AI agent governance in Latin America

Latin America's AI regulation is mostly in progress rather than in force. What binds today are the data-protection regimes — Brazil's LGPD foremost among them — and the sectoral supervision that already governs financial services. Brazil's PL 2338 is the instrument to track.

Get an Agent Trust Gap Brief

The short answer

Most of the region has not enacted comprehensive AI law. That is not the same as having no obligations. LGPD in Brazil, and comparable regimes elsewhere, already govern automated processing of personal data — which is most of what an enterprise agent touches.

Brazil's PL 2338 follows a risk-tiered structure recognisable from the EU AI Act. Organisations that have built for EU risk classification will find the conceptual work transfers. The obligations, definitions and thresholds do not transfer automatically — confirm against the Brazilian text as it advances rather than assuming equivalence.

The instruments that actually bind

Named, dated, and separated from the guidance that carries no force of law. Where an instrument does not mention agents directly, that is stated rather than implied away.

Jurisdiction	Instrument	Bearing on agents
Brazil	PL 2338 — AI bill in progress	Risk-tiered structure with EU-like architecture. The region's most advanced AI instrument. Track its progress rather than treating it as settled law.
Brazil	LGPD — in force	Data protection including rights around automated decisions. Binds today, whatever happens to PL 2338.
Mexico	Federal data protection + sectoral	No comprehensive AI statute. Data protection and sectoral financial supervision are the operative constraints.
Chile, Colombia, others	Developing	AI bills and national strategies at varying stages. Confirm current status per country before relying on any summary.
Financial supervision	In force region-wide	Central bank and securities supervision applies to automated decisioning regardless of AI-specific law.

Last verified 2026-08-07. This is a summary of published instruments for orientation, not legal advice. Obligations depend on your role, deployment and sector — confirm against the primary text and your counsel.

What this means for an agent deployment

Regulation in this region does not generally name "AI agents". It names outcomes: traceability, human oversight, accountability for automated decisions, incident reporting. An agent that acts — books, pays, sends, changes records — has to produce evidence of those properties on demand.

Build to LGPD first in Brazil. It binds now. PL 2338 does not yet, and building for a bill that may change is how effort gets wasted.
Reuse EU classification work for Brazil, but verify it. The architecture is similar enough to save time and different enough to burn you if assumed equivalent.
Handle automated-decision rights explicitly. Where an agent's action affects a person, review and explanation pathways need to exist under data-protection law already.
Keep localisation and language in scope. Disclosure and explanation obligations are only satisfied in a language the affected person actually reads.
Watch financial supervisors, not just AI bills. In practice, regional central banks move faster than legislatures on automated decisioning.

Common questions

Does Brazil have an AI law in force?

Not a comprehensive one. PL 2338 is the leading bill and follows a risk-tiered structure. LGPD, Brazil's data protection law, is in force and already governs automated processing of personal data.

Is PL 2338 the same as the EU AI Act?

Structurally similar — risk tiers, obligations scaled to risk — but not identical in definitions, thresholds or duties. Treat EU work as transferable reasoning, not transferable compliance.

What binds an AI agent in Latin America today?

Principally data protection law and sectoral financial supervision. Comprehensive AI statutes are mostly still in progress across the region.

Which LATAM market should we prioritise?

Brazil, on both market size and regulatory maturity. It has the most advanced AI instrument in progress and an operative data-protection regime today.

Do we need Portuguese and Spanish disclosures?

If an agent interacts with people, disclosure and explanation obligations are only met in a language they can actually read. Treat localisation as compliance, not marketing.

What a regulator asks across LATAM

The control set barely changes across jurisdictions; the interrogation does. These are the instruments an examiner cites here, and the question each one turns into.

Instrument	Status	What the examiner actually asks
Brazil LGPD	In force	Automated decision review rights and lawful basis for the agent's data processing?
Brazil AI Bill (PL 2338)	Advancing	High-risk classification and governance obligations if enacted - is the evidence ready?
Regional privacy authorities	In force	Cross-border transfer basis and automated-processing transparency for the action class?

Instruments and dates as verified 2026-08-12. Not legal advice.