Brazil's AI Bill (PL 2338/2023): Why Strict Liability Should Worry SMEs

Brazil's PL 2338/2023 was approved by the Senate in December 2024. Structurally it mirrors the EU AI Act — a risk-based model, with an "excessive risk" tier that is banned outright.

But it contains one departure that matters more to small businesses than the risk tiers do: strict liability.

The risk-based skeleton

Familiar territory if you know the EU AI Act:

• Risk-based classification, with obligations scaling to risk.
• Excessive-risk systems banned outright.
• Developers: risk management, with a heavier share of responsibility.
• Deployers: risk assessments, transparency, human oversight.
• Users: rights protections, including a right to explanation.

Why strict liability changes things

Under most regimes, a well-run business has a defence. You show your risk assessment, your human oversight, your documented reasonable care — and that counts for something. Colorado explicitly rewards it. Texas makes NIST adoption a safe harbour.

Strict liability weakens that logic. If liability can attach without proof of fault, then doing everything right offers less protection than it would elsewhere.

Most AI laws ask whether you were careful. A strict-liability regime asks whether harm occurred. That is a materially different risk profile for a company without a legal department.

Developers bear more of the burden under the bill, but SMEs anywhere in the chain can be exposed.

What SMEs should do now

• Comply with the LGPD today. Brazil's data protection law already governs AI processing personal data and is in force — this is the immediate obligation, not the future one.
• Take the right to explanation seriously. If AI influences decisions about Brazilian users, be able to explain the basis of those decisions in terms a person can understand.
• Be conservative about high-impact use cases in the Brazilian market until the liability position settles.
• Document anyway. Even where documentation is a weaker defence, it remains essential for insurance, contracts, and demonstrating good faith.
• Check your contracts. Where liability is strict, contractual allocation of risk between you and your AI vendors becomes disproportionately important.

The contract questions to ask your AI vendor

Where liability is strict, the allocation of risk in your supplier contracts stops being boilerplate. Before scaling in Brazil, get clear answers on:

• Indemnities — will the vendor cover you if their model causes the harm?
• Liability caps — a cap set at twelve months of fees is common, and may be far below the exposure.
• Right to audit or explain — can you obtain what you need to satisfy a right-to-explanation request from a Brazilian user?
• Change notification — will you be told when the underlying model changes? A silent upgrade can alter behaviour you have already assessed.

These are worth asking everywhere. In a strict-liability market they move from prudent to essential.

The bigger picture

Brazil matters beyond its own market because it shows the EU model being adopted and then strengthened. Other Latin American jurisdictions — Chile, Colombia, Peru, Uruguay — are moving in similar directions.

If Latin America is part of your growth plan, Brazil is the jurisdiction to watch, and the liability question is the part to raise with counsel before you scale.