Brazil advances AI audit bill

Brazil’s Chamber of Deputies Science, Technology and Innovation Committee has approved the opinion on PL 6706/2025, a bill that would amend the Lei Geral de Proteção de Dados Pessoais, or LGPD, to establish preventive algorithmic audits for artificial intelligence systems that influence high-impact social decisions. The proposal now moves to the Constitution and Justice and Citizenship Committee, amid other legislative efforts that are also pushing for tighter oversight of AI, data protection, and cybersecurity in the country.

What does PL 6706/2025 require?

The text would require audits to be conducted by external and independent entities at least every two years, or after any substantial modification to the AI model, according to Atlas Público. It also calls for a technical report to be submitted to the Autoridade Nacional de Proteção de Dados, ANPD, and for an executive summary to be published while preserving trade secrets.

The proposal is not limited to a generic review. According to the research material, the goal is to establish preventive verification over systems that could affect decisions with high social impact, with technical traceability and a reporting obligation before the data protection authority.

What penalties does noncompliance carry?

Failure to meet the audit obligations would be tied to the administrative sanctions already set out in the LGPD, according to SecurePrivacy.ai. That includes fines of up to 2% of a company’s revenue in Brazil, capped at 50 million reais per violation, plus daily fines as long as the violation continues.

How is AI regulation moving in Brazil?

The ANPD has already said it will expand its enforcement structure to monitor AI systems and biometric uses, with a focus on algorithmic transparency, model explainability, training data, and bias mitigation, according to SpaceMoney. In the same vein, the ANPD published Technical Note No. 1/2026 in 2026, stating that content generated by AI systems that refers directly or indirectly to an identified or identifiable person may be considered personal data, according to SecurePrivacy.ai.

That framing is already reflected in legislative work. PL 2688/2025, under review in the Chamber of Deputies, designates the ANPD as one of the authorities responsible for overseeing the use of artificial intelligence in Brazil, expanding the agency’s role in the digital regulatory ecosystem, according to Lefosse Advogados.

What other projects are moving in parallel?

The Chamber of Deputies Science and Technology Committee also approved in August 2026 the opinion on a bill introduced by Representative Romero Rodrigues to regulate the use of artificial intelligence in public security, through changes to Lei nº 13.756/2018, according to Atlas Público. The text also includes an explicit reference to the LGPD as a complementary framework.

On another regulatory track, the Institutional Security Office reported that, during the 5th meeting of the National Committee for Critical Infrastructure Security, it approved submitting the draft bill for the National Policy on Critical Infrastructure Security to the Executive Committee of the Chamber for Foreign Affairs and National Defense, a step before it is sent to the National Congress. The GSI said that, after the draft is consolidated, the text will be presented at a meeting scheduled for August 27, 2026.

Together, these initiatives map out a legislative push in which Brazil is trying to address algorithm audits, AI oversight, personal data use, and critical infrastructure protection at the same time.