AI Regulation Tracker  /  Regulatory pilot

Brazil's data authority opens a supervised AI sandbox, admits three firms to test through December 2026

The ANPD, Brazil's national data protection authority, moved what it describes as its first AI regulatory sandbox from preparation into live testing. Three companies will run real systems under direct supervision while the regulator studies the governance duties it may later require of everyone.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Brazil's national data protection authority has moved what it describes as its first artificial intelligence sandbox out of the planning room and into live operation. The Autoridade Nacional de Proteção de Dados, known as the ANPD, confirmed that it concluded the leveling phase of its AI and data protection regulatory sandbox and that three selected firms will now test real systems under its direct supervision through December 2026.

The mechanism is a regulatory sandbox: a controlled setting where a small number of companies build and run AI on personal data under a relaxed supervisory regime, while the regulator watches closely and learns. The point is not to hand three firms a permanent exemption. It is to let the ANPD stress-test, on live systems, the governance duties it expects to require of the wider market later. Sandboxes have become a favored tool for regulators facing a technology that moves faster than legislation, and the ANPD is applying the model to AI in what it describes as a first for Brazil.

The timing matters. Brazil already has a comprehensive data protection statute in force, and the ANPD already enforces it, but the authority has limited practical experience supervising the specific failure modes of AI systems. A sandbox lets it build that experience against real deployments rather than hypotheticals, and it gives participating firms a defined channel to test systems that might otherwise sit in a compliance gray zone.

Who is in, and how they got there

The ANPD selected the participants under a public call, Edital nº 2/2025, and confirmed the final list after an appeals round. Three firms made the cut: Metatext IA Ltda., which finished first with a score of 17.24; Synapse Artificial Intelligence Ltda., at 16.33; and IA Greenworld Ltda., at 14.10. Before any live testing began, all candidates went through the leveling phase, an obligatory step meant to align their understanding of AI, data protection, regulation, and the sandbox itself. That phase concluded in February 2026.

The structure that follows runs in stages: leveling, theoretical training, practical testing of the projects, and evaluations built on the participants' own reports and lessons learned. The whole supervised period runs to December 2026.

What the ANPD is actually testing

The regulator has been specific about its focus. The sandbox centers on algorithmic transparency, explainability, and the right to review of decisions taken solely by automated means. That last item points directly at Article 20 of the Lei Geral de Proteção de Dados, Brazil's data protection statute, which gives a person the right to request review of decisions made only by automated processing that affect their interests.

Those three themes are the connective tissue of modern AI governance. Transparency asks whether an organization can tell people that an automated system is involved. Explainability asks whether it can describe, in usable terms, how a given output was reached. The review right asks whether a person can push back and reach a human. By road-testing these duties on operating systems rather than on paper, the ANPD gets evidence for the rules it may later make binding.

What it does not do

This is a pilot, not a statute. It does not, on its own, impose new obligations on companies outside the sandbox, and it does not create a general licensing regime for AI in Brazil. It also does not replace the broader legislative effort: Brazil's horizontal AI bill remains a separate track in Congress. What the sandbox does is narrower and more practical. It lets a regulator that already enforces the LGPD build supervisory expertise in AI before the harder rules arrive, and it gives three firms a supervised path to test systems that might otherwise draw enforcement risk.

The cross-border read

For a US professional, the contrast is the story. Federal AI rulemaking in the United States remains stalled, leaving a patchwork of state activity. Brazil's privacy regulator, by comparison, is already live-testing AI governance duties under an existing national data protection law. US state regulators exploring similar supervised approaches, and any US firm running AI on the personal data of people in Brazil, should read the ANPD's sandbox as an early indicator of where enforceable expectations are heading. The controls the authority is examining now, transparency, explainability, and a real path to human review, are the same controls surfacing in US state privacy and AI proposals, which makes Brazil's live experiment a useful preview rather than a distant curiosity.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.