Brazil's data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD), held its first multisetorial consultation with civil society on August 13, 2026, to debate its regulatory sandbox for artificial intelligence and personal data protection. The videoconference gathering brought together public-sector, private-sector, academic and civil-society representatives to weigh in on a pilot that has run three Brazilian technology companies in a controlled, supervised environment since March 2026. The ANPD published the session on August 14, 2026.
The consultation is the ANPD's first broad opening of the sandbox to outside input, and it signals the risk surfaces the authority is treating as priority for AI under the LGPD (Lei 13.709/2018) while Congress finalises the Marco Legal da IA (PL 2338/2023). The discussion was structured around four thematic blocks: transparency and supervision of AI tools; anonymization and data governance; discrimination and disproportionate impacts; and regulatory gaps. A second consultation, this time restricted to sectoral regulators, will follow on a date yet to be set.
Who is in the sandbox, and what is being tested?
The sandbox is operated by the ANPD's Superintendência de Inovação Tecnológica (Sitec) under Edital nº 2/2025, which selected three companies: Metatext, Synapse AI and Prevvine Tecnologia. They began testing in March 2026, and the ANPD published its first partial monitoring report in early July 2026. According to the authority, the participants have already mapped technological, legal and operational challenges across governance, security, transparency and personal-data protection, surfacing good practices and areas needing improvement.
Invited specialists at the August 13 session included the Núcleo de Excelência em Tecnologias Sociais of the Federal University of Alagoas (NEES/UFAL), the Opice Blum law firm, the Rio de Janeiro Public Prosecutor's Office (MPRJ), the National Social Security Institute (INSS), the Datasphere Initiative and the USP Center for Artificial Intelligence and Machine Learning (CIAAM-USP), which is itself part of the pilot alongside the ANPD. The sandbox project page tracks the selected participants.
What does the consultation signal for AI vendors and DPOs?
For AI developers and data protection officers operating in Brazil, the four-block structure is the clearest preview yet of the issues the ANPD will press when it moves from pilot to binding instruments. Transparency and supervision point toward disclosure and human-oversight duties on AI systems handling personal data; anonymization and data governance suggest heightened scrutiny of training-data provenance and de-identification; the discrimination block signals attention to disparate impact on protected groups; and the regulatory-gaps theme implies the ANPD sees current LGPD provisions as incomplete for AI-specific risks.
This is consultative, not binding: the consultation creates no new obligations, and the sandbox itself is experimental. But the themes align with the direction of PL 2338/2023, which the Senate approved in December 2024 and which is now before the Câmara dos Deputados, making the sandbox a practical rehearsal for obligations that may become law.
| Sandbox theme | What practitioners should watch |
|---|---|
| Transparency and supervision of AI tools | Disclosure and human-oversight duties on AI handling personal data |
| Anonymization and data governance | Training-data provenance and de-identification standards |
| Discrimination and disproportionate impacts | Bias testing and disparate impact on protected groups |
| Regulatory gaps | Where the LGPD falls short for AI, likely future rulemaking |
Continuous, per-jurisdiction real-time monitoring surfaces this kind of consultative step the moment it publishes, rather than when a binding rule lands months later.
Take advantage of this real-time watch
Compliance teams should verify whether their AI systems fall within the ANPD's emerging risk categories, review the July partial report for operational signals, brief data governance and product teams on the four themes, and track the second regulator-only round for cross-sectoral implications.
