A hearing that revealed the real fight
On June 9, 2026, the Brazilian Senate's Science, Technology, Innovation and Computing Committee (CCT) held a public hearing on PL 3018/2024, a bill from Senator Styvenson Valentim (Podemos-RN) that would regulate AI data centers — covering energy efficiency, environmental sustainability, cybersecurity audits, and mandatory "counterparts" (contrapartidas) from firms receiving public incentives (Senado Notícias). Inácio Calache Cozendey of the National Confederation of Industry (CNI) put the operators' case bluntly: "The datacenter investment is massive, so the operator wants guarantees." Hamilton José Mendes da Silva of the Ministry of Science, Technology and Innovation pushed the other direction, arguing for mandatory transparency on water and energy consumption. Senator Vanderlan Cardoso proposed steering new facilities toward the Northeast, where wind and solar surpluses already exist. The bill remains in committee, with more hearings expected before a rapporteur's report (PL 3018/2024, Senado Federal).
The steelman for regulating first
The case for CCT's approach is not frivolous. Data centers are genuinely resource-intensive, and Brazil's grid is being asked to absorb a lot, fast: the National Electric System Operator (ONS) reports 18 of 22 signed data-center grid-connection requests already authorized, with projected average data-center load jumping from 304 MW in 2026 to 3,457 MW by 2030 — an elevenfold increase in four years, per the joint ONS/CCEE/EPE Q1 2026 load forecast (Canal Solar). Without disclosure rules, regulators and communities have no way to verify operators' claims about water use or renewable sourcing before facilities are built and locked in for decades. Cybersecurity audit requirements are similarly defensible: AI training and inference infrastructure increasingly underpins critical economic activity, and Brazil has no obligation to take vendors' security assurances on faith. None of this is regulatory overreach in principle — it's the kind of disclosure and audit regime most mature digital economies already impose on critical infrastructure.
Where the bill risks tipping into obstruction
The problem is not the existence of rules but their design. "Counterparts" — requiring firms to deliver unspecified economic or technological benefits in exchange for incentives — is the kind of open-ended obligation that produces exactly the legal uncertainty Cozendey warned about. Investors weighing a data center in Brazil versus Chile, the UAE, or the United States need to know their compliance cost at the time they sign a contract, not after a committee negotiates bespoke concessions later. A cybersecurity audit regime that is vague about scope, cadence, or who certifies compliance will function less as a security safeguard than as a discretionary veto point. If PL 3018/2024 emerges from committee with precise, predictable, proportionate standards — not case-by-case bargaining — it can coexist with, rather than choke, the investment the CCT witnesses say Brazil needs.
Redata: the incentive side is where the real damage is happening
The more consequential story this year isn't the regulatory bill — it's the fiscal one sitting next to it. The Chamber of Deputies approved PL 278/2026 on February 24, 2026, creating Redata, a special tax regime suspending import duties, PIS/Cofins and IPI on data-center equipment for five years, converting to permanent exemption on delivery. In exchange, beneficiaries must source 100% renewable electricity, hold water efficiency at or below 0.05 liters per kWh, reserve at least 10% of processing capacity for the domestic market (8% in the North, Northeast and Center-West), and invest 2% of equipment costs in local R&D. The government estimates the regime will forgo R$5.2 billion in revenue in 2026 alone, then roughly R$1 billion annually through 2028 (Câmara dos Deputados).
Redata has been stalled in the Senate since late February, with no rapporteur assigned. Senate President Davi Alcolumbre has declined to schedule a floor vote amid a dispute over whether fossil gas, nuclear power and small modular reactors should count as eligible energy sources alongside hydro, wind and solar — and the underlying provisional measure it replaced has already expired, complicating the fiscal mechanics of reviving it (ClimaInfo).
A regulatory bill with no incentive counterpart just adds cost. An incentive bill with no path to a vote adds nothing at all.
The proportionate path
Regulators are right to want visibility into water and energy use, and right to expect real security audits from operators who will anchor Brazil's AI economy for a generation. But sequencing matters. Brazil is trying to pass a compliance-heavy regulatory bill at the exact moment its complementary tax incentive — the thing that would make compliance worth the cost — is paralyzed by an unrelated energy-source dispute. If the Senate wants investment to land in Brazil rather than in competing jurisdictions already courting the same capital, CCT should keep PL 3018/2024's disclosure and audit provisions tight and predictable, and Senate leadership should stop letting Redata's fate hinge on a fossil-gas fight that has nothing to do with data centers' actual environmental footprint.