AI Regulation by Regulatory Agencies

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Brazil’s regulatory agencies face the challenge of creating regulatory frameworks for artificial intelligence in strategic sectors such as health care, telecommunications, energy, and finance.

The Role of Regulatory Agencies in the Age of Artificial Intelligence

Brazil’s public administration is going through a profound transformation. Artificial intelligence already permeates regulated sectors such as health care, telecommunications, transportation, electric power, and the financial market, and regulatory agencies must respond to this reality with appropriate rules and instruments. Looking at the current landscape, we see that sector-specific AI regulation is not merely a technical issue. It is an institutional necessity that involves safety, transparency, the protection of fundamental rights, and sustainable economic development.

Brazil’s regulatory agencies (including ANVISA, the National Health Surveillance Agency; ANATEL, the National Telecommunications Agency; ANEEL, the National Electric Energy Agency; ANS, the National Supplementary Health Agency; ANAC, the National Civil Aviation Agency; CVM, the Securities and Exchange Commission of Brazil; and BACEN, Brazil’s Central Bank) have specialized technical expertise in their respective sectors. That expertise puts them in a privileged position to understand the specific risks AI can pose in each regulated area. An algorithm used for medical diagnosis presents completely different risks from those of an AI system used to price electricity or analyze credit. We therefore recognize that the regulatory approach must be informed by the sector, respecting the particularities of each field.

The Legal Framework for Artificial Intelligence, which moved through the National Congress as Bill 2338/2023, proposed a governance structure that combines centralized regulation with sector-specific regulation. Under this model, each regulatory agency keeps its authority to regulate the use of AI within its own sector, following the general guidelines set by federal legislation. This regulatory architecture avoids both a regulatory vacuum and overlapping jurisdiction, allowing regulation to adapt to the specific features of each regulated market.

Strategic Sectors and Their Specific Regulatory Challenges

Health Care and Health Surveillance

In the health care sector, ANVISA faces the challenge of regulating AI-based medical devices, such as diagnostic support software, automated triage systems, and algorithms for surgical planning. The agency already has experience evaluating software as a medical device (SaMD), but the adaptive nature of some AI systems (which keep “learning” after deployment) calls for new paradigms of conformity assessment. The international trend, followed by agencies such as the FDA in the United States and the EMA in Europe, is to adopt continuous-monitoring frameworks that go beyond traditional pre-market approval.

Sector-specific regulation of artificial intelligence requires each regulatory agency to balance technological innovation with the protection of rights, adapting its regulatory instruments to the particulars of the sector it supervises.

ANS, for its part, must deal with health plan operators’ use of AI to approve or deny procedures. Algorithms that decide on coverage bear directly on the right to health, and regulation must ensure that these automated decisions are transparent, auditable, and open to challenge by the plan beneficiary.

Telecommunications and Data Protection

ANATEL plays a significant role in regulating the infrastructure that supports AI systems, especially in the context of 5G networks and edge computing. Beyond the infrastructure question, the agency monitors the practices of telecommunications operators that use AI for network management, customer service, and data traffic analysis. Overlap with Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, or LGPD) is unavoidable, because the large-scale processing of personal data is inherent to how AI systems operate in the telecommunications sector.

The Financial Sector and Capital Markets

BACEN and CVM already show considerable regulatory maturity in dealing with AI. BACEN has published guidance on the use of algorithms for granting credit, pricing financial products, and detecting fraud. The central concern in these cases is algorithmic non-discrimination, because AI systems trained on historical data can perpetuate biases that result in the financial exclusion of vulnerable groups. CVM, for its part, tracks the growing use of robo-advisors and high-frequency trading algorithms, seeking to safeguard market integrity and protect investors.

Common Principles for Sector-Specific AI Regulation

Although each regulated sector has its own particularities, we can identify principles that should guide all regulatory agencies in governing artificial intelligence. The first is algorithmic transparency. AI systems used in regulated sectors must be explainable to the extent necessary for regulators to carry out their oversight function and for citizens to understand decisions that affect them.

Accountability is another fundamental principle. When an AI system causes harm in a regulated sector (whether a mistaken medical diagnosis, an improper credit denial, or a failure in critical infrastructure), there must be clear mechanisms to identify who is responsible and ensure compensation. Regulatory agencies can require regulated companies to keep detailed records on the development, training, and deployment of their AI systems, making incidents easier to trace.

Regulatory proportionality also deserves emphasis. Not every use of AI in regulated sectors carries the same level of risk. Risk-based classifications (such as the one adopted in the European Union’s AI Act) allow regulation to be stricter where risks are greater, avoiding disproportionate obligations for low-risk applications. We consider this approach especially relevant for the Brazilian context, where protecting rights must be balanced against encouraging innovation and competitiveness.

Regulatory interoperability among agencies is equally crucial. Many AI applications operate where regulated sectors overlap. An AI-based telemedicine system, for example, may be subject at the same time to regulation by ANVISA (as a medical device), ANS (as a health plan), ANATEL (as telecommunications infrastructure), and the National Data Protection Authority (for the processing of personal data). Coordination among these bodies is essential to avoid legal uncertainty and excessive regulatory costs for economic players.

Regulatory Governance and AI Sandboxes

One of the most promising tools for regulating AI in specific sectors is the regulatory sandbox. These controlled environments allow companies to test innovative AI solutions under the supervision of the regulatory agency, with temporary relaxation of certain regulatory requirements. The Central Bank of Brazil has already implemented a regulatory sandbox for fintechs, and other agencies can replicate that experience to assess the impact of AI systems before setting permanent rules.

We believe regulatory sandboxes offer benefits to both regulators and the private sector. Agencies gain hands-on knowledge of how the technologies work, which allows for more informed and effective regulation. Companies, in turn, gain greater regulatory predictability and can adapt their products before a full-scale launch. It is essential, however, that these experimental environments include safeguards to protect consumers and clearly defined exit mechanisms.

Another important aspect of regulatory governance is the technical capacity of the agencies themselves. Effective AI regulation requires regulators to understand deeply the technologies they intend to govern. Investing in training technical staff, hiring specialists, and partnering with research institutions is indispensable if agencies are to perform their functions with the competence the subject demands.

We also note that public participation in the AI regulatory process is indispensable. Public consultations, hearings with experts, and sector dialogues help ensure that regulation reflects the interests of everyone affected, and not only those of technology developers or large economic players. The democratic legitimacy of regulation depends on this openness to broad participation.

Outlook for the Future of Sector-Specific AI Regulation in Brazil

The regulatory landscape for artificial intelligence in Brazil is still under construction. Passage of a general legal framework, combined with sector-specific action by regulatory agencies, is likely to create a robust and adaptable regulatory ecosystem. The main challenges in the coming years include harmonizing general and sector-specific regulation, strengthening the agencies’ institutional capacity to keep pace with the speed of technological innovation, and international cooperation on standards and certifications.

Comparative experience offers valuable lessons. The European Union, with its AI Act, adopted a risk-based approach that is influencing regulators around the world. The United States chose a more decentralized approach, with sector-specific agencies taking the lead in regulating AI within their areas of authority. The Brazilian model, which combines elements of both approaches, has the potential to balance protection and innovation in a way that suits the country’s institutional needs and realities.

Companies that operate in regulated sectors and use, or plan to use, artificial intelligence should keep constant watch on the guidance and rules issued by their respective regulatory agencies. Regulatory compliance is not only a legal obligation. It is also a competitive advantage and a source of trust among consumers, investors, and partners. Proactively adopting good AI governance practices (such as algorithmic impact assessments, periodic audits, and transparency mechanisms) puts organizations in a favorable position as the regulatory environment becomes progressively more demanding.

In conclusion, AI regulation by Brazil’s regulatory agencies is an opportunity for the country to build a model of technology governance that protects fundamental rights without stifling innovation. That balance depends on institutional cooperation, technical capacity, public participation, and a commitment to the principles of transparency and accountability. The regulatory path is complex, but the institutional and legal foundations for following it successfully are already being laid.

This topic is directly related to artificial intelligence regulation, which we address in a dedicated article.

This topic is directly related to AI regulation in the financial sector, which we address in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.