Artificial intelligence (AI) advances at a pace that makes even basic tasks, such as establishing rules for its operation, challenging. While governments try to define limits for systems already involved in daily decisions and services, new capabilities continue to emerge and expand the technology's usage possibilities.
The discussion, therefore, is not merely about deciding whether AI should or should not be regulated. It is necessary to determine which risks should be controlled, who should be held accountable, how much companies must do to comply with the rules, and how to maintain up-to-date legislation in the face of a rapidly changing technology.
For Luca Belli, professor at FGV Direito Rio, the need for regulation is directly related to the risks these systems may produce. An AI may function differently from what its developers intended, produce inadequate results, or be targeted by cyberattacks. Therefore, according to the professor, the rules should serve to identify these risks and establish mechanisms to reduce them.
The possibility that the AI system does not function as predefined by the developer or functions incorrectly or is targeted by a cyberattack leads to the necessity of regulation, defining measures to, on one hand, map existing risks and, on the other hand, adopt all necessary measures to minimize, ideally eliminate, these risks.
Luca Belli, professor da FGV Direito Rio
O desafio começa justamente depois dessa constatação. Diferentes países escolheram caminhos distintos para lidar com a tecnologia, e essas escolhas refletem não apenas preocupações com segurança e direitos, mas também interesses econômicos e estratégicos.
AI regulation involves issues such as rights, security, responsibility and the limits for technology use – Image: Summit Art Creations/Shutterstock
Europe, the United States and China adopt different paths
The European Union was one of the first major jurisdictions to create comprehensive legislation for artificial intelligence. The European model is based on risk and places the protection of fundamental rights at the center of the regulatory framework.
In practice, this means that applications with higher potential impact on people are subject to stricter requirements. The logic tries to establish a relationship between the risk of a certain system and the level of control applied to it.
Belli, however, points out an important limitation in the European experience: the regulatory strategy would not have considered, at least initially, the need to develop its own alternatives to reduce dependence on foreign technologies. In this field, the United States and China have advanced with strategies that combine regulation with technological development policies.
In the United States, artificial intelligence is also treated as an issue of technological leadership and national security. The country uses industrial policies and access restrictions to certain technologies as instruments to strengthen its position in the sector.
China follows a similar logic of incentivizing technological development, but combines this industrial policy with specific regulations for applications that may have social impact. Among the examples cited by Belli are rules for deepfakes and algorithmic recommendations.
The difference between these strategies shows that regulating AI does not merely mean establishing limits for companies. The rules can also influence investments, competitiveness, model development, and a country's ability to build its own technological chain.
For Brazil, this comparison is especially relevant because the country needs to adapt foreign experiences to a different economic and technological reality.
Brazil tries to define its own model
The Brazilian debate has moved beyond the initial discussion on the need to regulate artificial intelligence. Bill PL 2.338/2023 was approved by the Senate in December 2024 and is now being analyzed by the Chamber of Deputies.
The proposal adopts a risk-based approach. Instead of establishing the same obligations for all AI systems, the text seeks to differentiate applications according to their potential impact and establish proportional requirements.
According to Leandro Alvarenga, privacy and security consultant and columnist for Olhar Digital, the central point of the Brazilian discussion has moved from the existence of regulation to the model chosen to implement it.
We are not discussing today whether artificial intelligence should or should not be regulated. In fact, it's about what regulatory model Brazil wants to adopt. In practice, the text adopted by the Senate today follows a logic of risk-based regulation.
Leandro Alvarenga, privacy and security consultant
The Brazilian project for regulating artificial intelligence was approved by the Senate in 2024 and is under discussion in the Chamber of Deputies – Image: Thiago Domingues Vieira / Shutterstock
The classification, however, involves a series of decisions. It is necessary to define what will be considered high risk, which systems will be subject to more stringent obligations, and how these requirements will be applied to companies of different sizes and capabilities.
It is at this point that one of the main concerns of the productive sector emerges. A large company may have financial, technical, and human resources to comply with a complex regulation. A startup or small company may not have the same structure.
For Alvarenga, the issue is finding the appropriate calibration. He evaluates that systems capable of impacting fundamental rights need regulation and supervision, but warns that excessive obligations may affect the country's innovation capacity.
If we regulate too much, we risk exporting innovation and importing technology. If we regulate too little, we risk importing problems and exporting rights.
Leandro Alvarenga, privacy and security consultant
The risk of heavy regulation, according to the expert, is that the cost of complying with the rules becomes an entry barrier. This could mainly affect small companies and favor those with larger structures to absorb the demands.
The consequence could also be technological. If Brazilian companies face more difficulties in developing AI systems while large foreign companies can comply with the rules, the regulation could end up influencing the market's composition.
Therefore, Alvarenga argues that Brazil should draw inspiration from international best practices, but not simply replicate models created for other economic and institutional realities.
What happens when AI makes decisions?
Concern for innovation, however, does not eliminate the reasons for creating rules. Artificial intelligence can already participate in decisions with concrete effects on people's lives.
A system used in hiring processes, credit analysis, or other services could produce unfair or discriminatory results. And this can happen even when the application is subject to data protection rules.
Alvarenga highlights precisely this change in the debate. According to him, AI has shown that risks are not limited to the handling of personal information: a system can also produce problematic decisions.
In this scenario, the focus of regulation should not simply be to control the technology, but the situations in which it can produce impacts. This also involves human supervision, especially when AI participates in relevant decisions.
The issue is important because an automated decision may seem objective precisely because it was produced by a system. But the criteria used, the data employed, and the way the result is interpreted can produce consequences that need to be evaluated by people.
Generative AI has made some of these problems more visible. Tools capable of producing realistic texts, images, videos, and audio have expanded concerns about fraud, deepfakes, and content difficult to distinguish from real materials.
The popularization of generative AI has expanded concerns about deepfakes and artificial content increasingly difficult to distinguish from real materials – Image: FAMILY STOCK/Shutterstock
But, for Alvarenga, the risk of concentrating regulation in these cases is to create rules thinking only about exceptions. Most AI applications have uses considered positive, and the attempt to prevent harmful uses should not prevent the others.
This reinforces the logic of risk-based regulation: different applications with different impacts do not necessarily need to be subject to the same level of requirements.
The problem of creating rules for a changing technology
Even when the risks are identified, there is another obstacle: the speed of AI evolution.
Legislation usually goes through a long process between drafting, debate, approval, and implementation. The technology, on the other hand, can change significantly in a few months. Models gain new capabilities, tools find new applications, and problems that were not anticipated become part of the discussion.
Arthur Igreja, an expert in technology and innovation, highlights precisely this misalignment. AI, according to him, has become more powerful and gained new capabilities at a rate that normal legislation usually cannot keep up with.
This does not mean that the regulatory debate should be abandoned. On the contrary: for the Church, the speed of technology makes it even more important that there be proactivity in creating the rules.
The problem can also be observed from Belli's perspective. For the professor, a law is, at best, a photograph of the state of the art and the best practices available at the time it is approved.
The law is, at best, a faithful photograph of the state of the art and the best practices at the time of its adoption. The problem is that, particularly in the case of artificial intelligence, technological evolution is extremely rapid.
Luca Belli, professor at FGV Direito Rio
Therefore, overly detailed legislation can quickly become outdated. On the other hand, overly open rules can generate doubts about their application and increase legal uncertainty.
Belli advocates for a model capable of adapting the application of the rules as new situations arise. The law would establish principles and obligations, while implementation mechanisms could allow for adjustments in light of specific circumstances.
The difficulty lies in finding this balance without letting flexibility turn the legislation into something unpredictable for companies and users.
A law does not function on its own.
There is still a step that begins after the approval of any regulatory framework: implementation.
Artificial intelligence spans different sectors of the economy and may involve different public agencies in oversight. A single legislation may require coordinated action from authorities responsible for distinct issues, making the implementation structure as important as the text approved by Congress.
Belli warns that it is not enough to create well-formulated rules if they are not effectively applied.
Making a beautiful law without it being effective serves no purpose.
Luca Belli, professor at FGV Direito Rio.
The professor also questions the expectation that different agencies can coordinate automatically in the face of complex legislation. For him, the cooperation structure needs to be thought of from the beginning, with mechanisms capable of defining responsibilities and avoiding conflicts of competence.
This point is especially important in a technology not restricted to a single sector. AI systems can be used in financial services, health, education, commerce, security, and various other areas, creating situations where different authorities may have some role in oversight.
Therefore, regulation does not end with the approval of a law. It is necessary to define how the rules will be interpreted, who will oversee them, and how the system will be updated as new applications emerge.
Does Brazil want to be a consumer or a producer of AI?
The discussion on regulation is also connected to a broader issue: what will be Brazil's role in the AI industry.
The United States and China already concentrate companies, infrastructure, and AI models, while other countries try to build their own capacity to reduce technological dependencies. The rules created now may just influence Brazil's ability to participate in this market.
For Alvarenga, the regulatory choice should not be analyzed only by the immediate impact on companies. It also needs to consider the effect on technology development in the country.
What do we want to be: an AI consumer, a technology consumer, or, effectively, a technology producer? The risk of overly heavy regulation is not only to reduce innovation, but to concentrate too much technological power in a few global actors who are not Brazilians. Leandro Alvarenga, privacy and security consultant
The challenge is to build a regulation that protects rights, establishes responsibilities and reduces risks without turning the compliance with rules into a barrier for national companies. At the same time, leaving regulatory gaps may expose users and entire sectors to problems that will be more difficult to correct later.
It is a choice that involves not only the use of AI but also the position that Brazil aims to occupy in its development.
For Alvarenga, the greatest strategic risk would be the country being left out while other nations set the direction of the technology.
The risk for Brazil here is not not regulating artificial intelligence. The risk for Brazil is watching an artificial intelligence revolution from the stands, while other countries are the ones defining the rules of the game.
Leandro Alvarenga, privacy and security consultant
Ana Figueiredo is a technology editor at Olhar Digital. She is a Journalism graduate from the Federal University of Uberlândia (UFU).
