Quick Answer:
Brazil has no national AI law yet, so regulators are acting sector by sector: medicine, telecommunications and capital markets already have AI rules, and the data protection agency runs a testing sandbox. For your business, the safe move is simple: disclose AI generated content and chats, protect customer data, and keep a human reviewing every claim.
Key Takeaways:
- National bill still pending: according to TozziniFreire, bill PL 2.338/2023 passed the Brazilian Senate unanimously on December 10, 2024 and waits in the Chamber of Deputies with no voting forecast.
- Medicine has a rule: Resolution CFM 2.454/2026 treats AI strictly as a support tool, with the physician always making the final decision, and was scheduled to take effect on August 26, 2026, as reported.
- Regulators are testing: the ANPD sandbox has three participating companies and runs until December 2026, with a first monitoring report published on July 2, 2026.
- Other sectors moved too: Anatel Resolution 777/2025 lists eight AI principles including transparency and privacy, and CVM Resolution 246 of July 30, 2026 created a financial technology division.
- MerchandisePROS analysis: the common thread is transparency, data protection and human accountability, three habits any owner can adopt this week.
Whether you run a business in Houston, Miami, Monterrey or Bogotá, you are probably already using AI to write posts, answer chats or build ads. Brazil offers a preview of how rules for that kind of use may arrive: not as one big law, but one sector at a time. This article reports what two Brazilian sources confirm, then gives practical guidance you can apply anywhere.
What Brazil Has Decided, and What It Has Not
The national framework is still open. According to the law firm TozziniFreire, bill PL 2.338/2023 was approved unanimously by the Federal Senate on December 10, 2024. In the Chamber of Deputies it has waited for months for the rapporteur's opinion in a Special Committee, with no voting forecast, and the firm notes that the expected schedule was postponed repeatedly.
While the bill waits, sector regulators are filling the gap. The same source reports that the Federal Council of Medicine issued Resolution CFM 2.454/2026 on February 11, 2026, scheduled to enter into force on August 26, 2026. It frames AI strictly as a support tool, always leaving the final decision to the physician, and prohibits AI systems from communicating diagnoses, prognoses or treatment decisions directly to patients.
Telecommunications and finance moved as well. Anatel published Resolution 777/2025 on April 30, 2025, with eight mandatory AI principles: reliability, fairness, non discrimination, plurality, privacy, democratic values, sustainability and transparency. The securities regulator CVM issued Resolution 246 on July 30, 2026, creating a Financial Technology Division.
The national data protection agency, ANPD, runs a regulatory sandbox for AI. According to the same source, it operates until December 2026 with three companies: Metatext, Synapse AI and Prevvine Tecnologia. A second report from Atualidade Política says the first monitoring report came out on July 2, 2026 and that the first cycle was spent structuring the tests, still without a full evaluation.
What the Pattern Means for a Small Business
MerchandisePROS analysis: none of these rules were written for a bakery, a dental clinic or an online store, and none of them automatically applies to you if you operate outside Brazil. What matters is the direction. Regulators are not banning AI. They are asking for three things over and over: say when AI is involved, protect the data people give you, and keep a responsible human in charge.
The medical rule is the clearest example. The machine can help, but a person signs off and a person talks to the patient. The same logic fits marketing: AI can draft your ad, your post or your chat reply, but someone on your team should own what is published in your name.
Four Steps to Take This Week
This is MerchandisePROS analysis, conservative on purpose, and useful whether your customers are in Texas, Florida, Mexico or Colombia:
- Be transparent: add a short note when a chat assistant is automated and when an image or text was generated by AI.
- Protect customer data: do not paste customer lists, health details, payment data or private messages into AI tools until you know how each tool stores and uses them.
- Keep a human reviewing claims: prices, results, guarantees, testimonials and medical or financial promises should be checked by a person before an ad goes live.
- Write it down: keep a one page list of which AI tools you use, for what, and who reviews the output.
If you want to see how visible and consistent your business already looks online, our free audit is a good first step, and our digital marketing and AI visibility services explain how we help afterwards.
Note: this article is general information based on the two sources linked above, not legal advice. Rules differ by country, state and industry, so confirm your obligations with a qualified professional.
"Use AI to work faster, but never to hide who is responsible. If your name is on the ad, a person on your team should have read every word before it went out."
Diego Medina F., Founder of MerchandisePROS
Frequently Asked Questions
Does Brazil have a national AI law today?
Not yet. According to TozziniFreire, bill PL 2.338/2023 passed the Brazilian Senate unanimously on December 10, 2024 and still waits in the Chamber of Deputies, with no voting forecast. In the meantime, regulators are issuing sector rules.
Do Brazil's AI rules apply to my business in the US or LATAM?
The rules reported in the sources apply inside Brazil and to specific sectors such as medicine, telecommunications and capital markets. They do not automatically apply to you elsewhere. They are a useful signal of where rules are heading, and this is general information, not legal advice.
Should I tell customers when content or chat is generated by AI?
MerchandisePROS analysis: yes, it is a low cost habit that builds trust and prepares you for transparency rules, which were one of the principles Anatel listed in Brazil. Check the rules that apply in your country and industry with a qualified professional.
What should I avoid putting into AI tools?
MerchandisePROS analysis: avoid pasting customer lists, phone numbers, health details, payment data or private messages into any AI tool unless you have confirmed how that tool stores and uses the data.
How we do it at MerchandisePROS:
Diego Medina F. reviews every audit and deliverable personally before it reaches a client, so the system does the heavy lifting and a human stays accountable for the result. See what makes us different.