Bill 2.338/2023: what Brazil’s AI legal framework may change

Where does PL 2.338/2023 stand?

The bill passed the Senate on December 10, 2024 and moved to the Chamber of Deputies (Câmara dos Deputados). As of October 2026, it was still under analysis in a special committee of the Chamber, with the vote postponed until after Brazil’s October 2026 elections.

This path matters because the text can still be amended. If the Chamber makes changes, the bill goes back to the Senate before moving forward. In other words, the deadlines, definitions and obligations discussed today may not be the ones in the final version.

The safest reading is to treat the bill as a direction, not a finished rule. The risk-based logic, however, has been at the center of the debate from the start, and it is what helps a company get organized without depending on the final wording.

What is the risk-based approach?

The core idea is simple: the greater the possible impact of an AI system on people and their rights, the stricter the requirements. Some uses are considered excessive risk and are prohibited. Others are classified as high risk and carry additional obligations. Everything else follows lighter rules.

For high-risk systems, the text approved by the Senate includes obligations such as an impact assessment before use, human oversight of decisions, transparency about how the system works and record keeping. In business terms: know what the AI does, know who is accountable for it and be able to prove what happened.

Which uses fall into each category is one of the points that may still change in the Chamber. Your company does not need to guess the final list, but it does need to know which of its AI uses touch decisions about people, credit, health, employment or access to services, because those usually weigh the most in any risk classification.

What could Brazil’s AI framework change for companies?

The first change is visibility. Many companies use AI in several places, from customer service to document review, without a single inventory. A risk-based framework assumes the company knows where AI is used, what it is for and what data it relies on.

The second is accountability. Human oversight means named people who monitor and can review relevant decisions. Records mean being able to reconstruct later why a decision was made. This applies to in-house systems and to vendor solutions alike, which should prompt contract reviews.

The third is fitting in with existing rules. The bill does not replace the LGPD, Brazil’s General Data Protection Law, which remains in force with the ANPD as the data protection authority. Nor does it replace sector rules from regulators such as Bacen, CVM, ANS and Anvisa. In practice, AI governance tends to build on the data and risk governance the company already has.

Keep in mind that accountability does not disappear when AI comes from a vendor. If your company uses a third-party system to support a relevant decision, it still needs to understand what the system does, what data it uses and how a decision can be reviewed. That is why transparency and records are likely to become contract items, not just technology items. Since the text may change, confirm with your legal team how this applies to each case.

How to prepare without waiting for the law: a 5-step plan

1 · Build an inventory of AI uses. List in-house systems, contracted tools and pilots. For each one, note the purpose, the owning business area and the data involved.

2 · Make a preliminary risk classification. Flag the uses that affect decisions about people or their rights. This classification is internal and should be revisited once the final text is approved, but it already shows where to focus.

3 · Name accountable people. For each relevant use, define who monitors the system, who can review a decision and who answers if something goes wrong. Oversight without an owner does not work.

4 · Record decisions and rules. Keep track of what data the system accessed, which rule it applied and who approved it. A simple audit trail today avoids a painful reconstruction tomorrow.

5 · Review contracts and vendors with legal. Check what your AI vendors offer in transparency, records and data protection. Confirm with your legal team how to follow the bill and when to adjust each point.

How Semantix runs AI with regulation in mind

At Semantix, AI agents and specialists operate IT and business processes under clear rules. Safetix, part of the Semantix AI Suite, governs that operation: it sets rules and permissions, grants access only to what is needed and traces every execution, with human approvals recorded. Personal data is masked before it reaches the model, and the client chooses where the models run, including in Brazil or in its own environment.

We follow the discussions around PL 2.338/2023 and ABRIA, as well as the LGPD and sector rules, and we operate with ISO 27001, ISO 27701, PCI-DSS and SOC 2 Type II certifications. If you want to know where the risk sits in your operation, the path starts with a diagnostic.

You choose how far Semantix goes: use the Semantix AI Suite with your team, build together with Semantix or contract the operation. That is how Semantix, The Enterprise AI Company, builds enterprises that learn.