After nearly three years in committee, Brazil's Marco Legal da Inteligência Artificial (PL 2338/2023) is finally heading to the floor of the Chamber of Deputies. Rapporteur Deputy Aguinaldo Ribeiro (PP-PB) presented his substitute text on May 19, 2026, and Speaker Hugo Motta scheduled the plenary vote for May 27. If passed in the form circulating this week, Brazil becomes the largest emerging-market jurisdiction to enact an EU-style, risk-based AI statute — months before the European AI Act's own general-purpose AI obligations have fully bedded in.
The substitute keeps the architecture the Senate approved on December 10, 2024 under Senator Eduardo Gomes's (PL/TO) draft. AI systems are sorted into three tiers: excessive risk (prohibited outright), high risk (subject to algorithmic impact assessments, qualified technical responsibility, and registration), and low or moderate risk (light-touch transparency obligations). Penalties stretch to BRL 50 million per violation, or 2% of group turnover in Brazil — whichever is greater. Layered on top is the Sistema Nacional de Inteligência Artificial (SIA), with the Conselho Brasileiro para Inteligência Artificial (CBIA) at the apex and sector regulators (Anatel for telecom, health authorities for medical AI) handling vertical rules. The ANPD — Brazil's data-protection authority — is designated residual regulator wherever no sector authority has jurisdiction.
The Case for Mirroring Europe
The strongest argument for this framework is one Brazilian critics rarely engage seriously: legal certainty and interoperability. By aligning with the EU AI Act's basic taxonomy, Brazilian firms exporting AI products to Europe can build to a single compliance baseline. Brazilian regulators can draw on a growing body of European guidance, conformity-assessment methodologies, and case law rather than inventing standards from scratch. For high-stakes applications — biometric identification, credit scoring affecting low-income borrowers, AI in public services — there is a real argument that affected Brazilians deserve the same rights to explanation, contestation, and human review that European citizens won under the AI Act. Doing nothing is not the alternative; sectoral patches under the LGPD, the Consumer Code, and the Penal Code already create overlapping liability without coherent oversight.
The Implementation Problem Brazil Is About to Inherit
That said, Europe's own experience is a cautionary tale, not a template. The AI Act entered into force in August 2024 and is still being phased in. Brussels has spent the past eighteen months drafting codes of practice for general-purpose models, fielding industry pushback on training-data transparency, and explaining why startups and small firms find conformity assessments intimidating. Brazil is importing this architecture before its European progenitor has settled into a stable equilibrium — and with a small fraction of the European Commission's AI Office resources. The ANPD is being assigned residual jurisdiction across every sector lacking a specialised regulator. That is a recipe for either under-enforcement that breeds cynicism or selective enforcement that lands on the most visible (often domestic) targets.
The risk classification itself imports a flaw the EU has yet to resolve: the "high-risk" list is wide and definitional. Recruitment tools, credit scoring, education assessment, and law-enforcement risk profiling all fall in. A Brazilian fintech using off-the-shelf models for credit decisions will face algorithmic impact assessments, qualified technical responsibility, and registration before going to market. Large incumbents can absorb that overhead. Early-stage startups — exactly the kind São Paulo and Belo Horizonte need to compete with Mexican, Argentine, and Indian peers — often cannot.
The Copyright Skirmish
One late-stage fight illustrates the tension. On May 15, 2026, a coalition of 67 culture and rights-management organisations — including ABRA and API — wrote to Ribeiro warning that his substitute reportedly drops the Senate's entire chapter on copyright and AI training. Their objection is understandable: the Senate text gave authors an opt-out and remuneration rights when their works trained commercial models. Removing the chapter would tilt the playing field toward AI developers, including foreign ones. But the Senate's chapter, as drafted, was also a barrier to research use and to homegrown model-builders who cannot negotiate global rights clearances at scale. A narrower text-and-data-mining exception that preserves opt-outs for commercial uses while protecting non-commercial research would serve creators and innovators better than either extreme. That nuance is hard to negotiate on the floor in a week.
A Proportionate Path
Brazil's interests would be better served by a slimmer first statute: ban genuinely excessive uses (social-scoring systems, untargeted facial-recognition databases), require transparency and human-review rights for AI used in government decisions affecting citizens, and let sectoral regulators — Banco Central, Anatel, ANVISA — write the detailed rules for their domains, where they actually have the capacity and context. The SIA's coordinating council makes sense; the all-encompassing residual jurisdiction for the ANPD does not.
The May 27 vote is unlikely to be the last word. Amendments will fly on the floor, and the substitute would then return to the Senate for harmonisation. Deputies who care about Brazilian competitiveness should use the floor to narrow the high-risk list, calibrate penalties so first-time and small-firm offenders are not treated like recidivist multinationals, and give the EU time to finish testing the architecture before Brazil bolts it permanently onto its own economy.