Brazilian AI Bill PL 2338/2023 (not yet law)

Under Article 29 of the Senate-approved text, the developer of a general-purpose or generative AI system must, in addition to the relevant development documentation, carry out a preliminary assessment to identify its expected risk levels, including potential systemic risk, taking into account reasonably expected uses and the criteria in Section III of Chapter III. The readiness action now is to fold this assessment into the existing model release review, produce an assessment report template that will map onto the Brazilian framing, and share a single source document with the EU AI Act general-purpose model technical documentation to avoid duplicated work later.

Applies when

Not yet in force. If enacted in its current form it would apply to developers placing general-purpose or generative AI systems on the Brazilian market; for now it is a pre-release review readiness item.

Evidence to retain

• · Preliminary assessment report template and a first trial assessment
• · List of reasonably expected uses and the basis for the risk determination
• · Internal criteria and conclusion on systemic risk
• · Field mapping against the EU general-purpose model technical documentation

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Under Article 30 of the Senate-approved text, before making a systemic-risk general-purpose or generative AI system available or placing it on the market for commercial purposes, the developer must: describe the general-purpose AI model; document the tests and analyses performed to identify and manage reasonably foreseeable risks, as appropriate and technically feasible; document residual non-mitigable risks remaining after development; process and incorporate only datasets collected and handled in accordance with legal requirements and subject to adequate data governance, and, where personal data is involved, with Lei nº 13.709/2018 and Chapter II of this Law; publish a summary of the training dataset as regulated; design and develop the systems using applicable standards to reduce energy and resource use and waste and increase energy and overall system efficiency in the context of use; and produce intelligible technical documentation and instructions for use so that developers, distributors and applicators understand how the system works (item VII). Article 30 §1 is pointed: compliance is required regardless of whether the system is supplied as a standalone model, embedded in another AI system or product, under free and open-source licences, as a service, or through other distribution channels — which matters most to Chinese vendors releasing open-weight models. Article 30 §2 lets developers draw up or adhere to codes of good practice to demonstrate conformity. Readiness action: start producing training data provenance and licence chains, evaluation and red-team records, a residual risk register, technical documentation and instructions for use, and a publishable training data summary now, so the evidence is reconstructable when the law takes effect.

Applies when

Not yet in force. If enacted in its current form it would apply to developers placing systemic-risk general-purpose or generative models on the Brazilian market.

Evidence to retain

• · Model description (architecture, capability boundaries, intended and prohibited uses)
• · Risk testing and analysis records (red-teaming, evaluation suites and conclusions)
• · Residual risk register with mitigation status
• · Training data provenance and licence evidence, plus a draft publishable training dataset summary
• · Technical documentation and instructions for use aimed at developers, distributors and applicators (Article 30(VII))
• · Design note on energy and resource efficiency and the standards relied on

Estimated first-time effort: 15–35 person-days (estimate, not a commitment)