Brazil advances on AI, data and cyber laws

Brazil’s Chamber of Deputies is reviewing PL 298/2024, a bill that would amend Article 103 of the Brazilian Traffic Code to address the cybersecurity of vehicles and ban charging consumers for electronic operating system updates. The text also instructs CONTRAN to define procedures for technical vulnerability assessments, types of integrity testing, and a timetable for adding security measures to new projects.

What would PL 298/2024 change?

The proposal is aimed at bringing security requirements into the design and technical validation of connected vehicles. Based on the material provided, the measure does not only address vulnerabilities linked to intrusions or cyberattacks, it also prevents passing the cost of electronic operating system updates on to the user.

How is AI regulation progressing in Congress?

Bill No. 2,338/2023, which establishes Brazil’s Legal Framework for Artificial Intelligence, is still moving through the Chamber of Deputies after being approved unanimously by the Federal Senate on December 10, 2024. According to TozziniFreire Advogados, the text has been waiting for months for the rapporteur’s opinion in the Special Committee of the Chamber and no vote is scheduled.

The Federal Senate also says PL 2338/2023 was approved and sent to the Chamber on March 17, 2025, where it remains linked to other AI proposals in the Chamber’s Internal Temporary Committee on Artificial Intelligence in Brazil, the CTIA. In parallel, a Chamber committee approved a bill that seeks to extend data protection rules to artificial intelligence systems, according to coverage by Repórter Maceió and Contábeis.

What other bills are still pending?

The Observatório do PL No. 3,102/2022 places that proposal in the Chamber’s Committee on Constitution and Justice and Citizenship as of July 2, 2026, pending the appointment of a rapporteur, after it was approved by the Senate plenary with Amendment No. 1 on May 13, 2026 and sent to the Chamber on May 18, 2026. The Federal Senate, meanwhile, lists PL 2830/2019 as "PRONTA PARA A PAUTA NA COMISSÃO" since November 24, 2025, with its latest stop in the CCJ and a history of review of Amendment No. 2-PLEN after passing through the Social Affairs Committee.

What is the ANPD doing?

The ANPD has started monitoring digital platforms, app stores and generative AI tools to check obligations tied to the Marco Civil da Internet, with a focus on preventing illegal content and protecting children, teenagers and women online. Companies that receive notice must respond within 10 business days.

The ANPD also published the testing methodology for its Regulatory Sandbox on Artificial Intelligence and Data Protection, a document that sets out supervision, monitoring and evaluation procedures for the solutions taking part in the pilot.