Brazil LGPD and AI: What to Review Before 2027 Enforcement

In Brazil, artificial intelligence that uses personal data is already regulated, even though the country has no AI law yet. It is regulated by the LGPD (Brazil's General Data Protection Law), which is also the legal basis for the powers of the ANPD (the National Data Protection Authority). The ANPD has made AI one of its four priorities and plans 20 AI enforcement actions for 2027.

This guide explains what the ANPD will examine, what the 2024 Meta precedent taught, what the Authority expects from generative AI systems, and what your company should be able to show if it is inspected. It is useful for Brazilian companies and for groups from other Latin American countries that operate in Brazil.

The AI law can wait; the LGPD cannot

Brazil's AI Legal Framework, Bill 2338/2023 (PL 2338), was approved by the Senate on December 10, 2024. As of late October 2026, the official processing record of the Chamber of Deputies showed it in the Special Committee, awaiting the rapporteur's opinion.

The dates have slipped several times. According to a tracker published in October 2026, the votes scheduled for May 19 and May 27, 2026 did not take place, and in August of that year the rapporteur, Aguinaldo Ribeiro, had postponed the vote until after the October 2026 elections. So far, the legislative calendar has offered neither a reliable date nor a final text.

Meanwhile, AI that processes personal data is already subject to the LGPD. According to a specialized analysis, the ANPD's Map of Priority Topics creates no new obligations: it shows where enforcement of what the law already requires will concentrate. For the board, AI regulatory risk in Brazil already exists and already has an enforcer.

For a Chilean, Colombian, Mexican or Peruvian group with business in Brazil, the relevant question is not what the AI rules of its home country say. It is what its systems do with data about people in Brazil. Ask your local legal counsel to confirm the reach of the LGPD over your operations.

What the ANPD will examine in 2026 and 2027

Resolution CD/ANPD 30/2025, issued by the Authority's Board of Directors, was published on December 24, 2025 and approved the Map of Priority Topics for 2026-2027. It has four pillars: data subject rights, children and adolescents in the digital environment, data processing by the public sector, and AI and emerging technologies. The news was also reported in English as the setting of the Authority's enforcement priorities.

Under the AI pillar, the Map foresees 20 enforcement actions for 2027 on the processing of personal data, including children's data. The same day, Resolution 31/2025 updated the 2025-2026 Regulatory Agenda.

According to the analysis by the law firm Martinelli, the Authority gives priority to biometric, financial and health data. That reading is the basis for the industry table below.

The children's pillar adds another layer of exposure. The ECA Digital, the digital-environment version of the Child and Adolescent Statute (ECA, in Portuguese), had an expected entry into force of March 17, 2026. Any AI system that recommends content, recognizes faces or verifies the age of minors is more exposed.

The table below maps those priorities to industries. It is GAITECX's reading, not an official ANPD list.

Industry	Most exposed AI uses	Priority that applies
Banking, insurance and fintech	Credit scoring, fraud prevention, virtual assistants	Financial data and AI
Healthcare	Diagnostic support, triage, analysis of medical records	Health data and AI
Retail and private security	Facial recognition, video analytics, personalization	Biometrics and AI
Telecommunications, media, education and gaming	Content recommendation, age verification	Children and adolescents and AI
Government and its suppliers	Automated citizen services, database cross-referencing	Public sector and AI

The Meta precedent: suspension within days and a daily fine

The case that best sizes the risk took place in 2024. On July 2 of that year, the ANPD opened an ex officio inspection and imposed a precautionary suspension of Meta's privacy policy that allowed generative AI to be trained on user data. The central reason, according to the Authority: the company had not adequately informed data subjects about the consequences of the processing.

The measure also covered people who were not users of the platforms. It set a deadline of five business days to demonstrate the suspension and a daily fine of R$ 50,000 for non-compliance.

The ANPD rejected the request for reconsideration and, in parallel, Cade, the competition authority, opened its own proceeding on the use of data to train AI. The Authority lifted the measure on August 30, 2024, after approving a compliance plan with transparency measures toward users. The inspection remained open and under monitoring.

Four lessons for your company

The trigger was transparency, not a leak. No security incident was needed to halt the processing.
The perimeter includes non-customers. If your models use third-party data, such as contacts, images or public information, that data counts too.
More than one regulator can act. Data protection and competition authorities acted on the same facts, with different teams and timelines.
The way out was documentary. The activity resumed with an approved compliance plan. The ANPD did not ban AI training: it required that it be done with clear information to data subjects.

Balance matters. The case shows that the ANPD can act fast, but also that it accepts solutions when a company demonstrates transparency. The cost to the business was not only the potential fine: according to the dates cited, the feature was suspended in Brazil for about two months, between July and August 2024.

What the ANPD expects from generative AI systems

Beyond enforcement, the ANPD publishes studies that reveal its technical thinking. The Technology Radar on generative AI, a preliminary study from November 2024, proposes anonymizing data and collecting only what is necessary to train models. The Authority published an English version of the study, useful for foreign headquarters and vendors.

The study also warns that the risk does not end with initial training: it persists in model refinement (fine-tuning) and in later developments. It also flags synthetic content that may include data about real people. This affects any company that fine-tunes a third-party model with its customers' data.

Technology Radar No. 6, dedicated to deepfakes, maps risks and good practices, and highlights human oversight and explainable AI. For the CISO (chief information security officer), deepfakes are both a privacy problem and a fraud vector against customers and executives.

These studies do not replace the law, but they anticipate an inspector's questions:

What personal data went into the training or fine-tuning of the model, and why was it necessary?
Was it anonymized or minimized before use?
Who reviews the system's outputs that affect people?
How is a system decision explained to a data subject who challenges it?

The ANPD will gain more power as AI regulation arrives

The enforcer has also changed. Provisional Measure 1,317/2025, of September 17, 2025, turned the ANPD into Brazil's twelfth regulatory agency, under the regime of Law 13,848/2019. The Senate approved the measure on February 24, 2026: the institution is renamed the National Data Protection Agency, with 200 new regulation specialist positions and an audit body. Agência Brasil also reported the approval.

The ANPD will have more specialized staff just as the AI actions scheduled for 2027 begin. More technical capacity allows inspections that are more numerous and deeper.

Its role could grow further. In December 2025, the Government proposed a bill to create an AI governance system, the SIA. According to Security Leaders, the proposal reached Congress through a presidential message (Message 1,845), attached to PL 2338. It places the ANPD as the residual regulator for sectors without their own authority and creates a Brazilian AI Council (CBIA).

The law firm Baptista Luz explains that the SIA organizes institutions without imposing substantive rules, and that the ANPD would issue binding general standards. The bill also creates obligations for public bodies that use high-risk AI, which matters for the companies that serve them.

CGI.br (the Brazilian Internet Steering Committee) supports having the ANPD coordinate AI regulation and calls for risk classification, transparency and explainability. Until Congress approves these proposals, they are not law. Even so, the relationship your company builds with the ANPD is likely to be the one it will have with the future AI regulator.

Checklist: what your company should be able to show

The useful question for the next committee meeting is simple: "If the ANPD inspects us in 2027, which documents do we show?" Use this table to answer it with evidence, not intentions.

The suggested owners are the CEO, the CIO (chief information officer), the DPO (data protection officer), the CDO (chief data officer), the COO (chief operating officer), the CMO (chief marketing officer) and the CISO, plus the legal and procurement teams.

Board question	Evidence that should exist	Suggested owner
Do we know which AI systems use personal data?	Inventory with flagged categories: biometrics, health, financial data and minors	CIO and DPO
Do our privacy notices explain the use of data for AI?	Updated notices, version history and coverage of non-customers	DPO and Legal
Do we minimize and anonymize training and fine-tuning data?	Minimization policy and a record of the tests performed	CDO and DPO
Do we know what our AI vendors do with our data?	Clauses on use for training, fine-tuning and data location	Procurement and CISO
Can we suspend a processing activity within five business days without halting operations?	Continuity plan and estimated daily cost of the suspension	COO and CIO
Is there human oversight and deepfake controls?	Human review procedures and identity verification procedures	CISO and CMO
Does the board receive regular reporting on AI risk?	Quarterly report with inventory, incidents and regulatory status	CEO and risk committee

If any row has no evidence, that is your priority.

What to do in the next 90 days

Week 1: appoint a single owner (CEO). Name one person who answers to the board for AI regulatory risk, with a mandate to coordinate technology, data, legal and security.
Days 1 to 45: complete the inventory (CIO and DPO). List the in-house and third-party AI systems that use personal data. Flag those that process biometrics, health data, financial data or minors' data, the priorities identified for the ANPD.
Days 15 to 60: review transparency (DPO and Legal). Verify that privacy notices clearly explain the use of data to train or fine-tune models. Check whether the processing reaches non-customers, as happened in the Meta case.
Days 30 to 60: demand answers from vendors (Procurement and CISO). Ask in writing whether your data is used to train models, whether they apply anonymization and minimization, and what happens to data used in fine-tuning. Carry the answers into your contracts.
Days 30 to 75: assess the impact of the riskiest systems (DPO and CDO). Document a data protection impact assessment for the uses flagged in the inventory. Ask your legal counsel to confirm in which cases it is mandatory.
Days 45 to 75: control synthetic content (CISO and CMO). Define human oversight for AI-generated content and a verification protocol for deepfakes that impersonate executives or the brand.
Days 60 to 90: simulate a preventive measure (COO and CIO). Choose one critical system and test whether you can suspend the processing and prove it within five business days. Estimate what each day of suspension would cost.
Day 90: report to the board (CEO and risk committee). Present the inventory, the gaps and the plan. Include the status of PL 2338 and the SIA, with a named owner to follow them.

Frequently asked questions

Should I wait for PL 2338 to be approved before acting? No. The vote in the Chamber was postponed several times during 2026, while the LGPD already applies to AI that uses personal data. The AI enforcement planned for 2027 rests on obligations already in force.

Does the Map of Priority Topics create new obligations? No. According to this analysis, the Map shows where enforcement of what the LGPD already requires will concentrate. Its value for the board is that it anticipates where the ANPD will look.

What can the ANPD do if it detects a problem in an AI system? In the 2024 Meta case it ordered a precautionary suspension with a five-business-day deadline and a daily fine of R$ 50,000. The measure was lifted after an approved compliance plan, which shows that documentation determines the way out.

My company is not Brazilian. Does this affect me? If you process data about people in Brazil, probably yes, but confirm it with local legal counsel. Also review your AI vendors, because the risk of their models carries over into your operation.

The GAITECX view

At GAITECX, we see that AI risk in Brazil is no longer a legislative debate but an operational one: the ANPD has priorities, deadlines and precedents. Companies that reach 2027 with their AI inventory and privacy notices up to date will turn an inspection into a formality rather than a suspension. That is why this topic is part of our Strategic Cybersecurity track, where the region’s CISOs, DPOs and data leaders compare how they are preparing.