Federal Senate Bill of Law No. 2338, of 2023

• Authority: Other authorities
• Collections: Miscellaneous documents
• Most recent activity: Proposed
• Most recent activity date: 2023-05-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Compromise of privacy
• Overreliance and unsafe use
• Loss of human agency and autonomy
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• False or misleading information
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• Increased inequality and decline in employment
• Environmental harm
• AI pursuing its own goals

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 12-14 subdomains, with strong focus on discrimination and bias (1.1, 1.3), privacy and data protection (2.1), misinformation (3.1), malicious actors and misuse (4.1, 4.2, 4.3), human-computer interaction (5.1, 5.2), and AI system safety and robustness (7.1, 7.3, 7.4). Coverage is concentrated in discrimination prevention, transparency, human oversight, and governance frameworks.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Trade, Transportation & Utilities
• Finance & Insurance
• Scientific Research & Development Services
• Educational Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Information
• Professional & Technical Services
• Management, Administrative & Support Services

All other sectors had no coverage in this document.

Sectors Summary

This is a horizontal AI regulation that applies across all economic sectors in Brazil. The document explicitly identifies high-risk AI applications across multiple sectors including critical infrastructure, education, employment, financial services, healthcare, public administration, and national security. The regulation governs AI development and deployment comprehensively rather than being sector-specific.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative instrument (Federal Senate Bill) with extensive mandatory obligations, enforcement mechanisms including administrative sanctions and fines up to R$50 million, and a designated competent authority for oversight and enforcement.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The bill was authored by Senator Rodrigo Pacheco and developed with input from a Commission of Jurists specifically established to draft AI legislation, which conducted extensive consultations including public hearings with over 70 specialists and received 102 written contributions.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The law explicitly defines and targets both AI system providers (developers) and operators (deployers), including both private entities and public sector organizations at all levels of government. The definitions in Art. 4 clearly establish these as the regulated parties.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The law establishes a central competent authority to be designated by the Executive Branch with comprehensive enforcement powers including inspection, sanctions, and regulatory authority. It also provides for coordination with sectoral regulatory bodies.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The competent authority has explicit monitoring responsibilities including inspection powers, receiving reports of serious incidents, maintaining public databases of impact assessments, and preparing annual reports on its activities.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all stages of the AI lifecycle, with particularly strong emphasis on Design, Verification/Validation, Deployment, and Operation/Monitoring. It establishes requirements spanning from initial planning and risk assessment through ongoing monitoring and incident reporting.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• General Purpose AI

Technical Scope Summary

The document explicitly defines and covers AI systems broadly, with specific attention to high-risk applications. It does not explicitly mention frontier AI, general purpose AI, foundation models, or specific compute thresholds. The focus is on AI systems generally, with risk-based categorization rather than technical architecture distinctions.