AI vendors based in Brazil
AI vendors based in Brazil. Subject to the Lei Geral de Proteção de Dados (LGPD) and a developing AI regulatory regime modeled in part on the EU AI Act.
Brazil-based AI vendors operate under the Lei Geral de Proteção de Dados Pessoais (LGPD, Law 13,709/2018), in force since August 2020 and enforceable for fines since August 2021. The Autoridade Nacional de Proteção de Dados (ANPD) is the enforcement authority. LGPD borrows heavily from GDPR (ten legal bases, DPO, DPIA, data subject rights, 2% revenue cap on fines). Brazil does not currently hold EU adequacy; cross-border transfers rely on ANPD-published model SCCs (2023) or specific consent. The Brazilian Senate passed an AI bill in 2023 (PL 2338/2023) modeled on the EU AI Act with a risk-tiered approach; final adoption is still in progress as of 2026.
Buyer considerations
- No EU adequacy decision — EU buyers need SCCs or alternative transfer mechanisms.
- ANPD enforcement has been escalating; multiple seven-figure fines issued since 2023.
- Largest single market in Latin America with a large Portuguese-speaking population.
- Pending AI Act adopts risk-tiered approach similar to EU; high-risk AI systems face stricter obligations.
- Mandatory DPO appointment for processors of personal data; specific RIPD (DPIA equivalent) requirements.