AI Security Wiki
GitHub

Home / Brazil AI Compliance / Brazil: Role Guide

Brazil: Role Guide

Verification required. Claims on this page about Brazilian law were compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read, and each claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.

Use the Brazil AI Regulatory Hub for instrument detail, and the templates in this section.

AI practitioners

For engineers, data scientists and security staff.

  • Keep a review route for decisions based on automated processing (BR-T1).
  • Record data lineage so that LGPD rights can be met.
  • Keep your design flexible enough to take on tiered duties if the bill passes.

Product companies

For vendors, SaaS providers and platforms.

  • Do not claim compliance with a law that is not in force.
  • Prepare LGPD documentation for Brazilian customers.
  • Watch the Chamber for changes to the risk tiers.

Auditors

For internal, external and assurance auditors.

  • Use the LGPD and sector rules as criteria. The bill is a reference only.
  • Test how requests to review automated decisions are handled.

Implementors

For programme leads, GRC teams, CISOs and DPOs.

  • Map systems to their likely tiers now (BR-T2).
  • Assign an owner for the watchlist.
  • Align the data protection programme with ANPD guidance.

Shared evidence list

  • LGPD records
  • Review route logs
  • Tier mapping
  • Watchlist

Report limitation sentence for auditors

"Criteria were taken from a regulatory register dated 7 October 2026, compiled from secondary sources and not verified against primary legal text. This report is not a legal opinion."