Part of the AI Regulation News hub.
Brazil's data protection authority has opened contributions on the draft regulatory agenda that would set which artificial intelligence rules it writes in 2027 and 2028, with four of seventeen items on AI and a deadline of 16 October
This is a consultation about what to regulate, not a regulation. That makes it the cheapest point at which anyone with a view on how Brazil handles AI training data or automated decisions can actually be heard.
Bottom line: ANPD opened contributions on 1 September 2026 on the draft resolution approving its regulatory agenda for 2027 and 2028. Four of the seventeen agenda items are AI items. Contributions close on 16 October 2026. The draft is unnumbered and unsigned and binds nobody.
Who this affects: Anyone with an interest in how Brazil will regulate AI training data, deepfakes, AI companions aimed at minors, or automated decision review. Because it sets the queue rather than the rules, it is the moment when an argument is cheapest to make.
Issue date: Opened 1 September 2026, closing 16 October 2026, per the dates on ANPD's own participation page.
What changed: Nothing binding. What is now visible is the authority's own list of what it intends to write, in what order, and in which half of which year.
Analysis: The item worth reading closely is the one on generative AI and data protection, because it puts the legitimate interest question on the agenda explicitly. Whether legitimate interest can ground the use of personal data to train a model is the question the whole Brazilian AI compliance position turns on, and ANPD has now scheduled it rather than answered it.
Primary sources: ANPD public participation page for Tomada de Subsídios 04/2026 · Draft resolution and annexed regulatory agenda
- Instrument
- Tomada de Subsídios 04/2026, on a draft resolution approving the ANPD regulatory agenda for the 2027-2028 biennium
- Authority
- Autoridade Nacional de Proteção de Dados
- Jurisdiction
- Brazil
- Process
- SEI nº 00261.002488/2026-86. A parallel Tomada de Subsídios 05/2026 covers the 2027-2030 regulatory result evaluation agenda.
- Dates
- Contributions from 1 September 2026 to 16 October 2026
- Status
- Draft. The text is headed RESOLUÇÃO CD/ANPD Nº XX, DE XX DE XXXXX DE 202X, so it is unnumbered and unsigned.
- Bindingness
- None. The draft approves a work plan. Its article 1 approves the agenda and its article 3 provides that the resolution enters into force on the date of its publication, which has not occurred. Any duty would come from the future instruments the agenda schedules, not from this.
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://www.gov.br/anpd/pt-br/acesso-a-informacao/participacao-social/outras-acoes
What is open, and until when
Brazil's data protection authority opened contributions on 1 September 2026 on a draft resolution that would approve its regulatory agenda for the 2027 to 2028 biennium. Its own participation page gives the window: contributions may be submitted between 1 September and 16 October 2026.
The instrument being consulted on is a work plan. Its first article approves the agenda annexed to the resolution, and its third provides that the resolution enters into force on the date of its publication. Nothing in it regulates conduct.
The draft is also visibly unfinished. Its header reads RESOLUÇÃO CD/ANPD Nº XX, DE XX DE XXXXX DE 202X, with the number, day, month and year still placeholders. Anyone describing this as Brazil regulating AI is describing something that has not happened.
A parallel consultation, Tomada de Subsídios 05/2026, covers the authority's regulatory result evaluation agenda for 2027 to 2030.
The four AI items, and when each is scheduled
Four of the seventeen agenda items are AI items, and the agenda assigns each a phase across the biennium: regulatory impact analysis, then consultation with society, then final approval.
Item 4 covers generative AI use by children and adolescents under article 11 of Decreto nº 12.880/2026, reaching AI companions and chatbots, algorithmic risk assessment, and signalling the synthetic and automated character of an interaction. It is scheduled for impact analysis in the first half of 2027 and for consultation and final approval in the second half.
Item 7 covers AI generation and modification of intimate content, that is deepfakes, under articles 9 and 10 of Decreto nº 12.976/2026, and names preventive technical safeguards including prompt filters, risk classifiers and blocking mechanisms. Impact analysis is scheduled for the second half of 2027 and consultation for the first half of 2028.
Item 15 covers generative AI and data protection, including whether legitimate interest can ground the use of personal data for training.
Item 17 covers review of automated decisions under article 20 of the LGPD.
Why the training data item is the one to read
Of the four, item 15 carries the most weight for anyone operating a model that touched Brazilian personal data.
The legitimate interest basis is what most training arguments in Brazil currently rest on, and its availability for that purpose has never been settled by the authority. Putting it on a published agenda is not an answer, but it does confirm that the authority intends to reach the question rather than leave it to enforcement.
The practical consequence of the scheduling is that a company has a window. An argument made during a regulatory impact analysis is heard before a draft exists. An argument made after a rule is published is a compliance problem.
It is worth being precise about what this does not tell you. The agenda does not indicate what ANPD thinks the answer is, and nothing in the draft signals a direction. Reading a position into a queue would be inventing one.
What to do about it
If you have a view on any of the four items, the deadline is 16 October 2026 and the contribution is to a work plan rather than to a rule. That is a lower-cost intervention than any that will be available later.
For the training data question specifically, the useful contribution is evidence rather than position. An authority scheduling an impact analysis is asking what the effects are, and that is answerable with facts about how models are built and what alternatives exist.
Diary the phases rather than the deadline alone. Item 4 reaches consultation in the second half of 2027 and item 7 in the first half of 2028, which is when draft text will exist to argue about.
Do not change anything operationally on the strength of this. It is a draft work plan, unnumbered and unsigned, and the duties it contemplates would come from instruments that do not yet exist.
Brazil's ANPD opened Tomada de Subsídios 04/2026 on 1 September 2026, taking contributions until 16 October on a draft resolution approving its regulatory agenda for 2027 and 2028. Four of the seventeen items are AI items: generative AI use by children and adolescents under article 11 of Decreto nº 12.880/2026, covering AI companions and the signalling of synthetic interaction; AI generation and modification of intimate content under articles 9 and 10 of Decreto nº 12.976/2026, naming prompt filters, risk classifiers and blocking mechanisms; generative AI and data protection, including whether legitimate interest can ground the use of personal data for training; and review of automated decisions under article 20 of the LGPD. The agenda assigns each item a phase across the biennium, with the children item reaching consultation in the second half of 2027 and the deepfake item in the first half of 2028. The draft binds nobody: its article 1 approves a work plan, its article 3 provides for entry into force on publication, which has not occurred, and its header still reads RESOLUÇÃO CD/ANPD Nº XX, DE XX DE XXXXX DE 202X.
Source File
https://www.gov.br/anpd/pt-br/acesso-a-informacao/participacao-social/outras-acoes
Open ANPD's public participation page and find the entry for Tomada de Subsídios 04/2026. Confirm the contribution window in its own table, 01/09/2026 a 16/10/2026, and the process number SEI nº 00261.002488/2026-86. Then open the linked draft and confirm three things: the header still reading RESOLUÇÃO CD/ANPD Nº XX, DE XX DE XXXXX DE 202X; article 1 approving the agenda for the 2027-2028 biennium in the form of the annex; and article 3 providing that the resolution enters into force on the date of its publication. In the annexed agenda, items 4, 7, 15 and 17 are the AI items, each with its phase and half-year assignment.
Art. 1º Fica aprovada a Agenda Regulatória para o biênio 2027-2028 da ANPD, na forma do Anexo a esta Resolução. In English: Article 1. The ANPD Regulatory Agenda for the 2027-2028 biennium is hereby approved, in the form of the Annex to this Resolution. Draft resolution, Tomada de Subsídios 04/2026
FAQ
Is Brazil regulating AI with this?
No. This is a consultation on a draft work plan that would set which rules the authority writes in 2027 and 2028. The draft is unnumbered and unsigned and binds nobody. Any duty would come from the instruments the agenda schedules.
What is the deadline?
Contributions run from 1 September to 16 October 2026, per the dates on ANPD's own participation page.
Which items are the AI ones?
Four of seventeen. Item 4 on generative AI use by children and adolescents; item 7 on AI generation and modification of intimate content; item 15 on generative AI and data protection including legitimate interest for training; and item 17 on review of automated decisions under article 20 of the LGPD.
Does it say whether legitimate interest can be used for training?
No. It schedules the question rather than answering it, and nothing in the draft signals a direction. Reading a position into the agenda would be inventing one.
When would any of this produce actual rules?
The agenda assigns phases across the biennium. The children item is scheduled for impact analysis in the first half of 2027 and consultation and final approval in the second half; the deepfake item for impact analysis in the second half of 2027 and consultation in the first half of 2028.
Is there anything else open alongside it?
Yes. A parallel consultation, Tomada de Subsídios 05/2026, covers the authority's regulatory result evaluation agenda for 2027 to 2030.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.