The EU AI Act: Lessons for Brazil

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The European Union has passed the world’s most comprehensive regulation on artificial intelligence, and Brazil can (and should) learn from that experience as it builds its own regulatory framework.

What the AI Act Is and Why It Matters Globally

The European Union’s AI Act (Artificial Intelligence Regulation) is the first comprehensive regulatory framework devoted exclusively to the legal governance of artificial intelligence systems. Approved by the European Parliament in March 2024, with a phased entry into force beginning in 2025, the regulation sets rules proportionate to the level of risk that each AI application poses to the fundamental rights of European citizens.

Looking at the global context, it becomes clear that the European AI Act did not emerge in isolation. It is part of a regulatory trend that recognizes the need to govern technologies that already influence decisions in health care, credit, public safety, employment, and justice. The European approach stands out for its risk-based model, which sorts AI systems into four distinct categories: unacceptable risk (prohibited), high risk (heavily regulated), limited risk (transparency obligations), and minimal risk (free use).

Practices considered an unacceptable risk include social scoring by governments, subliminal manipulation of behavior that causes harm, exploitation of the vulnerabilities of specific groups, and certain forms of real-time biometric surveillance in public spaces. These prohibitions reflect a clear political choice: some AI applications simply should not exist in a democratic society, no matter what efficiency gains they might offer.

For systems classified as high risk (those used in critical infrastructure, education, employment, essential services, law enforcement, and the administration of justice), the regulation requires a prior conformity assessment, detailed technical documentation, effective human oversight, transparency about how the system works, and mechanisms that allow affected people to challenge its outcomes.

Brazil’s Regulatory Landscape: Where We Stand

Looking at Brazil’s situation, the country does not yet have specific, comprehensive legislation on artificial intelligence. Bill No. 2.338/2023, now pending in the National Congress, is the main legislative initiative under way. Inspired in part by the European model, the Brazilian bill also takes a risk-based approach, but it differs from the AI Act in significant ways.

Brazil already has a legal framework that partly applies to AI. The General Data Protection Law, or LGPD (Law No. 13.709/2018), regulates the processing of personal data, including by automated systems, and gives data subjects the right to request review of decisions made solely on the basis of automated processing. The Marco Civil da Internet, Brazil’s Internet Civil Rights Framework (Law No. 12.965/2014), establishes principles for the use of the internet in the country. The Consumer Protection Code offers protection in consumer relationships involving automated systems.

These rules, however, were not designed to address the specific features of artificial intelligence. The LGPD, for example, deals with the protection of personal data, but it does not address issues such as algorithmic bias in systems that do not process personal data, civil liability for harm caused by generative AI, or the governance of general-purpose models. There is, therefore, a regulatory gap that must be filled strategically.

Regulating artificial intelligence does not mean slowing down innovation. It means making sure that technological development stays within limits that protect fundamental rights and build society’s trust in automated systems.

We also note that the ANPD (Brazil’s National Data Protection Authority) has positioned itself as a relevant player in this debate, publishing preliminary analyses on AI regulation and taking an active part in legislative discussions. Which agency will hold regulatory authority over AI in Brazil remains an open question, and it is one of the most sensitive points in the debate.

Concrete Lessons from the AI Act for Brazilian Legislation

The first important lesson concerns risk-based classification. The European model shows that treating all AI applications the same way is inadequate. A customer service chatbot poses very different risks from a system that assists in judicial decisions or determines whether someone receives social security benefits. Brazil can benefit from this tiered approach by adapting the risk categories to national realities. We consider it essential that the Brazilian classification take into account the country’s social and digital inequalities, which magnify the harmful effects of biased AI systems.

The second lesson involves transparency and explainability. The AI Act requires that users be told when they are interacting with an AI system, and that high-risk systems be transparent enough for their results to be interpreted. In Brazil, this requirement takes on added importance when we think of systems used by the INSS (Brazil’s National Social Security Institute) to review benefits, by banks to grant credit, or by employers to screen job candidates. Brazilian citizens need the right to understand, at least in general terms, why an automated decision went against them.

The third lesson concerns mandatory human oversight. The AI Act requires high-risk systems to include mechanisms that allow effective oversight by human beings. This requirement is especially relevant to Brazil in the context of public administration, where automated decisions about social benefits, taxation, and public services affect millions of people. Human oversight cannot be merely a formality. It must be substantive, with trained public officials who have the autonomy to question and reverse algorithmic decisions.

The fourth lesson deals with the governance of general-purpose AI (such as large language models). The AI Act introduced specific obligations for providers of these models, including technical documentation, a copyright compliance policy, and systemic risk assessments for the most powerful models. We believe Brazil should pay attention to this category, since most generative AI systems used in the country are developed by foreign companies, which raises complex questions about jurisdiction and enforcement.

Challenges Specific to the Brazilian Context

When we propose carrying lessons from the AI Act over to Brazil, we must acknowledge that there are significant structural differences between the European and Brazilian contexts. The European Union has a well-established regulatory tradition, with independent authorities that have robust technical and financial resources. Brazil, for its part, faces institutional-capacity challenges that cannot be ignored.

The first challenge is deciding which authority will be in charge. The AI Act designates national authorities in each Member State, coordinated by the European Commission’s AI Office. In Brazil, the debate over which body will regulate AI involves the ANPD, sector-specific regulatory agencies, and the possibility of creating a new authority. The institutional choice will have deep consequences for how effective the regulation is. We argue that, whichever model is adopted, the authority needs technical autonomy, an adequate budget, and the ability to engage with the different sectors it regulates.

The second challenge is the impact on domestic innovation. Unlike Europe, which has a relatively mature AI ecosystem, Brazil is still building its technological base in this area. Overly restrictive regulation could stifle the growth of Brazilian startups and research centers, creating even greater dependence on foreign solutions. Regulation must strike a balance between protection and support for innovation, possibly through regulatory sandboxes (controlled testing environments) like those provided for in the AI Act itself.

The third challenge is digital inclusion and algorithmic literacy. For the rights granted by a future AI law to be effective, Brazilian citizens need a minimum ability to recognize that algorithmic decisions are affecting them and to exercise their right to challenge those decisions. In a country where a significant share of the population still faces barriers to digital access, this challenge cannot be underestimated.

The Question of Civil Liability

One point that deserves special attention is civil liability for harm caused by AI systems. Alongside the AI Act, the European Union is working on a specific directive on civil liability for AI, which eases the burden of proof for victims. In Brazil, the discussion over whether liability should be strict (regardless of fault) or fault-based (dependent on proof of fault) remains central to the legislative debate. We believe that, for high-risk systems, strict liability better protects citizens’ rights, especially given the information asymmetry between AI developers and the people affected by their decisions.

Outlook for the Future of AI Regulation in Brazil

For all its strengths, the European AI Act is not a perfect model. It has been criticized for its complexity, for its potential impact on European competitiveness, and for certain gaps regarding military and national security applications. Brazil has the opportunity to learn from both the successes and the missteps of the Europeans.

We believe the core principles of good AI regulation for Brazil include: proportionality (requirements that match the level of risk), transparency (the right to know when AI is affecting you), human oversight (especially in decisions that affect fundamental rights), non-discrimination (active efforts to combat algorithmic bias), accountability (clear mechanisms for redress of harm), and public participation (an open and democratic regulatory process).

The present moment is decisive. While PL 2.338/2023 moves forward in Congress, other countries are also defining their regulatory strategies. China, Canada, Japan, and several Latin American countries are developing their own approaches. Brazil has the chance to establish itself as a regulatory reference point in the Global South by building a model that is technically sound, socially fair, and economically viable.

We need to follow legislative developments closely and take an active part in the public debate on this subject. Regulating artificial intelligence is not purely a technological matter. It is a matter of fundamental rights, of democracy, and of the kind of society we want to build over the coming decades.

This topic is directly related to deepfakes and AI regulation in Brazil, which we cover in a dedicated article.

This topic is directly related to the legal framework for artificial intelligence in Brazil, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.