Preparing for the Brazil AI Bill (PL 2338/2023)

Classify the system's risk before placing it on the market or using it. Optional for most agents but mitigates sanctions (Art. 50 §1); mandatory for developers of general-purpose and generative AI (Art. 29).

No development, implementation or use of an excessive-risk system; developers take measures to prevent such uses (Art. 13 §1).

Everyone has the right to prior information that they are interacting with an AI system, through standard icons where relevant, in plain language for vulnerable groups (Art. 5 §§1 and 2).

Synthetic content generated or modified by the system carries an identifier that allows its authenticity or origin to be verified.

Measures to prevent, mitigate and correct discriminatory bias, including on the data used (Art. 18 I.e and II.e).

A person affected by a high-risk system may obtain, free of charge and in plain language, an explanation of the decision, recommendation or prediction made about them.

Affected persons may contest decisions and request human review; the procedures to exercise these rights are published.

Human oversight allowing people to understand, interpret, decide on and intervene in the system; the degree of human oversight in the results is documented.

The applier documents the system across its lifecycle, the reliability and safety tests performed, and the information that makes results interpretable.

The developer keeps a record of its governance measures to inform the applier, and implements explainability measures.

The system automatically logs its operation so that its accuracy and robustness can be assessed.

Tests to assess appropriate levels of security, including of the environment the system runs in.

The applier monitors the system's outputs for accuracy, robustness and discrimination, and mitigates what it finds.

An algorithmic impact assessment before placing on the market, kept up to date across the lifecycle. It may be carried out together with the LGPD data protection impact report (Art. 27), and its conclusions are published (Art. 28).

A serious risk discovered after release is reported immediately to the authority and the value chain, and serious incidents are reported to the sector authority.

Agents cooperate and share the information the others need to meet their obligations; a distributor checks the governance measures before placing on the market (Art. 16 §3).

The developer documents development. With systemic risk, before release: model description, test documentation, residual risks, lawful data governance, energy efficiency and downstream documentation (Art. 30 I to VII).

A summary of the copyright-protected content used in development is published, and rights holders' opt-out is honoured.

Public bodies and operators of a public service using a high-risk system keep usage logs (who, which case, which purpose) and publish their preliminary assessments.

Rights holders whose content was used for training are remunerated. This chapter may be removed by the Chamber of Deputies.