To say yes, legal needs to know what applies today and see what the company has decided to do. We found no research that measures legal as an AI bottleneck, so the minimum below is our proposal, with no study validating it. The legal status is as of November 4, 2026.
What is law today
Brazil has no general AI law. The LGPD, Brazil’s data protection law, already applies when AI processes personal data. Art. 20 gives data subjects the right to request a review of decisions made solely through automated processing. Art. 7, IX, and art. 10 cover legitimate interest as a legal basis and its limits. Art. 11 deals with sensitive data, and art. 12 with anonymized data. Art. 38 lets the authority require an impact report.
The ANPD, Brazil’s data protection authority and now an agency, has no AI-specific resolution. In its official list of regulations, none deals with AI or automated decisions. Parameters for art. 20 are on its regulatory agenda, and it records disagreement over requiring human review. It already acts anyway: it plans enforcement activities on AI systems and issued a preventive measure in the Grok case.
What is still a bill
PL 2338/2023 is not law. It passed the Senate and, in the Chamber of Deputies, awaits the rapporteur’s report in the special committee. The record shows no report and no voting date, lists about 40 attached bills, and its last act, on October 27, 2026, was only an attachment. The text can still change, and waiting for it does not suspend the LGPD. Anyone saying the legal framework has been signed, or treating a fine in the bill as a current rule, is wrong.
Usage policy
In a Gartner survey, 71% expect to use AI agents within 12 months, and 21% say they have the capacity to govern them. The first figure is an expectation, and Gartner sells advisory services. A short policy answers four questions:
- Which tools are approved, and who approves new ones?
- Which data cannot go in, with attention to personal and sensitive data?
- Who reviews what AI produces before it becomes a decision?
- Who answers for exceptions and incidents?
Risk matrix
The matrix lists each use and answers, for each one: is there personal or sensitive data? Is the decision solely automated, which triggers art. 20? Who is affected? Which control applies, and who owns it? For the highest-risk uses, keep the record of processing (art. 37) and an impact report ready (art. 38). Leave room to reclassify each use if the law changes.
Vendor clauses
Much of this gets settled in the contract. Among Brazilian companies using AI, 80% bought a ready-made solution and 54% hired a vendor to develop or modify one. Among those with 250 people or more, 81% and 60%. It is self-reported, by phone, with an 8% response rate. The contract needs to cover:
- Roles: when acting as processor, the vendor follows the controller’s instructions (art. 39).
- Training: whether it can use your data to train models, and on what legal basis.
- Transfer: where the data is processed, and under what rule (art. 33).
- Incidents: how it gives notice, so you can inform the authority and the data subject (art. 48).
- Exit: who owns the deliverables, and how data is returned or deleted.
This text does not cover sector regulators such as the Central Bank, CVM and ANS, or state laws. No number here is a Nebuloz result.
Status as of November 4, 2026. This text is general information, not legal advice.