EU AI Act for Brazilian Companies: How Article 2 Reaches Brazilian AI Providers

A Sao Paulo fintech whose AI credit-scoring model is used by a lender in Lisbon is bound by the EU AI Act — even with no European office, no European entity, and no Brazilian AI law forcing its hand yet. This is the part Brazilian companies most often get wrong. The EU AI Act is not Brazilian law and never becomes Brazilian law; there is no Brazilian application date and no Brazilian "AI Act competent authority" to register with. But Article 2 gives Regulation (EU) 2024/1689 deliberate extraterritorial reach, and it catches Brazilian providers and deployers the moment they place an AI system on the EU market or their system's output is used in the Union.

Brazil's own AI bill is closer to the EU model than most, which makes it tempting to assume the two will line up. They will not — not until Brazil's bill is law, and not even then automatically. For a Brazilian company touching the EU market, Article 2 is the entire and permanent basis on which the Act binds you, independent of where PL 2338/2023 lands.

---

Brazil is a third country: the Act never becomes Brazilian law

Brazil is not an EU Member State and not part of the European Economic Area (EEA). No mechanism — no transposition, no EEA incorporation — turns Regulation (EU) 2024/1689 into Brazilian federal law. So the only question that matters for a Brazilian company is the extraterritorial one: does your activity bring you within Article 2?

Brazil's own AI bill is EU-inspired but not yet enacted

Brazil is drafting a risk-based AI framework that openly echoes the EU model. PL 2338/2023, the Marco Legal da Inteligencia Artificial, was approved by the Federal Senate on 10 December 2024 and, as of mid-2026, is pending in the Chamber of Deputies (Camara dos Deputados), where committee review and amendments continue — including debate over biometric-surveillance carve-outs. It is not yet enacted: to take effect it must pass the Chamber and receive presidential sanction. Treat PL 2338/2023 as advanced but pending, not enacted.

Separately, the Lei Geral de Protecao de Dados (LGPD) — Brazil's GDPR-style data-protection statute, supervised by the ANPD (Autoridade Nacional de Protecao de Dados) — is in force and governs the personal-data dimension of AI today. The LGPD is real and binding; PL 2338/2023 is not yet. Neither satisfies the EU AI Act, and the EU AI Act satisfies neither. A Brazilian company selling into the EU faces both pictures in parallel — treat the Brazilian side as fast-moving and a matter for separate Brazilian counsel.

No Brazilian application date to wait for

For an EU company the Act applies on fixed EU calendar dates. For a Brazilian company those dates are not a domestic switch-on; they are simply the dates on which Brazilian companies already in scope through Article 2 must comply. There is no separate "Brazilian date" under the EU AI Act, and PL 2338/2023, once in force, will run its own Brazilian timeline — a parallel regime, not the EU's.

---

Article 2: the two limbs that catch Brazilian companies

Article 2 sets the Regulation's scope, written to reach beyond EU borders precisely so non-EU providers cannot undercut EU ones by staying offshore.

Placing AI on the EU market (Article 2(1)(a))

Under Article 2(1)(a), any provider that places an AI system on the EU market or puts it into service in the Union is in scope, regardless of where it is established. A Brazilian company that sells, licenses, or otherwise makes its AI product available to customers in Portugal, Spain, or Germany is caught — incorporation in Sao Paulo and servers in Brazil change nothing.

Output used in the Union (Article 2(1)(c))

Under Article 2(1)(c), a provider or deployer established in a third country is in scope where the output of the AI system is used in the Union. Brazilian companies already know this logic from the LGPD's own extraterritorial reach: the test is where the effect lands, not where the company or server sits. A Brazilian firm whose model scores, ranks, or generates content about people in the EU is caught on this limb even with no EU customer contract.

The authorised-representative obligation (Article 22)

A Brazilian provider of a high-risk system must, before placing it on the EU market, appoint an authorised representative established in the Union under Article 22 — a designated in-Union point of contact and accountability, not a full office. This parallels the EU-representative structure Brazilian exporters may already meet under the GDPR (GDPR Article 27), but it is a separate appointment under a separate statute.

---

Timeline: the EU dates apply to in-scope Brazilian companies

There is no separate Brazilian date under the EU AI Act. A Brazilian company in scope through Article 2 plans against the EU statutory calendar.

The Digital Omnibus high-risk deferral

The Digital Omnibus on AI is law: Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. Stand-alone Annex III high-risk obligations apply from 2 December 2027, and product-embedded Annex I high-risk obligations from 2 August 2028 — one legal date for each, written into the amended Regulation. The Commission's original proposal would have tied the delay to standards availability; the adopted text uses fixed calendar dates.

What did not move

Article 5 prohibitions and Article 4 literacy have applied since 2 February 2025; GPAI obligations under Articles 51-55 since 2 August 2025. For Brazilian foundation-model or GPAI providers placing models on the EU market, the GPAI duties are live now — and models on the EU market before 2 August 2025 have until 2 August 2027 to comply under the transitional provision.

---

What in-scope Brazilian companies actually have to do

The obligations are the EU obligations

Because the Act binds through Article 2 rather than any Brazilian transposition, an in-scope Brazilian provider or deployer faces the same role-based duties as an EU company. There is no Brazil-lite version, and meeting PL 2338/2023 once it is law will not discharge the EU duties. The roles map identically: provider, deployer, importer, distributor — with importer duties at Article 23 and distributor duties at Article 24.

The Article 25 role-shift

A deployer, distributor, or importer becomes a provider under Article 25 the moment it puts its own name or trademark on a high-risk system, substantially modifies it, or changes its intended purpose. A Brazilian company that fine-tunes a base model into a new high-risk purpose, or rebrands a high-risk EU tool, can inherit the full provider stack without realising it.

High-risk duties and penalties

For a stand-alone Annex III high-risk system, the provider stack applies in full: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness (Articles 9-15), conformity assessment, the Article 49 registration, and provider obligations under Article 16. Penalties are the Article 99 tiers — identical figures, calculated on worldwide turnover, not EU or Brazilian revenue: up to EUR 35 million or 7% for Article 5 breaches (Article 99(3)); up to EUR 15 million or 3% for most other obligations including high-risk provider duties (Article 99(4)); up to EUR 7.5 million or 1% for supplying incorrect or misleading information (Article 99(5)). For SMEs, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. The third tier is 1%, never 1.5%. Separately, GPAI model providers are fined by the Commission under Article 101 (up to EUR 15 million or 3%), not under Article 99.

---

Worked example: a Sao Paulo fintech offering AI credit scoring into the EU

CredFacil Tecnologia Ltda is a roughly 130-employee Sao Paulo fintech with around EUR 20 million in annual revenue. It sells an AI creditworthiness-scoring model, and a Portuguese consumer-lender licenses it to assess applicants in Portugal.

Why CredFacil is in scope now

As a provider placing the system on the EU market, CredFacil is in scope under Article 2(1)(a) today — no EU office required, the absence of a European entity irrelevant. Its model is high-risk under Annex III point 5 (access to essential private services — creditworthiness assessment and credit scoring of natural persons, excluding fraud detection), which triggers the full provider stack under Articles 9-15. Even without a direct EU contract, Article 2(1)(c) can catch it where the score is used to decide on people in the Union.

The FRIA dimension

Because creditworthiness scoring (Annex III point 5(b)) is one of the use cases that triggers the Article 27 Fundamental Rights Impact Assessment for deployers, CredFacil's EU lender-customers will need a FRIA — and they will expect CredFacil, as provider, to supply the technical and risk information that feeds it. Building that information into the compliance file up front is what keeps a Brazilian provider sellable into the EU credit market.

CredFacil's pre-market checklist

• Appoint an Article 22 authorised representative established in the Union before placing the model on the EU market.
• Build the Article 11 / Annex IV technical documentation and the Article 47 / Annex V EU declaration of conformity.
• Run the conformity assessment and register the system under Article 49.
• Support EU deployer-customers' Article 27 FRIA with the provider-side information they need.
• Note the exposure: a high-risk provider breach sits in the Article 99(4) tier. As an SME, CredFacil benefits from the Article 99(6) cap at the lower of the fixed amount or the percentage, so 3% of roughly EUR 20 million revenue is the operative ceiling, not the EUR 15 million figure.
• Keep Brazilian obligations — the LGPD now, PL 2338/2023 if and when it becomes law — running in parallel; the EU file does not discharge them, and vice versa.

---

What Brazilian companies should do now

Map your EU exposure, not your Brazilian status

Do not start from "are we covered under Brazilian law?" Start from "do we touch the EU market?" If you place AI on the EU market or your output is used in the Union, the EU timeline binds you through Article 2 — independent of where PL 2338/2023 sits in Congress.

A five-step starting checklist

1. Map your AI systems against Article 2 to confirm where you place systems on the EU market or your output reaches the Union.
2. Classify each system: clear the Article 5 prohibited-practice gate first, then assess Article 6 / Annex III for high-risk status.
3. Assign roles — provider, deployer, importer, distributor — and run the Article 25 conversion check on anything you rebrand, fine-tune, or repurpose.
4. For high-risk systems, appoint an Article 22 authorised representative in the Union before market placement.
5. Build the compliance file: risk management, Annex IV documentation, conformity assessment, and the Annex V declaration of conformity — and keep your Brazilian obligations running in parallel.

Two developments to monitor

Track two moving pieces for legal review: EU implementing guidance for the high-risk regime (the Commission's draft Article 6 classification guidelines of May 2026, and harmonised standards still being finalised), and PL 2338/2023's passage through the Chamber of Deputies — which, once in force, will add a separate Brazilian regime but will not displace the EU AI Act's extraterritorial reach. A risk-based Brazilian framework may ease the operational lift, but the two compliance files remain distinct.

How Confir helps Brazilian companies

Confir derives your provider, deployer, importer, or distributor role and classifies your systems under Articles 5 and 6 with Annex III logic from plain-language intake. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same audit-defensible finding with a human-readable explanation of which rule fired.

Confir generates the Article 11 / Annex IV technical-documentation pack and the Article 47 / Annex V declaration of conformity, and supports the Article 27 Fundamental Rights Impact Assessment where it applies — directly relevant to Brazilian providers of credit-scoring models. The aim is to give a Brazilian company an EU-market compliance file that stands on its own, separate from the LGPD and from PL 2338/2023. The GPAI workflow (Articles 51-55) is partial and on the roadmap, not presented as complete. Confir is EU-hosted, at confir.eu.

Related guides

• EU AI Act for US companies: extraterritorial reach
• EU AI Act extraterritorial reach for non-EU companies
• EU AI Act scope explained (Article 2)
• Article 27 FRIA explained
• EU AI Act deadlines and application dates