Brazil's ANPD publishes AI sandbox report

Brazil’s Autoridade Nacional de Proteção de Dados released its second interim monitoring report on its regulatory sandbox for artificial intelligence. According to the agency, the initiative is meant to generate evidence for regulatory public policy and promote ethical and secure technological development, in line with the LGPD and the fundamental rights of data subjects.

What is ANPD’s sandbox trying to do?

ANPD describes it as a controlled setting to observe how AI solutions behave under regulatory criteria. The immediate goal is to produce evidence that can support future public policy, with a focus on personal data protection and on whether these systems comply with Brazilian law.

The second interim report comes as debate grows in Brazil over corporate use of generative and agentic AI tools. At the Cybersecurity Summit covered by Meon, speakers addressed data governance, the risks of tools used without company authorization, and the need to tighten basic security controls.

What risks are companies and cited studies pointing to?

Materials released this week point to a specific risk, exposure of data in prompts and in unauthorized tools. CNN Brasil reported, based on a Check Point Research study, that Latin America had the highest regional share of high-risk generative AI prompts in July and August 2026, with one in every 29 prompts, or 3.5%.

IT Forum added another figure, though with weaker attribution, saying that in January 2026 one in every 30 prompts sent from corporate networks carried a high risk of exposing sensitive data and that the problem appeared in 93% of organizations that regularly used generative tools. As published, that result does not clearly identify the primary study.

Exame, for its part, cited IBM’s Cost of a Data Breach 2025 report to say that incidents tied to shadow AI were present in about 20% of the breaches analyzed and raised the average cost by about $670,000. That figure is global, not specific to Brazil.

What data should not end up in chatbots without authorization?

Exame warns that putting CRM data, documents, code, API keys, or passwords into unauthorized chatbots can expose personal information, intellectual property, and credentials. According to the coverage, that practice can also trigger obligations under the LGPD.

At the Cybersecurity Summit, speakers also mentioned digital fraud, ransomware, and vulnerability exploitation as major challenges for Brazilian organizations. Meon’s coverage stressed that, despite AI’s progress, phishing and basic failures remain among the issues putting the most pressure on companies in the country.