Since 2020, Brazil has been discussing the regulation of artificial intelligence through legislative proposals. With the intensification of discussions, the Federal Senate formed the Commission of Jurists responsible for subsidizing the drafting of a substitute bill on artificial intelligence in Brazil (CJSUBIA), which produced the final report concluding the commission’s work. This included a draft that was eventually formalized as Bill 2.338/2023.
The bill establishes general norms for the development, implementation, and responsible use of artificial intelligence systems with the aim of protecting fundamental rights and ensuring the implementation of safe and reliable systems, for the benefit of human beings, the democratic regime, and scientific and technological development.
The original text comprises nine chapters and presents the foundations that underpin the law, definitions of concepts related to the theme, principles, rights, as well as explaining the need for prior analysis of AI systems before their market launch, especially in terms of mapping and classifying the risks associated with the system.
Regarding risks, the bill presents examples and guidelines for identifying high and excessive threats, guiding the need for additional measures in cases of high risk and prohibiting treatment in the case of excessive risk.
According to the proposal, in relation to high risk, an algorithmic impact assessment will be necessary, which should be public and included in a database created for this purpose. The bill provides guidelines for this assessment, also allowing the authority to define other criteria.
For public security activities, the text provides for the possibility of using continuous biometric identification systems in publicly accessible spaces, in cases where there is a specific federal law and judicial authorization related to criminal prosecution.
The treatment must be based on governance measures and respect due legal process and judicial control, in addition to the principles and rights set forth in the law, especially the guarantee against discrimination and the need for a review of the algorithmic inference by the agent.
If the law is breached, administrative sanctions can be applied, ranging from warnings and fines to public disclosure of the infraction, prohibition or restriction on participating in a regulatory sandbox regime, partial or total suspension of the development, supply, or operation of the AI system, prohibition of processing certain databases, among others. In addition to these, there is also the obligation to repair the patrimonial, moral, individual, or collective damage.
Regarding the bill and potential points of convergence and/or conflict between it and the LGPD (General Data Protection Law), the National Data Protection Authority (ANPD) has already expressed its favorable position regarding the promotion of innovation, emphasizing the need to resolve any overlaps and conflicts between the norms, as well as the legal attributions of the ANPD, suggesting that it should be the key authority in the regulation and governance of AI in Brazil, especially in cases of personal data processing, for greater legal security and regulatory convergence between the protection of personal data and the regulation of artificial intelligence.
The text is currently being evaluated by the Temporary Commission on Artificial Intelligence in the Senate.
