Brazil’s ANPD expands AI and data rules

Brazil’s data protection authority, ANPD, closed the first edition of its AI and Data Protection Regulatory Sandbox and published the program’s final report. The pilot evaluated three technology solutions using AI in an experimental, controlled, and supervised setting, with support from the Center for Artificial Intelligence and Machine Learning at the University of São Paulo. Around the same time, the agency released the fourth, fifth, and sixth interim sandbox reports and presented a six-year institutional review showing stronger regulatory and enforcement capacity in Brazil.

What did the AI sandbox close show?

ANPD said the pilot examined three technology solutions with artificial intelligence under direct supervision and within an experimental, preventive framework, without a direct enforcement purpose. The interim reports described how the technical tests evolved, the validation of security controls, the regulatory maturity of the solutions, risk mitigation, and compliance with governance conditions.

The authority said the sandbox is meant to gather material for future regulatory guidance on AI in Brazil. According to the official statement, the program received support from the Center for Artificial Intelligence and Machine Learning at the University of São Paulo.

What regulatory scope does ANPD have now?

ANPD said Law No. 15,352/2026 turned it into a federal regulatory agency, and that Decrees No. 12,975 and No. 12,976, in force since May 2026, expanded its powers over regulation, enforcement, and the analysis of violations tied to app providers’ obligations and users’ rights.

In its review, the authority said its Enforcement unit opened 70 cases between 2020 and 2026. Those included monitoring procedures involving digital platforms, app stores, operating systems, and artificial intelligence tools to verify compliance with the Digital Child and Adolescent Statute and Brazil’s Internet Civil Framework.

What topics is ANPD regulating now?

The institutional review lists 19 regulatory initiatives. Of those, 16 are still in progress, two have been completed or closed, and one has not yet started, according to ANPD. Topics under development include biometrics, the application of the LGPD to artificial intelligence, minimum information security standards, anonymization, and age verification mechanisms under the Digital Child and Adolescent Statute.

TeleSíntese added that the regulatory agenda also includes setting interpretive parameters for Article 20 of the LGPD, which gives data subjects the right to request a review of decisions made solely through automated processing of personal data. Mobile Time said the institutional review also covers new enforcement powers under the Digital Child and Adolescent Statute, responsibilities related to protecting women from violence in digital environments, and staffing reinforcement through hiring competitions and specialized training.

What practical cases did the sandbox review?

A sector analysis, not officially confirmed in every detail, describes practical controls tied to the sandbox’s three areas: explanations for preventive blocks and anti-fraud security in finance, audits of location anonymization and sharing risks with providers in mobility, and traceability of sources, limits on automated recommendations, and protection of sensitive data in health.

That approach reflects the kind of requirements ANPD said it is testing in an experimental setting, with a focus on security, governance, and risk reduction before moving toward more stable regulatory criteria.