-
What are your countries legal definitions of “artificial intelligence”?
Currently there is no legal definition of “artificial intelligence” in Brazil.
Brazilian Strategy for Artificial Intelligence (see question 2 below) expressly acknowledges that there is no consensus for a definition of “artificial intelligence” and states that it is better understood as a set of techniques aimed at emulating aspects of the human beings cognition using machines. The Strategy follows the definition proposed by OECD for AI system:
“AI system: An AI system is a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. AI systems are designed to operate with varying levels of autonomy.”
Resolution No. 332/2020 of the National Council of Justice, which regulates the ethics, transparency and governance in the production and use of artificial intelligence by the Judiciary Branch in Brazil, defines “artificial intelligence model”, but said definition is limited to the purposes of the resolution:
“Artificial Intelligence Model: the set of data and computer algorithms, conceived from mathematical models, which objective is to offer intelligent results, associated with or comparable to certain aspects of the human thought, knowledge or activity.”
Bill of Law No. 2338/2023, currently being analyzed by the Brazilian Senate, contains the following definition of “artificial intelligence system”:
“Artificial Intelligence System: computational system, with different degrees of autonomy, designed to infer how to achieve a given set of objectives, using machine learning and/or logic and knowledge representation-based approaches, through input of data from machines or humans, with the objective of producing predictions, recommendations or decisions that may influence the virtual or real environment.”
-
Has your country developed a national strategy for artificial intelligence?
Yes. Brazilian Strategy for Artificial Intelligence was published by the Ministry of Science, Technology and Innovation (MCTI), under Ordinance MCTI No. 4617/2021, as amended by Ordinance No. 4979/2021. The Strategy aims at guiding the Federal government’s initiatives regarding AI in different areas.
The objectives of the Brazilian Strategy for Artificial Intelligence are: (i) contribute to set ethical principles for the responsible development and use of AI; (ii) promote sustainable investments in research and development of AI; (iii) remove barrier to innovation in AI; (iv) capacitate professionals for the AI ecosystem; (v) stimulate innovation and AI development in Brazil for the global market; and (vi) promote a cooperation environment between the public and private sectors, industries and research centers for the development of AI.
Based on the analysis conducted by Ministry, it organized the Strategy based on nine topics, named thematic axes, divided into two groups, as follows:
- Transverse Axes:
1.1. Legislation, regulation and ethical use
1.2. AI governance
1.3. International aspects - Vertical Axes:
2.1. Education
2.2. Workforce and training
2.3. Research, development, innovation and entrepreneurship
2.4. Application in the productive sectors
2.5. Application by the public sector
2.6. Public safety.
Also, Bill of Law No. 2338/2023 sets forth in its article 32 that the Federal government will appoint a supervisory authority responsible for AI and for the enforcement of the law, and one of the responsibilities of such authority is to draft, update and implement the Brazilian Strategy of Artificial Intelligence together with other authorities with related responsibilities and competences.
- Transverse Axes:
-
Has your country implemented rules or guidelines (including voluntary standards and ethical principles) on artificial intelligence? If so, please provide a brief overview of said rules or guidelines. If no rules on artificial intelligence are in force in your jurisdiction, please (i) provide a short overview of the existing laws that potentially could be applied to artificial intelligence and the use of artificial intelligence, (ii) briefly outline the main difficulties in interpreting such existing laws to suit the peculiarities of artificial intelligence, and (iii) summarize any draft laws, or legislative initiatives, on artificial intelligence.
Brazil has not yet implemented rules or guidelines on artificial intelligence.
In the absence of specific laws regulations, there are several laws that could be applied to artificial intelligence and the use of artificial intelligence in Brazil, such as the General Data Protection Law (Law No. 13709/2018), the Internet Legal Framework (Law No. 12965/2014), the Software Law (Law No. 9609/1998), the Civil Code (Law No. 10406/2002), the Consumer Defense Code (Law No. 8078/1990), the Copyright Law (Law No. 9610/1998) and the Industrial Property Law (Law No. 9279/1996). Such laws were not drafted having artificial intelligence in mind, and although certain provisions of such laws can be applied by analogy, they do not cover all aspects that the Bill of Law No. 2338/2023 intends to regulate, which is not unusual for new technologies. Given the fast pace of AI developments, there is debate as to how to better regulate and whether specific regulation may not become outdated quickly.
Bill of Law No. 2338/2023 is the most comprehensive proposed legislation in Brazil on artificial intelligence. It is currently under analysis before the Senate. This Bill proposes to replace Bill of Law No. 5051/2019, Bill of Law No. 21/2020 and Bill of Law No. 872/2021, that were under analysis by the Legislative Branch since 2019, and was drafted by a commission of jurists after public consultation. The Bill contains similarities to the European Union EU Act4. Said Bill of Law sets forth general rules for the development, implementation and responsible use of AI systems in Brazil. It outlines the principles applicable to AI, rights of individuals affected by AI, it requires a preliminary evaluation of the AI system by the developer or provider for classification of its degree of risk (excessive, high or not high). Different obligations and restrictions apply depending on such classification.
Also, the Bill of Law requires AI agents to establish a governance structure and internal processes to guarantee the security of the systems and the compliance with individual rights, and to provide transparency of such measures, and it stimulates agents to create and adopt codes of best practices and governance programs. AI agents are also require to adopt data management measures to mitigate and prevent potential discriminatory biases and data security measures by design. AI agents that supply or operate high risk AI systems are required to adopt additional governance measures and internal processes, such as the obligation to carry out tests to evaluate the reliability of the system and the adoption of technical measures to enable the explainability of the system. High risk AI systems must have human supervision to prevent or minimize risks to individual rights and freedoms that may arise from the normal use of the system or from the incorrect use of the system that can be reasonable foreseen. For high risk AI systems, Bill of Law No. 2338/2023 also requires an algorithm impact assessment.
Bill of Law No. 2338/2023 establishes that a supervisory authority responsible for AI and for the enforcement of the law will be appointed by the Federal government and creates an obligation for AI agents to notify to the authority serious security incidents in reasonable time. The Bill regulates the civil liability of the supplier or operator of an AI system, and also sets forth administrative penalties that may be applied by the authority in case of infringement of the law. Finally, the Bill establishes that the authority may authorize regulatory sandboxes for innovation in AI.
-
Which rules apply to defective artificial intelligence systems, i.e. artificial intelligence systems that do not provide the safety that the public at large is entitled to expect?
There is no specific rule for AI under laws currently in force, so any defective artificial intelligence system would be subject to the general provisions about defective products and services under Brazilian Civil Code or Brazilian Consumer Defense Code, and to the terms and conditions of the system license.
Generally speaking, according to Brazilian Civil Code, a contracting party may reject a defective good or product or demand the proportionate price reduction within a term of 30 days after delivery in case of apparent defects, or a term of 180 days as of the day on which the defect is evidenced in case of hidden defects. If the agreement sets forth a warranty period, the contractual warranty will suspend the term provided by the Civil Code for buyer to claim against hidden or apparent defects. With regard to consumer relationships, Brazilian Consumer Defense Code sets forth legal warranties that cannot be disclaimed as a matter of public policy. Consumer may claim against apparent or easily verifiable defects of durable products within 90 days as of actual delivery of the product, while for hidden imperfection or defects, said 90-day term for the claim starts when the defect is evidenced. If supplier does not correct the imperfection within at most 30 days, consumer may alternatively demand, at his option: (i) replacement of the product by other of the same kind, in a perfect state of use; (ii) immediate reimbursement of the amount paid, with monetary updating, notwithstanding his/her right to recover any losses and damages; or (iii) proportionate price reduction. The legal warranty is in addition to any contractual warranty.
In addition, Brazilian Software Law sets forth that contractual provisions that exempt either party from liability for any claims brought by third parties as a result of software imperfections, software defects or intellectual property rights infringement shall be void.
Bill of Law No. 2338/2023 does not address specifically defective AI systems, but it sets forth that the development, implementation and use of artificial intelligence systems shall observe the principle of prevention, precaution and mitigation of systemic risks derived from intentional or non-intentional uses or unforeseen effects of artificial intelligence systems. In addition, the Bill of Law also requires any artificial intelligence agent that, after introducing an AI system in the market or using it in service, becomes aware of any unexpected risk to individual’s right to immediately communicate the fact to the competent authority and to the persons affected by the AI system. The Bill also establishes that the civil liability for damages caused by AI systems in consumer relationships remain subject to the terms of the Consumer Defense Code, without prejudice to the applicability of other provisions of the law.
-
Please describe any civil and criminal liability rules that may apply in case of damages caused by artificial intelligence systems.
There is no specific rule for AI under laws currently in force, so general rules regarding civil and criminal liability would apply.
Brazilian Civil Code establishes that if a person or entity, due to a voluntary action or omission, negligence or imprudence, or due to excessive exercise of rights in violation of good faith principles or social practices, violates rights or causes losses or damages to another person or entity (and victim is able to prove the fault of the other party and the existence of a cause consequence link), the defaulting party will have to repair such losses and/or damages. The general rule is the subjective liability, but the Civil Code sets forth that there shall be strict liability, with the obligation to indemnify regardless of any fault, in the instances specified in the law, or when the activity normally carried out by the author of the damage implies in risk to other’s rights, due to its nature. The Civil Code also establishes that companies shall be strictly liable for the damages caused by the products that they place in the market.
For consumer relationships, Brazilian Consumer Defense Code sets forth that the manufacturer, producer, builder, whether foreign or Brazilian and the importer shall be jointly and severally liable and must indemnify consumers for damages caused to consumers for defects arising from the project, manufacturing, construction, assembly, formulae, handling, presentation or conditioning of the products, as well as for insufficient or inadequate information provided about the uses or risks of products. The reseller may also be held jointly liable before consumer if the manufacturer, producer, builder or importer cannot be identified or if the product was supplied without clear identification of such parties. The Consumer Defense Code also sets forth that the supplier of services shall be strictly liable before consumers for damages caused to consumers for defects associated with the rendering of services, as well for insufficient or inadequate information provided about the service fruition or risks.
Regarding criminal liability, it is usually attributable to the individual only, and not to legal entities, unless specific laws sets forth the criminal liability of the legal entity. This is the case with certain environmental crimes. According to Section 3 of Law No. 9605/1998, legal entities, such as companies, may face criminal sanctions only when involved in environmental crimes. Otherwise, the criminal liability is personal to the individual. Under Brazilian Criminal Code (Decree-Law No. 2448/1940, as amended), both the individual who directly commits a criminal offense expressly set forth in the law and the accomplice are subject to the same penalties in Brazil, since the Criminal Code provides that “whoever contributes to a crime is subject to its sanctions.” Minor sentence balancing can be established for the accomplice. Thus, every individual who engages in acts that lead to crimes may be criminally liable, provided that (i) they acted with willful intent; and (ii) they knew (or should have known, depending on the type of crime and conduct) they were engaging in a prohibited activity. Brazilian criminal law establishes that some acts can be considered criminal offenses despite of the individuals’ unwillingness in relation to the act (meaning that willful intent does not need to be proven). In such cases, criminal liability is applicable if (i) a criminal law expressly defines an act as a crime that can be committed even in case of unwillingness; and (ii) the individual acts in a negligent or reckless manner, or in case of malpractice and commits such act defined in the law as a crime.
Bill of Law No. 2338 contains specific rules about civil liability. It establishes that the supplier or operator of the artificial intelligence system that causes material, moral, individual or collective damage is required to indemnify it in full, regardless of the degree of the system’s autonomy. Also, in case of high risk or excessive risk AI system, the supplier or agent shall be strictly liable for the damages caused, in the extent of their participation to the damage. If the AI system is not high risk, the fault of the agent that caused the damaged will be presumed, and the burden of proof will be reversed in favor of the victim.
In addition to civil liability, please note that the Bill of Law No. 2338/2023 also sets forth administrative penalties that may be applied by the authority to suppliers or operators of artificial intelligence systems in case of breach of the obligations set forth in the Bill. The following administrative penalties can be applied according to the Bill:
- warning;
- simple fine, limited, in total, to 50 million Brazilian Reais per breach, and in case of private legal entities, to up to 2% of the net revenues of the corporate group in Brazil in the last fiscal year;
- publication of the breach after it has been analyzed and its occurrence has been confirmed;
- prohibition or restriction to participate in any regulatory sandbox regime provided for in the Bill for up to 5 years;
- total or partial, temporary or definitive, suspension of the development, supply or operation of the artificial intelligence system; and
- prohibition to process certain databases.
The Bill expressly sets forth that such administrative penalties do not replace the applicability of administrative, civil or criminal penalties set forth under Brazilian General Data Protection Law, Brazilian Consumer Defense Code or other specific laws, and also that the application of administrative penalties does not exclude the obligation to fully repair any damages caused. Bill of Law No. 2338/2023 does not set forth any specific crime or attribute criminal liability to conducts associated with artificial intelligence systems.
-
Who is responsible for any harm caused by an AI system? And how is the liability allocated between the developer, the user and the victim?
According to Brazilian Civil Code, the party that caused the damage due to a voluntary action or omission, negligence or imprudence is responsible, to the extent of their fault, and the cause consequence link must be evidenced. In instances where the law sets forth the strict liability, there is no need to prove fault, such as when the activity normally carried out by the author of the damage implies in risk to other’s rights due to its nature, and in case damages caused by the products that companies place in the market. The Civil Code expressly sets forth that if the victim also contributed to the event caused damages with fault (voluntary action or omission, negligence or imprudence), the victim’s indemnification will be calculated considering how severe victim’s fault was when compared to the fault of the author of the damage.
In case of consumer relationships, the manufacturer, builder, producer or importer will not be held liable only if they can evidence that: (i) they have not placed the product in the market; (ii) even though they placed the product in the market, there is no defect; or (iii) in case of exclusive fault of the consumer or of a third party. In case of services, the supplier will not be held liable only if supplier can prove (i) that having rendered the service, there is no defect; or (ii) the exclusive fault of consumer or of a third party.
According to the Bill of Law No. 2338/2023, the supplier or operator of the artificial intelligence system is the one liable, in full, for any damages, moral or patrimonial, individual or collective, caused by the system. For purposes of the Bill, “operator” of the AI system is any individual or legal entity, whether public or private, that employs or uses the artificial intelligence system in its name or to its benefit, except if the AI system is used within a personal non-professional activity. Pursuant to the Bill, the supplier or operator will not be held liable if it can evidence that (i) it has not placed the AI system into circulation, has not employed it or taken advantage of it; or (ii) that the damage is a result of act or fact attributable solely to a third party or to the victim, or a result of external force majeure.
-
What burden of proof will have to be satisfied for the victim of the damage to obtain compensation?
Under current laws, there is no specific provision on AI, so general rules will apply.
Pursuant to Brazilian Code of Civil Procedure (Law No. 13105/2015), the burden of proof lies with plaintiff with regard to the facts that constitute plaintiff’s right, and the burden of proof lies with defendant with regards to the existence of any fact that is impeditive, that alters or that terminates plaintiff’s right. In general, plaintiff has the burden to prove the damage, defendant’s fault and the cause-consequence link that defendant’s conduct caused the damage to plaintiff. In cases where there is strict liability according to the law, the agent is liable regardless of proof of agent’s fault, so plaintiff is only required to evidence the damage and the cause-consequence link. However, the Code of Civil Procedure sets forth that in cases expressly set forth in the law, or given the peculiarities of a case that make it impossible or extremely burdensome for one of the parties to meet the burden of proof set forth in the law, or much easier for the other party to obtain evidence of the contrary, the court may reverse the burden of proof or distribute it differently by a justified decision. The parties may also agree to a different distribution of the burden of proof, except in cases of non-disposable rights or if the agreement makes it extremely difficult for one party to exercise its rights.
In case of consumer relationships, consumers have as one of their basic rights the facilitation for the defense of their rights, including the inversion of the burden of proof in their favor.
Bill of Law No. 2338/2023 also changes the general rule on burden of proof. It sets forth agent’s strict liability for high risk or excessive risk AI system, in which case victim is only required to prove the damage and the cause-consequence link that damage was caused by the AI system. For non-high risk AI systems, the fault of the agent that caused the damaged will be presumed, and the burden of proof will be reversed in favor of the victim.
-
Is the use of artificial intelligence insured and/or insurable in your jurisdiction?
In principle, risks associated with the use of artificial intelligence are insurable in Brazil, under a civil liability insurance. We have not identified any insurance offerings in the Brazilian market covering risks or damages associated with the use of artificial intelligence.
-
Can artificial intelligence be named an inventor in a patent application filed in your jurisdiction?
According to the Brazilian Patent and Trademark Office (INPI), artificial intelligence cannot be named an inventor in a patent application filed in Brazil.
Brazilian Industrial Property Law (Law No. 9279/1996) sets forth that the requirements for patentability of an invention are novelty, inventive step and industrial applicability. There other requirements for the application to be granted, such as sufficient description, but none of those requirements refer to the author as an individual. Article 6 of the Industrial Property Law sets forth that the author of an invention or utility model has the right to obtain a patent in accordance with the requirements set forth in the law, and also that the inventor will be named and qualified, unless inventor requests that inventor’s name is not made public.
There was a lot of debate in Brazil as to whether or not artificial intelligence could be named as an inventor in a patent application, because the Industrial Property Law does not expressly state that the inventor is an individual. However, on September 13, 2022, the Specialized Legal Department of the Brazilian Patent and Trademark Office (INPI) issued Opinion No. 00024/2022/CGPI/PFE-INPI/PGF/AGU, in which the Specialized Legal Department concluded that artificial intelligence cannot be named as inventor in a patent application filed in Brazil.
The Opinion refers to a specific patent application, which named as inventor an artificial intelligence system and as applicant the developer of the AI system, and the patent application clearly indicated that the invention was autonomously generated by an artificial intelligence. The Opinion analyzed the requirements of Brazilian Industrial Property Law for patent applications in general and it concluded that, although the law does not expressly require the author to be a person, it can be clearly inferred from the provisions of the Industrial Property Law that the inventor must be a person with legal personality, to whom rights and obligations can be attributed. It also indicates that the nomination of artificial intelligence as inventors in Brazil would require specific laws. In the absence of such specific laws, INPI concludes that artificial intelligence cannot be named an inventor in a patent application filed in Brazil.
-
Do images generated by and/or with artificial intelligence benefit from copyright protection in your jurisdiction? If so, who is the authorship attributed to?
There is a lot of debate as to whether images generated by or with artificial intelligence benefit from copyright protection in Brazil, and to date there is no precedent from superior courts in Brazil analyzing that.
Brazilian Copyright Law (Law No. 9610/1998), in its article 11, expressly sets forth that author is the individual (human being) that creates a literary, artistic or scientific work, and authors are afforded patrimonial and moral rights under Brazilian Copyright Law. There are instances where the Copyright Law allows analogies to protect certain works, such as in case of collective works – the law sets forth that the organizer shall be the holder of patrimonial rights, but individual participations are protected – among others, such as audiovisual works and anonymous works. However, it is clear in the law that the general rule is that the author is an individual, and patrimonial rights can be assigned to legal entities. Also, Brazilian doctrine and case law also recognize that a minimum of originality as an attribute of the creation is a requirement for the work to be afforded copyright protection.
In view of the above, most of scholars defend that a work that is created solely by artificial intelligence would not, under Brazilian Copyright Law, be subject to copyright protection and would be deemed a work in the public domain. Nonetheless, the issue is not so obvious if the work is created with human interference, such as inputs from an individual that will direct and influence the outcome of the work.
We understand that there is a lot of room for discussion, especially in cases of works that are not 100% autonomously created by AI systems. With human interference in the creative process, the analysis must be made on a case-by-case basis to determine whether the human interference in the creative process is sufficient to meet the minimum originality and the human creation requirements of Brazilian law. The analysis must also consider the terms and conditions applicable to the specific AI system and the actual human involvement.
Moreover, if the artificial intelligence is a tool that assists in the creation of the work, but there is an individual that controls the creative process, we believe that in principle such work should be afforded copyright protection to the individual that created work, for the original creations of the individual.
To date, there are no precedents of superior courts in Brazil that have analyzed this matter in depth, so the question remains undefined.
-
What are the main issues to consider when using artificial intelligence systems in the workplace?
There are many issues that may arise in connection with the use of artificial intelligence systems in the workplace, and the issues will vary depending on the functionality of the AY system, whether it is generative AI or not, whether the system will be able to make autonomous decisions or not, whether the AI system will process personal data or confidential data, among others.
Generally speaking, issues that companies should bear in mind before using artificial intelligence systems in the workplace are:
- compliance of the AI system with applicable laws and proposed regulations likely to be approved;
- AI governance, monitoring, testing, controls and documentation associated with AI systems and use of AI by the company;
- controls applicable to the AI system, ethics, security measures and governance;
- transparency and information the company needs to provide to affected individuals on the use of AI;
- whether the AI system is considered excessive or high risk and if the company will be in position to comply with individual rights, assessment, security, governance and risk mitigation measures;
- databases used to train the AI system from both an intellectual property and data protection perspectives;
- protection of confidential information of the company;
- if the AI system is used for decision making process, the ability to review decisions by humans and ensure that decisions will be non-discriminatory, and that the company will be in a position to explain the process to authorities should the company be required to;
- if the AI system processes personal data, if the processing is in compliance with Brazilian General Data Protection Law;
- in case of generative AI systems, who will be deemed the owners of the works created by the AI system and who is responsible for intellectual property infringement claims from third parties; and
- potential liability to company for the use of AI systems and how liability can be mitigated.
-
What privacy issues arise from the use of artificial intelligence?
Whenever the use of an artificial intelligence system involves the processing of personal data, privacy issues will arise and overall compliance with Brazilian General Data Protection Law (Law No. 13709/2018 – “LGPD”) will be required, and this has been expressly acknowledged by Bill of Law No. 2338/2023.
Notwithstanding the overall compliance with the Brazilian General Data Protection Law that will be required, there are a few obligations and issues that we would like to highlight. First, regarding the databases used to train the algorithm – if the database used to train the algorithm contains personal data, such processing needs to be in compliance with LGPD, and developer will need to process such personal data to train the algorithm in accordance with one of the legal bases set forth by LGPD and to comply with all obligations in the law, including to provide transparency and comply with data subject rights. The same applies in the use of the AI system by a company or an operator. If the use of the AI system will imply in processing of personal data, the operator needs to make sure that such processing is in compliance with LGPD, that the purposes for which the personal data will be processed by the AI system have been clearly identified and are limited. Of particular relevance to AI systems is to be able to determine that the processing is not discriminatory, which is required by the General Data Protection Law, and also that the processing is made in accordance with one of the legal bases of the law, and that the data controller will be able to comply with transparency obligations and data subject rights and that adequate security, technical and administrative measures have been adopted to protect the personal data.
In case of AI systems that make decisions that may affect the interests of data subjects, under LGPD data subjects have the right to request the review of decisions made solely based on automated data processing if such decisions affect their interests, including decisions that aim at defining a personal, professional or consumer profile, credit profile or other aspects of data subject’s personality. Also, if requested, the data controller must provide clear and adequate information about the criteria and procedures used for the automated decision, subject to protection of trade secrets. Depending on the type of processing activity, data controller may also be required to prepare a data protection impact assessment. Again, those are examples that we believe are quite relevant in connection with AI systems, but all obligations under LGPD will be applicable, including, without limitation, incident notification obligation and compliance with international data transfer mechanisms.
-
What are the rules applicable to the use of personal data to train artificial intelligence systems?
The rules of Brazilian General Data Protection Law (LGPD) shall apply to any processing of personal data, including the use of personal data to train artificial intelligence systems. LGPD is the first comprehensive data protection law in Brazil and applies to the processing of personal data in Brazil and it has extraterritorial effects – it applies irrespective of industry and regardless of where the data processing agent is located, to the extent that (i) the data processing takes place in Brazil; (ii) the data processing occurs for the offering of goods and services in Brazil, or for the processing of personal data from data subjects located in Brazil; or (iii) the processed personal data is collected in Brazil. For purposes for LGPD, the personal data will be deemed collected in Brazil if the data subject was in Brazil by the time the data was collected. The law also provides for data protection principles to be observed in data processing. All data processing activities in Brazil must comply with the following principles: (i) purpose, (ii) suitability, (iii) necessity, (iv) free access, (v) quality, (vi) transparency, (vii) security, (viii) prevention, (ix) non-discrimination, and (x) accountability. As such, data subjects must be given clear, precise, and easily accessible information on how and for which purposes his/her personal data will be processed.
In a nutshell and in general terms, in order to comply with LGPD, companies will be required to: (a) prepare and maintain a Record of Processing – for that purpose, companies needs to map and list all processing activities and determine the legal basis for processing for each activity; (b) adopt security, technical and organizational measures to protect personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or any type of improper or unlawful processing; (c) appoint a Person in Charge, that will act as a communication liaison between company and the Authority, as well as between company and data subjects; (d) map sharing of personal data with third parties and amend, where necessary, existing contracts to regulate the processing of personal data; (e) where personal data is transferred to another country, adopt one of the mechanisms set forth in the law for international data transfers; (f) comply with data subjects rights; (g) notify the Authority and data subjects in reasonable time in case of a security incident that causes or is likely to cause relevant risk or damages to data subjects; and (h) prepare data protection impact assessments for certain processing activities as required by LGPD.
Bill of Law No. 2338/2023 expressly sets forth that any text or data mining activities involving personal data shall be subject to the provisions of the Brazilian General Data Protection Law.
-
Have the privacy authorities of your jurisdiction issued guidelines on artificial intelligence?
Not properly a guidance, but an analysis of the proposed legislation from a data protection perspective. On July 6, 2023, Brazilian Data Protection Authority (ANPD) published a Preliminary Analysis of Bill of Law No. 2338/2023 on the use of artificial intelligence. ANPD considers that the Bill of Law is consistent with and, in many aspects, similar to, the Brazilian General Data Protection Law (LGPD). It points out that both laws contain similar approaches to risk and similar principles, set forth incident notification obligations, and guarantee similar data subject rights. The authority also indicates that both LGPD and Bill No. 2338/2023 require processing agents to adopt similar governance mechanisms and require assessments for certain activities based on risk, such as the data protection impact assessment and the algorithm impact assessment.
The Authority also indicated in its comments that, given ANPD’s function to guard rights to privacy and data protection, ANPD is the key authority in the regulation of artificial intelligence. Although Bill of Law No. 2338/2023 and LGPD have considerable similarities, according to the Bill of Law the Federal Government will appoint which will be the authority responsible for AI, so this preliminary analysis works as a position paper from ANPD.
In addition, according to the regulatory schedule published by ANPD, activities regarding regulation and guidance on AI by ANPD will initiate around mid-2024.
-
Have the privacy authorities of your jurisdiction discussed cases involving artificial intelligence?
According to the information publicly available, not yet.
-
Have your national courts already managed cases involving artificial intelligence?
Yes, there are thousands of cases in Brazil that refer to artificial intelligence or that review aspects associated with artificial intelligence. Our research revealed that the vast majority of cases were labor or consumer disputes, and in several cases there was dispute about evidence obtained with use of AI systems or interaction of consumers with AI systems and compliance with consumer regulations. Our research has not identified any precedent by a superior court in Brazil discussing specifically ownership of intellectual property rights of works created by generative AI systems.
-
Does your country have a regulator or authority responsible for supervising the use and development of artificial intelligence?
Not yet. However, Bill of Law No. 2338/2023 sets forth that the Federal government will appoint a supervisory authority responsible for artificial intelligence and for the enforcement of the AI law.
-
How would you define the use of artificial intelligence by businesses in your jurisdiction? Is it widespread or limited?
The use of artificial intelligence by businesses in Brazil is becoming widespread, although many business still apply artificial intelligence systems to limited purposes or activities. Different studies carried out in 2022 illustrate that trend:
- The study “Advances in the organizational culture based on data, analytics and AI” carried out by IDC for SAS and published in October 2022 shows that, in Brazil, 63% of the businesses that use data and analytics also use AI, while the average in the Latin American region is 46%;
- A global study on “Trust in Artificial Intelligence” published in 2023 by KPMG shows that across countries, 61% of the people are wary about trusting AI systems. While trust is particularly low in countries like Finland and Japan, people in the emerging economies of Brazil, India, China and South Africa have the highest levels of trust, with the majority of people trusting AI systems10; and
- According to IBM, a global research commissioned by IBM – IBM Global AI Adoption Index 2022, indicates that 41% of the businesses in Brazil have actively implemented artificial intelligence in its activities.
-
Is artificial intelligence being used in the legal sector, by lawyers and/or in-house counsels? If so, how?
Yes, AI systems are being used in the legal sector in Brazil, mostly to analyze and compile court decisions and precedents, manage lawsuits, investigate frauds and analyze documents, although lawyers and in-house counsels usually exercise caution and impose restrictions in instances where the use of AI may pose a risk to attorney-client confidentiality.
-
What are the 5 key challenges and the 5 key opportunities raised by artificial intelligence for lawyers in your jurisdiction?
We believe that the 5 key challenges for lawyers raised by artificial intelligence in Brazil are (i) maintaining attorney-client confidentiality in the use of AI; (ii) managing risks in the use of AI given the uncertainty of the legal framework applicable to AI in the near future; (iii) advising clients in the use of AI given the uncertainty of the legal framework applicable to AI in the near future; (iv) lack of maturity in the market for potential compliance with complex obligations such as the algorithm impact assessment if Bill of Law No. 2338/2023 is approved; and (v) controlling the use of AI solutions by users to mitigate exposure of the firm or the company.
On the other hand, we also see as the 5 main opportunities raised by artificial intelligence for lawyers in Brazil the following: (i) efficiency with simple tasks; (ii) better and faster legal research; (iii) better management of court cases and decisions; (iv) possibility to implement better controls for deadlines and cases; and (v) new and better tools to train and interact with teams.
-
Where do you see the most significant legal developments in artificial intelligence in your jurisdiction in the next 12 months?
The most significant legal development in Brazil in artificial intelligence will likely be around the discussions before the Legislative Branch and possible voting and approval of Bill of Law No. 2338/2023. Also, even while Bill of Law No. 2338/2023 is pending, we expect to see an increase of court decisions discussing artificial intelligence, and the interplay of AI with other laws and regulations, including Brazilian General Data Protection Law and Consumer Defense Code.
Brazil: Artificial Intelligence
This country-specific Q&A provides an overview of Artificial Intelligence laws and regulations applicable in Brazil.
-
What are your countries legal definitions of “artificial intelligence”?
-
Has your country developed a national strategy for artificial intelligence?
-
Has your country implemented rules or guidelines (including voluntary standards and ethical principles) on artificial intelligence? If so, please provide a brief overview of said rules or guidelines. If no rules on artificial intelligence are in force in your jurisdiction, please (i) provide a short overview of the existing laws that potentially could be applied to artificial intelligence and the use of artificial intelligence, (ii) briefly outline the main difficulties in interpreting such existing laws to suit the peculiarities of artificial intelligence, and (iii) summarize any draft laws, or legislative initiatives, on artificial intelligence.
-
Which rules apply to defective artificial intelligence systems, i.e. artificial intelligence systems that do not provide the safety that the public at large is entitled to expect?
-
Please describe any civil and criminal liability rules that may apply in case of damages caused by artificial intelligence systems.
-
Who is responsible for any harm caused by an AI system? And how is the liability allocated between the developer, the user and the victim?
-
What burden of proof will have to be satisfied for the victim of the damage to obtain compensation?
-
Is the use of artificial intelligence insured and/or insurable in your jurisdiction?
-
Can artificial intelligence be named an inventor in a patent application filed in your jurisdiction?
-
Do images generated by and/or with artificial intelligence benefit from copyright protection in your jurisdiction? If so, who is the authorship attributed to?
-
What are the main issues to consider when using artificial intelligence systems in the workplace?
-
What privacy issues arise from the use of artificial intelligence?
-
What are the rules applicable to the use of personal data to train artificial intelligence systems?
-
Have the privacy authorities of your jurisdiction issued guidelines on artificial intelligence?
-
Have the privacy authorities of your jurisdiction discussed cases involving artificial intelligence?
-
Have your national courts already managed cases involving artificial intelligence?
-
Does your country have a regulator or authority responsible for supervising the use and development of artificial intelligence?
-
How would you define the use of artificial intelligence by businesses in your jurisdiction? Is it widespread or limited?
-
Is artificial intelligence being used in the legal sector, by lawyers and/or in-house counsels? If so, how?
-
What are the 5 key challenges and the 5 key opportunities raised by artificial intelligence for lawyers in your jurisdiction?
-
Where do you see the most significant legal developments in artificial intelligence in your jurisdiction in the next 12 months?