Brazil's Ministry of Women has put its own staff and contractors under a generative AI policy, in force since 24 September 2026, that requires human validation of AI-assisted work and a notice on documents where AI contributed significantly

Who is bound, and who is not

The ordinance is Portaria GM/MMULHERES nº 134, dated 22 September 2026 and signed by the Minister of Women, Márcia Helena Carvalho Lopes. It was published in the Diário Oficial da União on 24 September 2026 and, under Article 20, took effect that day. Article 1 establishes a good-practice policy for generative AI "no âmbito do Ministério das Mulheres", within the Ministry of Women.

Article 2 fixes the scope: "Esta Política aplica-se a todas as pessoas servidoras, colaboradoras, estagiárias, bolsistas e prestadoras de serviço que utilizem ferramentas de Inteligência Artificial Generativa nas atividades institucionais do Ministério das Mulheres." Our translation: this Policy applies to all servants, collaborators, interns, scholarship holders and service providers who use generative AI tools in the institutional activities of the Ministry of Women. It does not bind members of the public or any other ministry or agency.

Human validation, stated in two places

Article 5 carries the core rule for the ministry's covered staff and contractors: generative AI tools serve as support for human work, and their use for automated decisions without validation by a responsible public agent is barred. Article 7 adds, for the same people in their ministry work: "Todo conteúdo produzido com o auxílio de Inteligência Artificial Generativa deverá ser revisado e validado pela pessoa responsável pela atividade, que assumirá a responsabilidade integral pelo resultado final." Our translation: all content produced with the help of generative AI shall be reviewed and validated by the person responsible for the activity, who will assume full responsibility for the final result.

Article 14(I) repeats the automated-decision bar in slightly different words, prohibiting "decisões administrativas automatizadas sem supervisão humana", in our translation automated administrative decisions without human supervision. Neither article bans automated steps outright; both turn on a human check. Article 3 defines human supervision as review and validation by the person responsible for the content produced.

One drafting point, which is our observation and not the ministry's: Article 12(VIII), on projects, systems and solutions involving generative AI, asks for logs and audit trails that keep "decisões automatizadas" traceable. Read with Articles 5 and 14, that seems to contemplate automated outputs that a person then validates.

The disclosure notice and its trigger

Article 8 is the only labelling rule, and it is conditional. For covered staff and contractors, whenever generative AI "contribuir de forma significativa para a elaboração de documentos", contributes significantly to preparing documents, the document is to carry this notice, quoted from the ordinance: "Parte deste conteúdo foi produzida com o auxílio de ferramenta de Inteligência Artificial Generativa, revisada por agente público responsável." Our translation: part of this content was produced with the help of a generative AI tool, reviewed by a responsible public agent.

The ordinance does not define a significant contribution. It does not require a notice on every document an AI tool touched, and it says nothing about documents produced outside the ministry.

Copilot by name, other tools by homologation

Article 9 authorises Microsoft Copilot, as part of the corporate Microsoft 365 package, as an official generative AI tool within the ministry. Its sole paragraph says the authorisation does not relieve the user of full responsibility for generated content, or of the bar on processing sensitive or confidential personal data without proper safeguards.

Article 10 lets the IT coordination unit authorise other platforms through a formal homologation process. Its only paragraph, labelled § 1º although no second paragraph follows, calls for transparent, risk-based criteria covering compliance with the LGPD, the platform's terms of use, and guarantees that ministry data will not be used to train public models. The ordinance lists no other approved tool, and we have seen no register of approvals.

Nothing in the text says the ministry has bought anything new, and nothing in it establishes how Microsoft handles ministry data.

Security, prohibited uses and liability

Article 11 lists security practices for covered users: corporate credentials and institutional environments only; no sharing of personal, sensitive or confidential data on external platforms; anonymisation where applicable; separate production, staging and test environments; access management with multi-factor authentication; periodic monitoring and audit; and immediate reporting of incidents or suspected breaches to the IT coordination unit. Article 12 adds practices for projects, systems and solutions involving the use of generative AI, including an ethical and impact assessment before deployment.

Article 14 prohibits five uses. Besides the automated-decision bar and unreviewed official documents, they are processing personal or sensitive data without authorisation, producing discriminatory, false, defamatory or biased content, and "criação de perfis comportamentais ou análise preditiva de indivíduos", in our translation creating behavioural profiles or predictive analysis of individuals. Article 13, by contrast, only recommends uses such as drafting, summarising public texts and data, and preliminary analysis. It obliges no one to use AI.

Article 16 requires each covered user to sign a term of acknowledgment and responsibility. Article 17 says non-compliance "poderá implicar responsabilização administrativa, civil e penal, conforme a legislação vigente", may lead to administrative, civil and criminal liability under existing legislation; it creates no new offence or fixed penalty. Article 18 gives the IT coordination unit implementation, guidance, periodic audit and review duties, and Article 19 sends gaps and exceptional cases to the ministry's Digital Governance and Information Security Committee.

What we did not verify

What we opened: the ordinance as published on the Imprensa Nacional DOU site, read in full from heading to signature, in the capture our independent reviewer checked, where Article 5 appears as quoted. Portuguese passages are quoted from that page with accents as published.

What we did not open: the certified PDF edition of the DOU, which the HTML page says it does not replace; the decrees and Portaria GM/MMULHERES nº 51/2025 cited in the preamble; any ministry release, the term of responsibility form, or a homologation register; and any generative AI policy of another Brazilian federal body, none of which we discuss.

What we refuse to claim: that these rules bind any other ministry, the federal public service at large, the public, or AI vendors outside their work for this ministry; that the ordinance bans every automated decision; that Copilot is the only tool the ministry has approved or will approve; that a document without the notice breaches the ordinance whatever the AI contribution; that the ordinance creates new penalties; that the ministry has already implemented its controls; and that this is the first such policy in Brazil.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Brazil's CNJ bars machine-only court decisions
• Brazil's AI Act, PL 2338: where the law stands
• Israel's public-sector responsible AI guide
• Latin America AI regulation tracker
• AI Regulation News hub