process, how suppliers handle the origin of synthetic content and automated decision-making. Compliance became a commercial requirement before it became a full legal requirement in Brazil.
Because the expertise here is both legal and technical at the same time.
Adapting an AI operation requires reading regulations and understanding system architecture. Those who master the regulations but don't know what machine-readable markup is write policies that the engineering team can't implement. Those who master the technology but ignore the legal basis for data processing build a product that the authorities can stop.
The IDP's Postgraduate Program in Digital Law, Data, and Artificial Intelligence explores precisely this frontier. The first axis covers digital constitutionalism, internet governance, data protection, provider liability, and the regulatory frameworks of LGPD, GDPR, and Marco Civil. The second deals with intellectual property in the digital environment, competition between platforms, behavioral advertising, and consumer rights in the information age.
The course is 100% online, with live classes on Fridays from 18 PM to 9:15 PM and Saturdays from 21:30 AM to 12:45 PM, every two weeks, totaling 384 hours, and starting on August 21, 2026.
Among the professors is Laura Schertel Mendes, PhD in Private Law from Humboldt University of Berlin, president of the Digital Law Commission of the Brazilian Bar Association (OAB Federal) and rapporteur of the Commission of Jurists on Artificial Intelligence of the Federal Senate, whose work gave rise to the text under discussion. Also teaching are Victor Fernandes, National Secretary of Digital Rights of the Ministry of Justice, and Fabrício da Mota Alves, former National Data Protection Advisor of the National Data Protection Authority (ANPD).
Learn about the Postgraduate Program in Digital Law, Data, and Artificial Intelligence: https://pos.idp.edu.br/products/pos-graduacao-em-direito-digital-dados-e-inteligencia-artificial
References
Entry into force of the transparency obligations of Article 50 on 02/08/2026, deadline until 02/12/2026 for machine-readable marking on models already available before that date, and scope over open source systems: https://sitepd.org.br/2026/08/03/ue-amplia-regras-da-lei-da-ia-com-novas-exigencias-para-empresas/ and https://sindpd.org.br/2026/08/03/fase-lei-da-ia-obrigacoes-empresas/
Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24/07/2026 and in force since 27/07/2026, postponing the high-risk obligations from August 2026 to December 2027 and maintaining the other deadlines, in addition to extraterritorial scope: https://www.terra.com.br/noticias/regulacao-europeia-adia-prazos-para-ia-de-alto-risco,49935b8f7e32a5534d2179459382d921gkg22lua.html
Reading that the postponement is not an extra deadline and detailing the most urgent obligation, with analysis by Bruna Castanheira and Vanessa Pirró: https://jornalempresasenegocios.com.br/espaco-empresarial/adiamento-do-ai-act-nao-e-prazo-extra-para-adequacao-alertam-especialistas/
The status of Bill 2338 in the Chamber of Deputies, registered as awaiting the rapporteur's opinion in the special committee, in the official processing record: https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2487262
Approval in the Senate on 10/12/2024 with Eduardo Gomes as rapporteur in the CTIA and twelve public hearings held in the Chamber between 20/05 and 30/09/2025: https://www.dataprivacybr.org/comissao-especial-do-pl-de-ia-na-camara-dos-deputados/
Report by Aguinaldo Ribeiro in the special committee: https://www.diap.org.br/index.php/noticias/noticias/92249-pl-2338-23-votacao-do-projeto-sobre-inteligencia-artificial-esta-prevista-apenas-para-dezembro
Executive Branch project from December 2025, creating SIA, CBIA, CRIA and CECIA, and assigning ANPD the role of residual regulator: https://convergenciadigital.com.br/governo/inteligencia-artificial-projeto-do-governo-foi-articulado-com-relator-e-entra-no-pl-2338-23/
Adjustments by the rapporteur regarding the definition of high risk, impact assessment criteria and civil liability, and mention of the LGPD (Brazilian General Data Protection Law) and CNJ Resolution 615/2025 as already applicable regulations: https://criaai.app.br/blog/regulamentacao-inteligencia-artificial-no-brasil/ and https://www.barbieriadvogados.com/regulamentacao-inteligencia-artificial-brasil/
