Artificial Intelligence Governance Policy of the Chamber of Deputies
Brazil · Regulation · Chamber of Deputies of Brazil
Our summary
This regulation establishes AI governance standards for the Chamber of Deputies and applies to all use, development, contracting and implementation of AI systems within the institution. It sets out ethical principles for AI deployment, including requirements for data protection, transparency, human autonomy, fairness, robustness, security and intellectual property respect, alongside mechanisms for risk management and oversight through a new Ethics Committee on AI Use.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
53 sections
Jump to a chapter
- Capítulo I General provisions
- Capítulo II Principles and objectives
- Capítulo III Privacy directives
- Capítulo IV Transparency directives
- Capítulo V Accountability and human autonomy
- Capítulo VI Non-discrimination directives
- Capítulo VII Robustness and security
- Capítulo VIII Guidelines for intellectual property
- Capítulo IX Risk management in AI
- Capítulo X Roles and responsibilities
Capítulo I General provisions
3 sections
This chapter establishes foundational rules for the AI governance policy of the Chamber of Deputies and covers definitions, policy establishment, and principles for AI systems.
Article 1 Purpose and scope
This regulation creates the AI governance policy framework for the Chamber of Deputies and implements a prior executive decision.
Article 2 Definitions
Defines thirteen terms used in this regulation: artificial intelligence as technology or algorithms performing tasks that usually require human intelligence; generative AI as a kind capable of creating new content in multiple formats from learned patterns; AI systems as digital platforms using AI; AI system lifecycle as all stages from conception to deactivation including planning, design, data preparation, training, testing, deployment, monitoring and deactivation; business manager as head of administrative unit responsible for IT solutions in their area; data manager as formally designated responsible for data decisions; ethical principles as consensus on accepted conduct when using, developing and implementing AI systems; hallucination as convincing but false responses in generative AI; retrieval-augmented generation as a technique combining generative AI with information retrieval systems; AI agent as autonomous or semi-autonomous system perceiving information to meet determined objectives; sensitive personal data as specified categories including racial origin, religious conviction, political opinion, union affiliation, health or sexual life data, genetic or biometric data linked to a person; public cloud for AI services as external provider operated shared infrastructure where AI services run on standardized platforms; and private cloud for AI services as dedicated isolated environment operated by the organization or exclusive provider with infrastructure located in the national territory or with location and sovereignty controlled by the Chamber of Deputies.
Article 3 Policy establishment
The regulation establishes an AI governance policy grounded in ethical principles for using, developing, procuring and deploying AI systems, integrating with existing corporate and IT governance frameworks.
Capítulo II Principles and objectives
2 sections
This chapter outlines the ethical principles governing AI deployment and specifies the policy's goals of maximizing AI benefits while minimizing associated risks.
Article 4 Ethical principles
AI system development and use must follow eight ethical principles covering good faith data treatment, privacy protection, transparency, accountability, fair and unbiased results, secure and resilient operation, human decision primacy, and intellectual property respect.
Article 5 Policy objectives
The policy aims to optimize AI advantages for the Chamber while mitigating risks such as harm to fundamental rights, privacy violations, discriminatory outcomes, false content generation, and threats to democratic stability.
Capítulo III Privacy directives
4 sections
This chapter sets requirements for handling personal data in AI systems, establishing that personal data use should be avoided when possible and regulated when necessary.
Article 6 O uso de dados pessoais por sistemas de IA deve ser evitado
Article 7 Personal data handling requirements
When AI systems must process personal data, they must comply with data protection law and require formal authorization from the data manager and data protection officer; personal data must be anonymized when accessed by unauthorized users.
Article 8 Public cloud restrictions
Submitting personal data to public cloud AI services is prohibited without prior written authorization from the data manager and data protection officer, regardless of anonymization status.
Article 9 Account creation restrictions
Prohibits staff from creating accounts on cloud-based generative AI systems outside the Chamber's infrastructure using corporate identifiers such as email addresses or institutional credentials.
Capítulo IV Transparency directives
3 sections
This chapter establishes transparency guidelines covering three main articles on AI system disclosure, with requirements that users be informed when interacting with AI agents.
Article 10 Transparency requirements
Requires that AI systems and the data they use, whether in development or operational, meet transparency standards to ensure decisions are explicable and traceable.
Article 11 Transparency action scope
Specifies that transparency efforts for AI systems must address planning, development, procurement, deployment and ongoing monitoring throughout the system's lifecycle.
Article 12 Os usuários deverão ser informados quando estiverem interagindo com um agente de IA
Capítulo V Accountability and human autonomy
2 sections
This chapter establishes directives on responsibility, accountability and maintaining human control, covering two articles on organizational and user obligations.
Article 13 Administrative responsibility
Requires administrative units using AI in their work to define roles and responsibilities for all stakeholders involved, while complying with existing data governance, information security and personal data protection policies.
Article 14 User accountability
Makes generative AI users responsible for materials they create and publish from system outputs, requiring them to review results before public release or workplace use, and prohibits automated decisions without human review.
Capítulo VI Non-discrimination directives
1 section
This chapter establishes guidelines for ensuring AI systems produce fair and non-discriminatory results, covering one article on prohibited AI applications.
Article 15 Prohibited AI uses
Prohibits development and use of AI systems that generate unlawful or abusive discrimination, create or amplify biases in the data, or assess personality traits or behavioral characteristics for profiling purposes.
Capítulo VII Robustness and security
7 sections
This chapter covers security and robustness requirements for AI systems, including data confidentiality protection according to classification levels and administrator responsibilities for identifying sensitive corporate data and restricted documents.
Article 16 Robustness testing for AI systems
AI systems created, contracted or modified by the Chamber of Deputies must undergo robustness testing to measure their ability to withstand failures, errors and security vulnerabilities.
Article 17 Os sistemas de IA devem assegurar a confidencialidade dos dados utilizados, conforme o grau de sigilo atribuído
Article 18 Restricted access data processing authorization
Processing restricted access data through AI systems on private cloud or Chamber infrastructure requires prior explicit authorization from the responsible Data Manager.
Article 19 Prohibited use of restricted data on public cloud
Using restricted access data for AI systems on public cloud platforms is prohibited, whether the data is under the Chamber's responsibility or another organization's responsibility.
§ 1 Definition of restricted access data
Restricted access data includes information classified as secret based on State or societal security, legally protected information, data that could endanger business operations, and credentials for accessing Chamber digital systems.
§ 2 Os titulares de unidades administrativas devem definir formalmente os dados que comprometam os processos corporativos
§ 3 Enquadram-se nas condições do caput as minutas de documentos com restrição de acesso
Capítulo VIII Guidelines for intellectual property
2 sections
This chapter covers intellectual property matters related to AI systems, including how systems must respect content ownership rights and how users must attribute data sources.
Article 20 Respect for intellectual property in AI
Development and deployment of AI systems must comply with intellectual property rights of content represented in their datasets.
Article 21 Data source verification and attribution
Users must verify and cite data sources with proper author recognition in documents created using generative AI systems; this requirement also applies to Chamber research conducted with other organizations.
Capítulo IX Risk management in AI
7 sections
This chapter establishes AI risk management procedures, including creating a permanent ethics committee, considering complete system lifecycles from development through adaptation or acquisition, and coordinating between technical and governance bodies.
Article 22 AI risk management across system lifecycle
Risk management must encompass the entire lifecycle of internal, adapted or contracted AI systems, and the technical directorate must define minimum information requirements for AI system documentation.
Article 23 AI Ethics Committee establishment
A permanent AI Ethics Committee is created with technical functions, composed of the Data Protection Officer and representatives from six administrative units: Projects and Management, the Speaker's Office, Legal Affairs, Technology and Innovation, Human Resources, and Documentation and Information.
Article 24 Evaluation and approval of AI projects
Before starting an AI project or system implementation, Ditec must conduct an ethical risk assessment and submit it to CETIA for analysis. CETIA approval depends on compliance with IT governance standards, documentation level, and monitoring requirements; if high risk is identified, the request is rejected and justifications are communicated to relevant committees.
§ 4 As demandas por sistemas de IA aprovadas no CDTI devem ser encaminhadas ao CGE para ciência
Article 25 Data verification and documentation mechanisms
Ditec and business areas must establish mechanisms to verify alignment between AI system results and their underlying data, retrieve training data used by AI systems except for generative AI or open-source models, and store external training datasets and generative AI retrieval-augmented generation data for future explanation of system outputs.
Article 26 Lifecycle procedures and development standards
Ditec must establish procedures defining responsibilities for all phases of AI system lifecycles from conception through removal from the institution's portfolio. Development must include risk identification for security incidents and failures, testing plans to detect inappropriate behaviors, and measures to identify and control bias and hallucinations that could distort results.
Article 27 Continuous monitoring of operational AI systems
Operating AI systems must be continuously supervised jointly by business managers, data managers, and Ditec to identify risks to ethical principles and determine needs for data adjustments, system retraining, business rule modifications, or system suspension. Data used by AI systems must be continuously monitored for security attacks that could compromise integrity and privacy.
Capítulo X Roles and responsibilities
12 sections
This chapter covers the roles and responsibilities of various institutional bodies and committees in AI governance, including Ditec, CETIA, CDTI, CGE, CGSIC, data managers, business managers, and project managers, with provisions for handling unspecified cases and the effective date of the regulation.
Article 28 AI governance actors
Nine actors participate in AI governance: Ditec, data managers, business managers, project managers, the Data Protection Officer, the AI Ethics Committee, the IT Steering Committee, the Strategic Management Committee, and the Information Security and Cybersecurity Management Committee.
Article 29 Responsibilities of Ditec
Ditec must define and coordinate development and maintenance of AI systems ensuring ethical principles throughout their lifecycle, establish technical directives for generative AI prompts and agents, deliberate on contracting digital solutions with AI, manage AI risks, increase system resilience against security incidents, support committee deliberations, partner on data quality, and conduct continuous monitoring of AI systems.
Article 30 Responsibilities of data managers
Data managers must deliberate on treatment of data under their responsibility by AI systems throughout their lifecycle, propose analysis for removing unreliable AI systems from operation, partner on data quality with Ditec and business managers, and conduct continuous supervision of AI systems.
Article 31 Responsibilities of business managers
Business managers must request authorization from data managers and the Data Protection Officer for data access and treatment, document and supervise continuous generative AI use in work processes, suspend unreliable AI systems, partner on data quality decisions, conduct continuous supervision of AI systems, and provide timely business requirements and testing feedback on system behavior.
Article 32 Responsibilities of project managers
Project managers must request authorization from data managers and the Data Protection Officer for data access in AI projects, submit documentation on planned generative AI use following Ditec standards before project start, report periodically on AI use according to Ditec standards, and inform Ditec when identifying risks or problems in applying ethical principles in AI use.
Article 33 Data Protection Officer Authority
The Data Protection Officer decides on requests concerning access to and handling of personal data in AI systems.
Article 34 Responsibilities of CETIA
CETIA reviews risk reports for new AI system requests and provides assessments with conditions for approval, evaluates risks in systems under development or in operation with recommendations on continuation or deactivation, communicates its assessments to specified units, and publishes periodic executive reports on its analyses.
Article 35 CDTI Coordination
CDTI must incorporate CETIA's analyses into its procedures for technology and IT projects that use or plan to use AI systems.
Article 36 CGE Decision-Making
CGE, with support from Ditec, makes decisions regarding the use, development, implementation and contracting of AI systems.
Article 37 Cabe ao CGSIC deliberar sobre aspectos de segurança da informação e cibernética de sistemas de IA
Article 38 Os casos omissos serão analisados pelo CGE, que poderá propor normas complementares à Diretoria-Geral, sempre que necessário
Article 39 Entry into Force
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 21 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 3 of 4
- Risk classification, not covered
Data and privacy 4 of 4
Transparency and records 3 of 4
- Labelling of synthetic content, not covered
Technical safeguards 4 of 4
Assurance and lifecycle 3 of 4
- Registration and notification, not covered
Rights and protected groups 1 of 4
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 3 of 6
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 40 are shown.
Article 3 2 controls
- ObligationApplies to: Public authorityDrafted by the Index
The Chamber of Deputies must establish an AI governance policy grounded in ethical principles for using, developing, procuring and deploying AI systems.
- ObligationApplies to: Public authorityDrafted by the Index
The AI governance policy must complement and integrate with existing corporate governance and IT governance frameworks already in place.
Article 4 8 controls
- ObligationApplies to: AnyoneDrafted by the Index
Development, use, procurement and deployment of AI systems must treat data in good faith and for legitimate purposes.
- ObligationApplies to: AnyoneDrafted by the Index
AI systems must respect the right to privacy and protection of personal data.
- ObligationApplies to: AnyoneDrafted by the Index
AI systems must operate transparently with responsible disclosure of procedures and decisions.
- ObligationApplies to: AnyoneDrafted by the Index
Organisations must take responsibility and account for their AI system decisions and outcomes.
- ObligationApplies to: AnyoneDrafted by the Index
AI systems must produce results that are fair, free from bias, inclusive and non-discriminatory.
- ObligationApplies to: AnyoneDrafted by the Index
AI systems must operate as designed with intact data, respect authorised access, and maintain resilience against failures and security incidents.
- ObligationApplies to: AnyoneDrafted by the Index
Human decision-making must remain primary when using AI systems, with continuous supervision of system behaviour guaranteed.
- ObligationApplies to: AnyoneDrafted by the Index
AI systems must respect intellectual property, trade secrets and copyright.
Article 7 3 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers must comply with data protection law when AI systems process personal data that is strictly necessary.
- ProhibitionApplies to: DeployerDrafted by the Index
Deployers must not process personal data through AI systems without formal justification and prior written authorization from the data manager and data protection officer.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must anonymize personal data when it will be accessed by users not authorized to view it.
Article 8 1 control
- ProhibitionApplies to: DeployerDrafted by the Index
Deployers must not submit personal data to public cloud AI services, whether anonymized or not, without prior written authorization from the data manager and data protection officer.
Article 9 1 control
- ProhibitionApplies to: AnyoneDrafted by the Index
Staff members must not use corporate information such as email addresses or institutional credentials to create accounts on cloud-based generative AI systems not contracted by the Chamber.
Article 10 1 control
- ObligationApplies to: DeployerDrafted by the Index
AI systems and the data they use must meet transparency standards to ensure decisions are explicable and traceable.
Article 11 1 control
- ObligationApplies to: DeployerDrafted by the Index
Transparency efforts for AI systems must address planning, development, procurement, deployment and monitoring throughout the system's lifecycle.
Article 13 2 controls
- ObligationApplies to: Public authorityDrafted by the Index
Administrative units using AI must define roles and responsibilities for all stakeholders in each action involving AI.
- ObligationApplies to: Public authorityDrafted by the Index
Administrative units using AI must comply with existing data governance, information security and personal data protection policies.
Article 14 3 controls
- ObligationApplies to: DeployerDrafted by the Index
Users of generative AI systems are responsible for documents they create and publish from system outputs.
- ObligationApplies to: DeployerDrafted by the Index
Users must review generative AI results before making them public or using them in work processes and decisions.
- ProhibitionApplies to: DeployerDrafted by the Index
Organisations must not adopt automated decisions created by AI systems without human review.
Article 15 3 controls
- ProhibitionApplies to: ProviderDrafted by the Index
Providers must not develop or deploy AI systems that produce unlawful or abusive discrimination.
- ProhibitionApplies to: ProviderDrafted by the Index
Providers must not develop or deploy AI systems that create or strengthen biases against any entity represented in the training data.
- ProhibitionApplies to: ProviderDrafted by the Index
Providers must not develop or deploy AI systems that assess personality traits or behavioral characteristics of individuals or groups for profiling.
Article 16 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The Chamber of Deputies must subject AI systems it develops, contracts or modifies to robustness testing to measure resilience to failures, errors and security vulnerabilities.
Article 18 1 control
- ObligationApplies to: DeployerDrafted by the Index
Processing restricted access data through AI systems on private cloud or Chamber infrastructure requires prior explicit authorization from the responsible Data Manager.
Article 19 1 control
- ProhibitionApplies to: DeployerDrafted by the Index
Deployers must not process restricted access data for AI systems on public cloud platforms, whether the data is under the Chamber's responsibility or another organization's responsibility.
Article 20 1 control
- ObligationApplies to: ProviderDrafted by the Index
Providers and deployers must comply with intellectual property rights of content represented in the datasets that AI systems use and are developed with.
Article 21 2 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers must verify data sources and name their respective authors in documents created with generative AI systems.
- ObligationApplies to: Public authorityDrafted by the Index
The Chamber of Deputies must verify data sources and name respective authors in research papers produced with generative AI systems in collaboration with other organisations.
Article 22 2 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers must conduct risk management across the entire lifecycle of AI systems developed internally, adapted or acquired through contract.
- ObligationApplies to: Public authorityDrafted by the Index
The technical directorate must establish the minimum set of information that must be recorded about actions related to AI systems.
Article 23 1 control
- ObligationApplies to: Public authorityDrafted by the Index
A permanent AI Ethics Committee must be established with the Data Protection Officer and representatives from six specified administrative units.
Article 24 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
Before starting an AI project or system implementation, Ditec must conduct an ethical risk assessment and submit it to CETIA for analysis.
- ObligationApplies to: Public authorityDrafted by the Index
CETIA must analyse whether the AI project meets IT governance standards, documentation and monitoring requirements before granting approval.
- ObligationApplies to: Public authorityDrafted by the Index
CETIA must reject an AI project request if its analysis identifies high risk to the Chamber or to citizens, and must communicate the justifications to Ditec, CDTI and CGE.
- ObligationApplies to: Public authorityDrafted by the Index
CETIA must consult the information security and cybersecurity committee before issuing its opinion if the AI project involves information security or cybersecurity aspects.
Article 25 3 controls
- ObligationApplies to: Public authorityDrafted by the Index
Ditec and business areas must establish mechanisms to verify that AI system results correspond to their underlying data.
- ObligationApplies to: Public authorityDrafted by the Index
Ditec and business areas must establish mechanisms to retrieve the training data used by AI systems, except for generative AI or models refined from open-source pre-trained models.
Change history
No changes recorded since we began monitoring this policy.