THE COST OF WAITING FOR ARTIFICIAL INTELLIGENCE REGULATION

The corporate interpretation was immediate and predictable, summarized in the idea that companies had gained more time. This conclusion, however, is mistaken, and the cost of this misunderstanding tends to emerge first in contracts and only later in the regulatory sphere.

Five days later, on August 2, two sets of obligations entered into force without any postponement. On one hand, Article 50 of the AI Act imposes transparency obligations on systems that interact directly with natural persons, generate synthetic audio, image, video, or text, perform emotion recognition or biometric categorization, or produce deepfakes and content intended to inform the public on matters of general interest.

On the other hand, the European Commission began fully exercising its enforcement authority over providers of general-purpose models, with fines that may reach 3% of worldwide annual turnover or €15 million, whichever is greater. The obligations applicable to those providers have been in force since August 2025, lacking only the effectiveness of the sanctioning power. The Omnibus postponed what is most complex and costly to implement but fully preserved what can already be supervised, clearly revealing European regulatory priorities for the next eighteen months.

In this scenario, three aspects of the new regulation affect platforms in a particularly relevant manner.

The first is institutional in nature, as the AI Office has assumed exclusive supervisory authority over artificial intelligence systems integrated into or forming part of very large online platforms and search engines designated under the Digital Services Act, replacing the dispersion of national authorities with a single supervisor empowered to directly impose sanctions.

The second concerns the regulatory timeline, since machine-readable labeling of synthetic content was postponed until December 2, 2026 only for systems already placed on the market before August 2, meaning that new products are born subject to the obligation.

The third is substantive in nature, since beginning on December 2, 2026, Article 5 will encompass two new prohibited practices related to the generation or manipulation of non-consensual intimate images and child sexual abuse material. In this context, those who make generative functionalities available to users cease to occupy merely the position of hosting providers and become exposed to the most severe sanctioning regime of the regulation, which may reach 7% of worldwide turnover.

It should be emphasized that none of this depends on a company being established within the European Union. This is because the AI Act applies to providers and deployers located in third countries whenever the output produced by the system is used within European territory. Thus, a Brazilian platform whose recommendation system, automated moderation system, or conversational agent serves European users falls within the regulatory perimeter, even if it does not have a single employee on the continent.

That said, within the domestic sphere, the regulatory scenario proves considerably more challenging than the narrative currently prevailing in the market suggests.

At present, Bill No. 2,338/2023 remains before the Chamber of Deputies, awaiting the opinion of the rapporteur in the Special Committee, after having been forwarded by the Senate in March 2025, subjected to twelve public hearings, supplemented by thirty-five attached proposals, and repeatedly included in voting agendas that ultimately did not materialize.

Should the Chamber introduce amendments to the substitute bill, as the direction of legislative debate suggests, the matter must return to the Senate for further consideration. Added to this, the electoral context contributes to increasing uncertainty regarding the conclusion of the legislative process, which is why any compliance strategy based on the expectation of approval of future Brazilian legislation remains dependent on a variable outside the control of the private sector.

The absence of specific legislation does not mean the absence of regulatory obligations, a perception that still persists in part of the private sector, particularly because the Brazilian Supreme Federal Court, when ruling on Themes 987 and 533 on June 26, 2025, with effectiveness beginning on August 5 of the same year, declared the partial and progressive unconstitutionality of Article 19 of the Brazilian Civil Rights Framework for the Internet and established a new platform liability regime that, although not expressly referring to artificial intelligence, already produces concrete effects on the use of algorithmic systems and automated moderation, recommendation, and content-distribution mechanisms.

Two aspects of the thesis adopted by the Supreme Court deserve special attention, since Item 4 establishes a presumption of liability, regardless of prior notice, for unlawful content disseminated through advertisements, paid promotions, or artificial distribution networks operated by chatbots and robots, excluding liability only where diligent action within a reasonable period can be demonstrated, while Item 5 imposes a duty of care requiring immediate removal of content involving an exhaustive list of serious crimes, likewise without requiring prior notice, whereas Item 11 excludes strict liability, making proof of diligence the central element for determining platform responsibility.

The ruling also requires providers to maintain a legal representative based in Brazil with full authority to respond before administrative and judicial authorities, including regarding the provision of information concerning content moderation rules, transparency reports, monitoring and management of systemic risks, user profiling, advertising, and paid promotions, establishing an informational duty that directly impacts the governance and operation of algorithmic systems employed by platforms and whose observance is already in force.

Added to this framework are Law No. 15,211/2025, which established the Digital Statute for Children and Adolescents and has been in force since March 17, 2026, including its application to foreign providers whose services are available within Brazilian territory, and Article 20 of Brazil’s General Data Protection Law (LGPD), which guarantees data subjects the right to review automated decisions affecting their interests.

The result is a regulatory environment sufficiently dense to require robust governance structures, such that any future artificial intelligence legislation tends to consolidate obligations that already exist rather than truly creating new ones.

A frequently overlooked regulatory tension therefore emerges, because the duty of care presupposes proactive detection mechanisms that, at scale, depend on the use of artificial intelligence. The same systems employed in content moderation simultaneously trigger the right to review established under the LGPD and, for European users, the transparency and governance obligations established by the AI Act, meaning that the obligation to use the technology and the obligation to govern it become concentrated within the same organizational structure.

The practical consequence is that the most immediate challenge facing platforms is not regulatory, but contractual, because these companies simultaneously operate as deployers of models developed by third parties and as providers of artificial intelligence systems to their own users, accumulating distinct functions within the technological chain and requiring an appropriate allocation of risks, liabilities, and obligations in each of these relationships.

In supplier relationships, most cloud computing, licensing, and API access agreements were entered into before the consolidation of the regulatory debate surrounding artificial intelligence and still fail to adequately address the matter, failing to define the parties’ positions within the technological chain, ensure access to technical documentation necessary for regulatory compliance, provide effective audit mechanisms, and allocate risks related to administrative sanctions, content-removal orders, and copyright disputes involving training data.

Even where liability clauses exist, economic exposure often remains limited to amounts paid during the previous twelve months, making contractual protection largely irrelevant in the face of sanctions calculated on global revenue.

In relationships with users, the primary instrument remains the terms of use, which are often more outdated than the supplier agreements themselves. The transparency obligations established in Article 50 of the AI Act fall directly upon the platform, while age-verification requirements and account-linking obligations involving legal guardians imposed by the Digital Statute require modifications to the product itself, in addition to due process guarantees and appeal mechanisms arising from the Supreme Court’s holding, which must be formally established in enforceable instruments vis-à-vis users, a circumstance that significantly reduces the evidentiary utility of terms drafted before these requirements existed.

There is also a frequently overlooked weakness in contracts dealing with data processing, which rarely regulate adequately the use of user and customer information for training or retraining models, fail to define specific legal bases for such purposes, and do not ensure the transfer of these obligations to subprocessors and providers situated at earlier levels of the technological chain, creating a silent exposure that generally becomes visible only during audits, investigations, or litigation.

From the governance perspective, some measures must precede any more sophisticated discussion, beginning with the complete mapping of artificial intelligence systems used by the organization, whether proprietary or provided by third parties, including those contracted directly by business units without the participation of technology, risk, or compliance functions, since it is impossible to assess, classify, or mitigate risks associated with systems whose existence has not even been formally identified.

The second measure consists of classifying each system under applicable regulatory frameworks, particularly European and Brazilian regimes, through formally documented analyses capable of being reused, preventing the legal classification from having to be rebuilt with every new demand. The third concerns the express designation of individuals responsible for decisions and controls adopted, since collective structures without clearly identified individual responsibilities tend to generate records and procedures but rarely ensure adequate accountability and governance effectiveness.

The common element among these measures is their evidentiary function because, since the Supreme Court rejected strict liability, platform liability has become largely dependent upon the ability to demonstrate diligence, the effectiveness of self-regulatory mechanisms, and compliance with the additional duties imposed by the Court.

In this context, the governance dossier ceases to occupy a merely accessory position within compliance structures and becomes a central defense instrument, which is why it must be developed continuously and before potential disputes arise, since records created only after litigation emerges tend to possess reduced evidentiary effectiveness.

This same body of documentation simultaneously satisfies requirements imposed by European authorities and informational duties imposed upon the legal representative in Brazil, creating one of the rare situations in which a single investment in governance and compliance generates regulatory gains usable across more than one jurisdiction.

With respect to timing, the postponement introduced by European regulators provides a considerably smaller window than is generally assumed, particularly because conformity assessment processes, preparation of technical documentation, implementation of human oversight mechanisms, and adaptation of supply chains frequently require periods exceeding sixteen months, especially when they depend upon third parties.

Added to this is the need for contractual renegotiation, whose effectiveness is directly related to timing, since suppliers currently still have incentives to negotiate audit clauses, guarantees, and indemnification provisions, a scenario that is likely to become significantly less favorable as regulatory deadlines approach and demand for the same contractual adjustments increases.

The central question for organizations is no longer whether artificial intelligence regulation will exist, but rather who will bear the risks and costs arising from its use, a matter that unfolds primarily in the contractual sphere and is already being defined through the agreements that continue to be negotiated and executed, often because of the absence of adequate provisions governing the allocation of responsibilities.

Available at: https://www.congressoemfoco.com.br/artigo/122452/o-custo-de-esperar-pela-regulacao-da-inteligencia-artificial