Brazil Revisits Its Cybersecurity Law

Update September 15, 2026: Brazil’s cybersecurity debate still rests on an existing national strategy and sector plans for telecommunications, but it now also overlaps with the stalled PL 2338/2023 on artificial intelligence, which remains under review in the Chamber of Deputies without an approved law.

Brazil is shaping its General Cybersecurity Law on top of an existing framework, a current National Cybersecurity Strategy and sector plans for critical infrastructure. Telefónica frames the discussion within that prior architecture, while Amirt says telecommunications and broadcasting will have to develop plans aligned with it.

What changed in Brazil’s legislative debate?

The debate gained a parallel front with PL 2338/2023, which seeks to create a general legal framework for artificial intelligence in Brazil. The bill passed the Senate plenary in December 2024 and was sent to the Chamber of Deputies in March 2025, where, as of September 2026, it is still under review by a Special Committee chaired by Representative Luisa Canziani and with Representative Aguinaldo Ribeiro as rapporteur.

The official status of the file is "awaiting the rapporteur’s opinion," according to Monitor Mercantil. AI Policy Tracker places the bill’s introduction in the Senate in May 2023, its approval on December 10, 2024, and its transmission to the Chamber on March 17, 2025, still without becoming national law.

What framework applies until there is an AI law?

The LGPD remains the main reference for AI systems in Brazil until a specific law is approved. Different specialized reports agree that PL 2338/2023 remains in the Chamber after repeated voting delays, so data protection and compliance obligations tied to the LGPD continue to govern the handling of personal data.

Monitor Mercantil says that, as of September 2026, the country still does not have a specific, in-force AI law. StartSe says the same thing, noting that the LGPD remains the main applicable framework for AI systems.

Why is the vote on PL 2338/2023 delayed?

The Chamber’s Special Committee has been operating for 16 months without a filed opinion, according to LCF Consulting. The same review adds that five voting dates were set and canceled since November 2025, and that rapporteur Aguinaldo Ribeiro publicly announced on 08/24/2026 that the vote will be postponed until after the October 2026 elections.

NDmais attributes the delay to a blocked agenda and a lack of political consensus, with disagreements over tax rules in the final report. That combination is extending regulatory uncertainty for technology companies and AI-intensive operations.

What does the bill propose on artificial intelligence?

The bill would create the National Artificial Intelligence Regulation and Governance System, coordinated by the National Data Protection Authority together with other executive branch bodies and experts, according to O Globo. It also classifies high-risk technologies and imposes security tests and measures to mitigate harm and discriminatory bias.

The same text also sets out a right to explanation and human review when public bodies use AI in decisions that affect an individual. Meanwhile, the cybersecurity front already in place in Brazil continues to rely on the National Cybersecurity Strategy and sector plans for telecommunications and broadcasting.