News | AI with Rights | Digital Platforms and Markets

AI in Brazil: Who Will Be Responsible for Regulation?

We are at a new frontier in the use of artificial intelligence, exploring the possibilities of generative AI. This growing interest has already raised enough red flags for governments and organizations to begin addressing the legal, regulatory, and ethical issues related to this technology.

Authorities responsible for personal data protection are increasingly dealing with AI-related issues. In the EU, for example, the European Data Protection Supervisor (EDPS) was established.

In the United States, the Federal Trade Commission (FTC), although not a data protection authority, addresses these concerns. In Latin America, several countries have enacted national legislation on personal data protection.

With the widespread use of ChatGPT, Italy and Spain have called for its suspension until compliance with the European General Data Protection Regulation (GDPR) is ensured.

In the meantime, the Ibero-American Network for Data Protection launched a coordinated action in May to safeguard the rights of individuals affected by ChatGPT in the Latin American context, among other examples.

At the start of 2023, the U.S. government conducted a public consultation on drafting such rules. Meanwhile, the European Union reached a preliminary consensus on the text of an AI Act, which will soon be put to a vote in the European Parliament.

Specifically, the European AI Regulation Proposal (AI Act) establishes a governance system at both the EU and national levels for member states.

The proposal introduces a European AI Board composed of representatives from member states and the European Commission, primarily aimed at harmonizing the application of the regulation across the EU, explains Paula Guedes Fernandes da Silva, a researcher at the Legalite Center for Law and Technology at PUC-RJ and an AI regulation researcher at the Data Privacy Brasil Research Association.

At the national level, the European proposal allows member states the freedom to designate one or more competent national authorities, including a national authority responsible for overseeing the implementation and enforcement of the regulation. “We have seen data protection authorities taking on this role at the national level”, Paula notes.

Who Will Regulate AI in Brazil?

Within these initiatives, Brazil has much to learn. Fernanda Galera Soler, a professor at Fundação Getúlio Vargas (FGV), highlights the importance of transparency, accountability, and risk-based governance practices, with the potential for creating a regulatory body.

“I also emphasize the need for harmonization with human rights and social participation, ensuring that the concerns of various sectors of society are heard and addressed”, she adds.

In 2021, the Brazilian Artificial Intelligence Strategy was launched, but despite its significance, it lacked important elements such as implementation planning, targets, relevant definitions, and even a budget.

According to Fernanda, since that time, the National Council of Justice (CNJ) has actively engaged in debates on AI, promoting studies and research involving AI in the judiciary, as well as hosting events and discussions.

In the judiciary alone, there are over 50 ongoing AI-related projects, according to an FGV survey. In the legislature, the most advanced initiative, PL 2338/2023, was introduced in early May by Senator Rodrigo Pacheco.

The Senate’s bill includes concepts, principles, and foundations for AI use, a list of rights for individuals affected by its use, and proposes categorization to facilitate risk analysis associated with artificial intelligence. It also suggests governance practices and addresses accountability and sanctions to be applied by a yet-to-be-designated competent authority.

The text mentions “competent authority” 28 times, defining it in Article 4, Section V, as the federal public administration body or entity responsible for ensuring the enforcement and supervision of the law nationwide. Article 32 establishes that the executive branch will designate this authority.

“As only the executive branch has the authority to create new regulatory bodies or increase their potential expenses, PL 2338 was vague in defining who this competent authority will be”, Paula explains.

“However, we must not forget that AI regulation should operate as a network, involving other authorities and bodies (CADE, ANPD, Public Prosecutor’s Office, Public Defender’s Office) as well as other actors, especially civil society”, adds the PUC-RJ professor.

ANPD as the AI Regulator

In an ideal scenario, the best path would be the creation of a specific authority for AI regulation in Brazil.

“Given the complexity of the subject, this authority would need to combine complex, diverse, and multidisciplinary expertise—including legal and technical—with broad regulatory and normative capacity, as well as technical, financial, administrative, and organizational independence and autonomy”, Paula outlines.

This authority would work alongside existing bodies, public institutions, and society, enabling an open dialogue with all stakeholders, including public consultations, hearings, and impact analyses for proposed regulations.

The National Data Protection Authority (ANPD) has expressed interest in being designated as the competent authority for AI regulation in Brazil, citing the synergies between AI and personal data processing. For instance, PL 2338 introduces principles, rights, and governance tools similar to those in the General Data Protection Law (LGPD).

“We have seen statements from ANPD representatives and a recent preliminary study published by the Authority indicating that, due to these overlaps, it is crucial for these regulations to align rather than conflict. This would be better achieved if the same authority undertakes this function, especially as overlapping competencies may arise”, Paula explains.

In this scenario, the challenge would involve ANPD’s current limitations in terms of staffing and financial resources. “If we choose to designate ANPD as the authority for AI regulation, it is essential to address these gaps and shortcomings”, the researcher states.

Fernanda from FGV highlights doubts about choosing ANPD as the regulatory authority, particularly regarding its ability to operate across sectors and disciplines, as the topic demands

“In this sense, following part of the debates conducted by the commission of legal experts tasked with supporting the drafting of an AI framework in Brazil, it would be interesting to establish an authority composed of various bodies, including ANPD, given the interdisciplinary challenges”, Fernanda notes.

Text by Rafael Teixeira Farias, originally published on July 25, 2023, on Fast Company Brasil.