AI systems classified by risk level: excessive (Art. 13), high (Art. 14), and general
Preliminary assessment
Self-classification before market introduction is optional — Art. 12 makes it a good-practice measure ("poderá realizar") that earns favourable treatment, not a precondition; a sector authority may simplify or waive it, and the competent authority may order reclassification or require an algorithmic impact assessment (Art. 12 § 4)
Prohibited practices
Art. 13 bans systems that induce harmful behaviour, exploit vulnerabilities, profile people to predict criminality or recidivism, or facilitate child sexual abuse material; plus public-authority social scoring, autonomous weapons systems, and real-time remote biometric identification in public spaces (with judicially authorised exceptions)
High-risk categories
Art. 14 lists twelve: critical-infrastructure safety devices; student admission selection and evaluations determining academic progress or monitoring; recruitment and employment decisions; access to essential public and private services; triage of emergency service calls; administration of justice; autonomous vehicles in public spaces; health diagnostics and procedures; analytical study of crimes; investigative credibility assessment and profiling; biometric emotion recognition; immigration and border control
Algorithmic impact assessment
Mandatory for high-risk systems (Art. 25), performed before placing the system on the market (Art. 26); conclusions are public, subject to trade-secret protection (Art. 28)
Penalties
Violation
Fine
Non-compliance
Up to BRL 50 million or 2% of revenue
Severe violations
Warnings, suspension, or bans on AI system operation
Art. 5(I) gives every affected person, at any risk level, the right to accessible free information that an interaction is automated, conveyed with standardised icons or symbols (Art. 5 § 1); cybersecurity and cyberdefence systems are excepted
Right to explanation
Art. 6(I) grants an explanation of a high-risk system's decision, recommendation, or prediction, subject to trade and industrial secrecy (Art. 6 § 1)
Explanation procedure
Art. 7 requires the explanation to be free, in plain accessible language, within a reasonable period; the competent authority sets deadlines and a simplified procedure scaled to system complexity and agent size
Documentation
Art. 18 requires developers and deployers of high-risk systems to keep lifecycle documentation and to use tools that allow accuracy and robustness to be assessed
Procedures for exercising rights
Art. 9 requires high-risk agents to state, clearly and accessibly, how the Chapter II rights are exercised
Synthetic content marking
Art. 19 requires an identifier in AI-generated synthetic content for authenticity and provenance verification; artistic and entertainment works may signal via credits or metadata (Art. 19 § 3)
Art. 6(III) gives a person affected by a high-risk system the right to human review of the decision, weighed against context, risk, and the state of the art
Right to contest
Art. 6(II) gives the right to contest and request review of a decision, recommendation, or prediction
Human supervision
Art. 8 requires human supervision of high-risk systems that lets supervisors understand, interpret, decide, and intervene; not required where implementation is provably impossible or disproportionate, in which case effective alternative measures apply
Procedures for exercising rights
Art. 9 requires agents to state how the rights are exercised; Art. 10 has the competent authority issue general guidelines with the SIA sector authorities
Enforcement avenues
Art. 11 allows the rights to be asserted before the competent administrative body or in court, individually or collectively
EveryAILaw.com