Alkemia
Alkemia Insights · Enterprise AI

The human review Brazilian law
chose not to require.

LGPD Article 20 is not a Brazilian version of European Article 22. It gives people a right to request review, but removed the requirement that a natural person conduct it. Without that floor, an agent’s autonomy limit is the company’s own delegation decision.
LGPD, Article 20 · operative text as of 12 August 2026
Discuss your decision → See the 6 checks
The inversion

The original LGPD text said a data subject could request review “by a natural person”. Provisional Measure 869/2018 removed those words. Law 13,853/2019 kept them out of the operative text. The cited legal commentary records that a paragraph approved by Congress would have restored human review, but was vetoed at enactment. Technical Note 12/2025 also records contributions that read the exclusion as deliberate. That is a public record of disagreement in the market, not the ANPD’s position. The note itself says the consultation does not represent the Authority’s final position.

The analogy that changes the outcome

Two rights, two architectures.

Brazil

Right to request review

  • A decision made solely through automated processing
  • A decision affecting the data subject’s interests
  • No express requirement for a human reviewer
  • Criteria and procedures disclosed when requested
European Union

Right not to be subject

  • A solely automated decision with legal or similar effects
  • Exceptions for contract, law and explicit consent
  • Human intervention among safeguards for two exceptions
  • Additional information and objection rights

Using European Article 22 as a shortcut adds a safeguard the Brazilian text does not contain. It may produce a prudent policy. It does not accurately describe the choice made by the LGPD.

What changes in operations

Without a statutory human floor, governance carries the weight.

  1. A

    Delegation stops being a compliance answer

    With no statutory human floor, the organization chooses the autonomy limit.

    The operative text protects the right to request review of decisions made solely through automated processing that affect a data subject’s interests. It does not say who must conduct that review. For agents able to recommend, approve, deny or prioritize, the decisive question becomes internal: which decisions may run without a human checkpoint, under which criteria and with which escalation path.

    Compliance does not answer that question. The board and management must answer it before the system does.

  2. B

    The review right needs an operable route

    A right without a channel, owner and timetable does not reach operations.

    The data subject has a right to request review. The organization therefore needs to know which systems make solely automated decisions about people, where a request enters, who receives it, how the decision is reassessed and how the result returns to the affected person. Article 20 does not supply that workflow. Without an operating design, the company invents it during the first contested case.

    A generic privacy inbox is insufficient. The route must reach the decision, its context and an owner able to reopen it.

  3. C

    Explanation depends on records created before a contest

    Criteria and procedures cannot be reconstructed after the request.

    Paragraph 1 requires clear and adequate information about the criteria and procedures used. In the consultation consolidated by Technical Note 12/2025, contributors converged on six parameters: clarity, objectivity, proportionality, purpose and legal basis, accessibility, and documentation produced during development. They also converged on explaining normative logic, not necessarily technical logic.

    That convergence is a market signal, not a legal requirement. Paragraph 2 remains the statutory control: a refusal based on trade secrecy may trigger an ANPD audit of discriminatory aspects.

The statute and comparative sources are listed below.

In Brazil, the decisive question is who defined how much the system may decide.

Alkemia reading

Why this matters

Compliance does not set your agency limit.

When the statute does not impose a human checkpoint, every autonomy band reflects a business choice. Materiality, reversibility, impact on people, stop authority and evidence requirements must be decided before deployment. Leaving those limits implicit hands the decision to vendor design, product settings or the agent’s emergent behavior.

This does not mean human review is always necessary, or that Article 20 covers every use of AI. The point is narrower: the statute does not provide the human floor many policies assume. A company may choose a stronger control. It should recognize that the choice is its own, document it and validate it legally for the concrete system.

What is moving through Congress

Human review is resurfacing through AI and consumer law.

Neither text is in force. They show the routes through which a duty could arrive without changing what Article 20 requires today.

  1. 01

    AI framework: a right bounded by high-risk scope

    The text received by the Chamber on 17 March 2025 would add rights to explanation, contestation and human review.

    In Bill 2338/2023, those rights sit in the section for people or groups affected by high-risk systems. Human review is qualified by context, risk and the state of the art. For public administration, the text would also provide facilitated and effective access to explanation and human review when decisions have relevant legal effects or significantly affect the person’s interests.

    This is a bill, not operative law. Its scope and qualifiers prevent reading it as a general mandate for every automated decision.

  2. 02

    Consumer law: review paired with strict liability

    An appended bill moves the control into consumer relationships.

    Bill 762/2026 would require, for consumer relationships involving high- or critical-level AI with significant effect, effective human-review channels for decisions that may cause harm. The next item would impose strict liability for damage caused by defects in design, implementation or operation. The bill also provides for a human-review mechanism for automated decisions that may cause significant harm.

    Since 23 March 2026, the bill has proceeded as an appendix to Bill 7132/2025 in the package received by the Special Committee on Bill 2338/2023. It is input to that proceeding, not a standalone vehicle or an operative duty. Its proposed LGPD amendment creates Article 4-A and does not change Article 20.

As of 17 June 2026, the Chamber record listed 382 proceeding events for Bill 2338/2023. None was a committee report or substitute text; 329 (86%) were requests filed or approved, and one was a rapporteur designation. This measures the record, not future inactivity. Scheduling readiness for “when the bill passes” relies on a date the official proceeding does not provide.

For a board, the heavier economic exposure in Bill 762/2026 lies beyond the review right: the proposed strict liability for defects in design, implementation or operation.

What to instrument

Six checks for your AI inventory.

  1. 01

    Solely automated decisions

    Which systems decide solely through automated processing and affect people’s interests? Separate decision support from the final decision. Article 20 addresses the latter.

  2. 02

    Approved autonomy band

    For each system, what level of agency was authorized, by whom and under which limits? Set human checkpoints by materiality, reversibility and impact, not by an imported regulatory analogy.

  3. 03

    Review request channel

    Can the affected person identify the decision, request review and receive an answer? Name the entry point, case owner, internal timetable and response route.

  4. 04

    Recorded criteria and procedures

    Does the inventory point to the version of the criteria, rules, models and procedures used? A general AI policy does not explain a concrete decision.

  5. 05

    Trade-secret treatment

    Who decides to restrict an explanation on commercial or industrial secrecy grounds? Record the basis, what can still be disclosed and the exposure to an audit of discriminatory aspects.

  6. 06

    Escalation and non-delegation

    Which decisions remain human without an express statutory mandate? The agency limit is a governance decision. It should not be delegated to the system or inferred from vendor settings.

This is a governance instrument, not a compliance determination. Article 20 applicability and the response design depend on the system and should be validated with counsel.

The next step

The governance question is “what did we decide?”.

For the board approving autonomy and the CIO accountable for the inventory, review starts with three records: the authorized agency band, the route through which a person contests a decision and the evidence of the criteria used. That design also lowers adaptation cost if either text advances. Reconstruction will fall on organizations that turned the absence of a statutory floor into implicit autonomy.

Discuss your decision

contact@alkemia.io

Sources

The thesis starts with the operative text.

Frequently asked questions

Automated decisions, in decision terms.

Does the LGPD require human review of automated decisions?
Not in the operative text. Article 20 gives the data subject a right to request review of decisions made solely through automated processing that affect their interests. The original wording said “by a natural person”. Provisional Measure 869/2018 removed that expression, and Law 13,853/2019 kept it out.
How is this different from the GDPR?
GDPR Article 22 structures a right not to be subject to a solely automated decision with legal or similarly significant effects. It sets exceptions and, in two of them, safeguards that include human intervention. Brazil’s Article 20 grants a right to request review without reproducing that human-intervention requirement.
Does Article 20 cover every AI-supported decision?
No. The provision addresses decisions made solely through automated processing that affect the data subject’s interests. Application to a concrete system depends on the facts, the decision flow and the legal context. Validate the classification with counsel.
Does trade secrecy allow a company to refuse any explanation?
Paragraph 1 requires commercial and industrial secrecy to be observed when information on criteria and procedures is provided. Paragraph 2 says that when refusal rests on those secrets, the ANPD may audit discriminatory aspects of the automated processing.
Does Technical Note 12/2025 state an ANPD position?
No. The note consolidates 124 contributions from the call for input. Its conclusion suggests using the document as input to the regulatory work and forwarding it to the Board’s Secretariat for information. The governing ANPD rule says a call for input does not represent the Authority’s final position.
Has the ANPD regulated Article 20?
On 12 August 2026, the official Regulatory Agenda still listed the Artificial Intelligence project as in progress, with attention to interpretive parameters for Article 20. This analysis does not predict what the ANPD will require.
Do the bills already require human review?
No. Bill 2338/2023 would create that right for people or groups affected by high-risk systems, qualified by context, risk and the state of the art. Bill 762/2026 is appended and would require human-review channels in consumer relationships involving high- or critical-level AI. Neither text is in force.
Where should a multinational operating in Brazil start?
Start with the inventory and decision rights. Identify systems that decide about people, record the approved autonomy, create the review route and link each system to its criteria-and-procedures record. Then validate the legal design of each concrete case.

This analysis offers governance criteria. It is not legal advice and does not determine the compliance of any system.

The text was checked against the consolidated wording of Law 13,709/2018, the comparative doctrine named in the sources, the full text of Technical Note 12/2025, the official texts and proceeding records of the bills cited, and the regulatory framework available on 12 August 2026. The note consolidates contributions and does not express the ANPD’s final position. The bills are not in force, and this analysis predicts neither their outcome nor what the ANPD will require.