PL 2338 and hospitality: what Brazil's AI bill means for hotels

Where PL 2338 stands in October 2026

PL 2338/2023, known in Brazil as the Marco Legal da Inteligência Artificial (the legal framework for AI), is not yet law. The current situation:

• Senate: approved on 10 December 2024.
• Chamber of Deputies: under review by a Special Committee, chaired by Deputy Luisa Canziani, with Deputy Aguinaldo Ribeiro as rapporteur. A plenary vote was at one point expected for the end of May 2026, but it did not happen, and the bill is still awaiting the committee's report.
• Next steps: if the Chamber changes the text, the bill goes back to the Senate before it can be signed into law by the President. After that, the text approved by the Senate provides for a transition period before most of the obligations take effect.

This article is based on the text approved by the Senate, which is the consolidated version available. Details such as lists of uses, deadlines and fine amounts may change in the Chamber. The core logic of the Senate text is an approach proportionate to the risk of each use of AI, but that structure may also still be changed as the bill moves through the Chamber.

What PL 2338 is, in a few words

The bill follows a model similar to the European AI Act: instead of regulating "AI" as a whole, it classifies each use of an AI system by level of risk and adjusts the obligations to that level.

• Excessive risk: prohibited uses, such as systems that exploit vulnerabilities or use subliminal techniques to induce harmful behaviour, and social scoring of citizens by public authorities. Remote, real-time biometric identification in public spaces is also restricted, with exceptions set out in law linked to public security.
• High risk: uses that are allowed, but with stronger obligations, such as an algorithmic impact assessment, human oversight and documentation. The list includes, for example, recruitment and decisions about employees, access to essential services, education, health and critical infrastructure.
• Other uses: follow general obligations of transparency, security and respect for the rights of the people affected.

The text approved by the Senate gives enforcement to the SIA, the national AI regulation and governance system, coordinated by the ANPD, the same authority that already enforces the LGPD (Brazil's data protection law) in hotels, together with each sector's regulators.

Why this matters for a hotel, and not only for those who build AI

The Senate text distinguishes three roles: whoever develops the AI system, whoever distributes it and whoever applies it in their own operation. In general, the hotel is the one applying it. Buying the tool from a supplier does not transfer all the responsibility to the supplier: the hotel decides what the AI is used for, about whom it makes or suggests decisions and with what data, and that is what defines the level of risk.

In practice, the same software can carry different risks in different hotels. A camera with video analytics that only counts people in the lobby is one thing; the same camera set up to identify guests by their faces is another.

Where each hotel use of AI tends to fit

The classifications below follow the text approved by the Senate, not a law in force. The final classification depends on the text that is approved and on later regulation, but the uses common in hospitality already allow an initial reading:

CV screening and HR decisions: high risk in the Senate text. This is the clearest point. The Senate text lists as high risk the AI systems used in recruitment, screening, filtering and assessment of candidates, and in decisions on promotion or dismissal. Hospitality hires in volume, with strong seasonality, and many recruitment platforms already offer automatic candidate ranking. If that classification stands, a hotel using this feature will need an impact assessment, effective human oversight of the decisions and an explanation to candidates when requested.

An example: the hotel uses a platform that receives 500 CVs for the season and automatically produces a list of the 30 "best-fit" candidates. Even if nobody is hired automatically, the tool is already influencing a decision about people, because whoever was left off the list will probably never be assessed by a human. That is why it should not be treated as a simple HR admin feature.

Facial recognition and biometrics: extra care. Facial recognition check-in, biometric access control to restricted areas and CCTV analytics that identify people sit in the most sensitive territory of the bill. Confirming that a guest is who they say they are, with their participation (one-to-one verification), tends to be treated very differently from identifying people in a crowd without them knowing. What defines the classification is the purpose and the way it is used, not the mere presence of biometrics. Regardless of PL 2338, biometric data is already sensitive personal data under the LGPD and requires a specific legal basis today.

Guest service chatbots and assistants: transparency. A chatbot that answers questions about breakfast times or takes bookings is not normally on the high-risk list. Even so, the Senate text provides for the right to know in advance that you are interacting with an AI. The conversation also involves personal data, so the rules on AI in guest service and the LGPD already apply now.

Revenue management and dynamic pricing: in principle, outside the high-risk list, with one caveat. The text approved by the Senate does not place rate suggestions based on occupancy, demand and competitors among the high-risk uses. The caveat is personalisation: if the price or offer starts to vary according to the individual guest's profile, the ban on discrimination comes into play, along with the right to review automated decisions that the LGPD already guarantees in article 20.

Generative AI in marketing and operations: obligations concentrated on the supplier. The rules on generative AI models and on the use of copyrighted content in training fall mainly on those who develop the models. For the hotel, the bigger risk is still the one we covered in our guide to AI governance in hospitality: guest data entered into unapproved tools.

The obligations likely to reach the hotel

Summarising the text approved by the Senate, these are the obligations most likely to affect a hotel in the role of the party applying AI:

• Preliminary assessment: classifying the risk of each AI system before putting it into use.
• Algorithmic impact assessment: mandatory for high-risk uses, with an analysis of the risks, the mitigation measures and the results.
• Human oversight: in high-risk uses, a person with the authority and real ability to review and reverse the AI's decision, not just rubber-stamp the result.
• Rights of the people affected: prior information about interacting with AI, an explanation of decisions, the right to challenge them and human review, especially for high-risk decisions.
• Documentation: records sufficient to show the authority how the system is used and overseen.

In the text approved by the Senate, the penalties include a warning, a fine of up to R$ 50 million per infringement or, for companies, up to 2% of the group's gross revenue in Brazil, capped at that amount, as well as publication of the infringement and suspension of the system's use. For many hotels, the most concrete risk is not the maximum fine; it is having to switch off, in a hurry, a tool the operation has come to depend on.

What already applies today: the LGPD

Waiting for PL 2338 to be approved before acting is a misreading, because an important part of what it requires already exists under the LGPD:

• Every AI tool that processes guest or employee data needs an appropriate legal basis. The role of each supplier (processor, controller or joint controller) depends on who defines the purposes and essential elements of the processing. When the supplier acts as a processor, the contract should set out the responsibilities and the terms of the processing.
• Biometric data is sensitive data, with narrower grounds for processing.
• Article 20 already guarantees the right to request a review of decisions taken solely on the basis of automated processing that affect the person's interests.
• The ANPD, which is expected to coordinate the SIA, already enforces the LGPD and applies penalties under it.

In other words, AI governance that is already based on the LGPD tends to cut down the adaptation work considerably when the AI law comes into force, although the bill brings requirements the LGPD does not have, such as the algorithmic impact assessment.

A checklist to prepare without waiting for the law

1. Build an AI inventory. List every tool with AI in use, including AI features built into systems the hotel already has (PMS, CRM, recruitment platform, CCTV) and unapproved tools used by the team.
2. Document each use. What each tool uses AI for, what data it receives, who has access and whether that data is used to train models or shared with third parties.
3. Classify each use by risk. Separate what involves decisions about people (HR, biometrics, personalised offers) from operational support with no individual impact.
4. Prioritise HR and biometrics. These are the uses most likely to fall into high risk. Check whether there is real human review and whether the legal basis for biometric data is documented.
5. Make AI visible to guests. Chatbots and assistants should identify themselves as AI and offer a route to a person.
6. Review supplier contracts. Ask for the system documentation, the supplier's own risk classification of its product and the split of responsibilities between the parties.
7. Name an owner. Someone with the authority to approve or veto uses of AI and to follow the bill's progress, normally whoever already answers for IT, security or compliance.

Next steps

PL 2338 may still change, but the direction of the text approved by the Senate is clear: the greater the impact of a use of AI on people, the greater the requirements. For hospitality, that points first to recruitment and biometrics, and then to transparency in guest service. Hotels that deal with the subject now, as a natural extension of the LGPD, will reach the transition deadline with an inventory ready instead of a problem.

Our team can map your hotel's uses of AI, classify each one by risk based on the bill as it stands and on the LGPD, and review contracts with AI suppliers. Talk to our team.

Official sources

• Federal Senate, PL 2338/2023: progress and text approved on 10 December 2024 (in Portuguese), senado.leg.br
• Chamber of Deputies, PL 2338/2023: progress record and Special Committee (in Portuguese), camara.leg.br