Brazil Senate Approves PL 2780/2024

Update September 8, 2026: PL 2780/2024 is no longer just on the agenda, it was approved by the Senate plenary and sent for sanction, with a veto or enactment window running from Sept. 4 to 25, 2026. The legislative agenda also added PL 5255/2026, while PL 1828/2023 moved to awaiting dispatch and PL 2338/2023 remains stalled in the Chamber of Deputies.

Brazil’s Senate approved PL 2780/2024 and sent it for sanction, while other bills on biometrics, artificial intelligence, electronic fraud and critical infrastructure security continue through the legislative pipeline. Together, these measures could reshape digital compliance duties, incident management and the use of automated systems for tech companies, telecom operators and platforms.

What happened to PL 2780/2024?

PL 2780/2024 was approved by the plenary of Brazil’s Federal Senate and sent for sanction, with a window for veto or approval open between Sept. 4 and 25, 2026. With that vote, the proposal left internal legislative debate and entered the final stretch of the process.

The Senate’s official record lists it as a matter filed and published in May 2026, and its inclusion on the agenda had already been reported since Aug. 28, 2026. The Sept. 2, 2026 update confirms the plenary vote did take place.

Public descriptions of the bill, based on available coverage of electronic fraud, point to intelligence mechanisms, data sharing and digital education to address those crimes. The material reviewed also links it to possible effects on incident response duties and cooperation with authorities by telecom operators and platforms.

What changes under CNSIC Resolution No. 20?

Resolution CNSIC No. 20 formally assigned ABIN to monitor threats against the country’s critical infrastructure. The decision strengthens the institutional security and cybersecurity layer around essential services and took effect when published in the Diario Oficial da União.

Sector coverage on digital defense says the National Committee on Critical Infrastructure Security set the Brazilian Intelligence Agency as the body responsible for that monitoring, in line with the National Intelligence Policy. The move does not change the bills moving through Congress on its own, but it does define a sensitive state function for essential infrastructure.

What changes with PL 2170/2023?

PL 2170/2023 stiffens penalties for anyone who incites or induces crimes in collective settings such as schools, universities and shopping centers, and the text includes incitement through digital media. The Senate Public Security Committee has already approved it, but it still must move through other stages of review and voting before any possible presidential sanction.

That makes it relevant in environments where the spread of messages, videos or campaigns can amplify criminal conduct. For now, the concrete legislative point is its committee advance, not final approval.

What is happening with facial recognition and biometrics?

PL 1828/2023 remains under review in the Senate, where it has been listed since Sept. 1, 2026 as awaiting dispatch. The proposal sets general rules for the use of facial recognition systems and other automated biometric identification tools by public administration and operators of essential public services.

Privacy and data protection groups said the bill had been placed on the plenary agenda for June 17, 2026 and that it would authorize facial recognition cameras in metro stations, trains, buses, public roads and government offices nationwide. As things stand, however, the only confirmed detail in the Senate record is that it is still pending dispatch.

What is the status of the AI framework in the Chamber of Deputies?

PL 2338/2023 remains in the Chamber of Deputies, where it sits in a special committee and is officially marked as awaiting the rapporteur’s opinion as of Sept. 2, 2026. The proposal, which seeks to create a regulatory framework for artificial intelligence in Brazil, was approved by the Senate on Dec. 10, 2024, but it still lacks an approved report in the lower house.

An analysis based on the official record says the file has 37 attached proposals and still has no opinion, substitute text or recorded votes. The schedule that called for an opinion on May 19 and a vote on May 27, 2026 was not met, and there is no new official date set for voting.

The special committee in the Chamber has not met since November 2025, according to sector coverage, and setting a new date depends on the rapporteur submitting the opinion. That step is now expected, for the moment, after the October 2026 elections.

Reporting on the impact of AI on funding for professional journalism highlights that PL 2338/2023 includes provisions requiring digital platforms to pay copyright fees when they use journalistic works in generative AI systems, a mechanism some industry players see as a way to support journalism amid the sector’s financial crisis.

Along the same lines, legal analysis columns describe PL 2338/2023 as a case of regulatory mismatch in Brazil, because the bill remains far from political and technical consensus despite more than 35 attachments in the Chamber. One opinion piece also calls it the country’s main legislative initiative on AI and reinforces the view that it has stalled.

What other bills remain under discussion?

Alongside PL 1828/2023, the Senate also lists PL 5255/2026, which has been in process since Sept. 1, 2026 and last appears in the plenary, where it is marked as awaiting dispatch. The available material does not include the bill’s consolidated text, so its specific regulatory impact cannot yet be defined.

Also still cited are PL 3066/2025, linked in legislative coverage to digitalization and public service security, and PL 169/2026, associated with foreign affairs and the economy, with no direct cybersecurity or data protection provisions in the available record. At the same time, REQ 91/2026 calls for a public hearing to inform PL 2470/2026.

How does election AI fit into this picture?

The regulation of deepfakes in the electoral campaign already has concrete rules from the TSE and requires platforms and technology providers to strengthen detection and response processes. National coverage says synthetic audio and video used to favor or harm candidates are banned, clear labeling is required, and penalties range from removal and fines to cancellation of registration.

An independent analysis adds that any campaign material using AI to create or alter image, voice or content must carry an explicit warning, that avatars and chatbots aimed at voters must identify themselves as machines, and that platforms that fail to remove unlabeled synthetic content share responsibility and may be sanctioned.

What precedent has already been closed?

Bill No. 1077/2019, which addressed the criminal classification of computer crimes and electronic fraud, is listed in the National Congress database as having completed its procedure and a final decision on record. It is no longer in legislative review, unlike the initiatives now driving debate in the Senate and the TSE.

PL 5184/2026 also appears in the Senate database, although the research material provided does not include enough detail about its content to place it precisely within the cybersecurity and digital compliance map.