In December 2024, Brazil's Federal Senate approved PL 2338/2023, the country's most ambitious attempt yet to construct a horizontal legal framework for artificial intelligence. The text, championed by Senator Eduardo Gomes and modeled in part on the EU AI Act, classifies a series of applications as "high-risk" — including autonomous vehicles (AVs). Eighteen months later, the Chamber of Deputies is still working through amendments, with the Comissão Especial established in 2025 weighing changes that could materially reshape how connected and autonomous mobility systems collect, store, and share data in Brazil.
For an industry that depends on vast streams of sensor, location, and behavioral data to function, the stakes are significant. Brazil is Latin America's largest automotive market and a key proving ground for the global mobility sector. How Brasília calibrates the interaction between PL 2338, the Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018), and existing sectoral rules will shape whether Brazil becomes an AV testbed or a jurisdiction that companies route around.
What PL 2338 Actually Does to AVs
The Senate-approved text imposes a tiered risk framework. AI systems deemed "high-risk" — a category that explicitly includes autonomous vehicle control systems — must comply with obligations layered on top of LGPD: algorithmic impact assessments (AIAs), documentation of training data provenance, human oversight mechanisms, technical robustness testing, and ongoing transparency reporting to a designated competent authority. The bill establishes a Sistema Nacional de Regulação e Governança de IA (SIA), with the Autoridade Nacional de Proteção de Dados (ANPD) likely playing a coordinating role given its existing data-governance remit.
For AV operators, this means three concrete shifts. First, data minimization and purpose-limitation rules under LGPD now intersect with AI-specific documentation duties: every dataset used to train perception or planning models must be traceable. Second, AIAs must be conducted before deployment and updated when the system materially changes — a non-trivial requirement for fleets running continuous over-the-air updates. Third, affected individuals gain rights to explanation about automated decisions that produce "relevant effects" — language broad enough that a pedestrian struck by an AV, or a driver whose insurance premium rises after telematics review, could in principle demand reasoning.
The Proportionality Question
The instinct behind PL 2338 is defensible. AVs sit at the intersection of safety-critical decision-making and large-scale personal data processing — a combination that warrants careful regulatory attention. But the bill, as it stands, risks two design errors that the Chamber of Deputies should fix before it heads to President Lula's desk.
The first is regulatory duplication. Brazil's vehicle safety regime already runs through CONTRAN (the National Traffic Council) and DENATRAN, with type-approval and homologation processes that have been adapting to advanced driver-assistance systems for years. LGPD, in force since 2020, already governs personal data — including the geolocation and biometric streams AVs generate. Bolting an additional AI-specific compliance layer on top, without explicit pre-emption or coordination mechanisms, creates a three-headed regulator problem: ANPD on data, CONTRAN on safety, the new SIA on algorithmic governance. Operators in São Paulo's pilot zones have already flagged concerns to ANPD about overlapping reporting duties.
The second is the breadth of the "high-risk" label itself. Lumping all AV systems together — from low-speed campus shuttles to highway-grade Level 4 robotaxis — applies the same impact-assessment burden to deployments with vastly different risk profiles. The European AI Act, which Brazil's bill borrows from, at least nods to use-case calibration. PL 2338 should follow suit.
What Sensible Amendments Look Like
Several proposals circulating in the Chamber would meaningfully improve the bill without gutting its protective intent:
- Regulatory sandbox carve-outs: Article 36 of the Senate text gestures at experimental environments, but the language is thin. Deputies should mandate that ANPD and the SIA jointly stand up an AV-specific sandbox, with streamlined AIA templates and clear data-sharing rules between fleet operators and authorities.
- Recognition of equivalence: Manufacturers that have already cleared UN-ECE WP.29 cybersecurity (R155) and software-update (R156) regulations, or ISO/SAE 21434, should receive presumption of conformity for overlapping PL 2338 obligations. This is how the EU has historically reduced duplicative testing burden.
- Tiered impact assessments: AIAs should scale with deployment scope and automation level — a pilot of five vehicles in a geofenced corridor should not face the same documentation load as a national rollout.
- Clear data-sharing protocols for safety: Anonymized crash and near-miss data should flow to a public-interest repository, as NHTSA's Standing General Order requires in the US. This serves both safety and public trust without exposing proprietary stacks.
Why This Matters Beyond Brazil
Brazil's choices will ripple. Mercosur partners — Argentina, Uruguay, Paraguay — typically harmonize toward Brazilian standards. Mexico's own AI bill, still in early committee, is watching closely. And global AV operators making capex decisions for the late-2020s will weigh Brazil's framework against Singapore's lighter-touch regime and the EU's more prescriptive one.
The pro-innovation case is not anti-regulation. AVs that crash or surveil opaquely will lose public legitimacy faster than any compliance burden could slow them. But the goal of PL 2338 should be to make Brazil's AV ecosystem trustworthy and competitive — not to construct a paperwork moat that only the largest incumbents can clear. The Chamber of Deputies has the opportunity, in the months ahead, to land that balance.