In 2026, two pieces of AI regulation news sounded like relief to anyone running a company. In Brazil, the rapporteur of the national AI bill in the Chamber of Deputies said the vote will wait until after the October elections. In Europe, the deadline for the heaviest rules of the AI Act was pushed from August 2026 to December 2027.
It looks like time gained. It isn’t. What was postponed is the part of the law that says how to prove you use AI responsibly. Liability for an automated decision that harms someone already exists today. And the homework these laws will demand takes months, because it depends on something almost no company has: knowing exactly where it uses AI.
What was actually postponed
Bill 2338/2023, Brazil’s AI legal framework, was approved by the Senate on December 10, 2024, and has been in a special committee of the Chamber since 2025. A vote was expected in the first half of 2026. On August 24, the rapporteur, Congressman Aguinaldo Ribeiro, said the vote will come after the elections (Bairo Gonzalez). If the Chamber changes the text, it goes back to the Senate. In other words: there is no date, and the final text can still change.
In the European Union, the package known as the Digital Omnibus entered into force on July 27, 2026, and postponed the obligations for high-risk systems: from August 2, 2026 to December 2, 2027 for the uses listed in Annex III of the AI Act, such as recruitment, credit and education, and to August 2, 2028 for AI embedded in regulated products (Usercentrics). This matters to any company selling into Europe: the AI Act applies to whoever places AI on the European market, wherever they are based.
What was not postponed
The list of what still applies is longer than the headlines suggest:
- Data protection law, already in force. In Brazil, article 20 of the LGPD gives anyone the right to request a review of decisions made solely on the basis of automated processing of personal data, including those that define a professional, consumer or credit profile, and requires the company to disclose the criteria used. Europe’s GDPR has an equivalent rule in article 22. Together they cover much of what is now called “AI that decides”. Under the LGPD, fines reach 2% of revenue, capped at R$ 50 million per violation.
- Under the AI Act, the prohibitions have applied since February 2025 and the rules for general-purpose models since August 2025. The transparency obligations of article 50, such as telling people they are talking to an AI, were not postponed.
- Ordinary liability. Consumer protection, labor law and contracts do not wait for an AI-specific law. If the chatbot promises a deadline the company doesn’t meet, the company answers for it, not the model.
Why waiting for the law is the mistake
The reason lies in how these laws are designed. Both Bill 2338 and the AI Act classify risk by use, not by tool. The same language model is low risk when it summarizes meeting minutes and high risk when it screens résumés — recruitment appears among the high-risk uses in the text approved by the Brazilian Senate and in the European Annex III. The tool is the same. What changes is who is affected by the answer.
That has a practical consequence: no company knows its exposure until it knows where it uses AI. And that map rarely exists. Let’s imagine a distributor with 80 employees. Finance uses an assistant to prioritize collections. HR pastes résumés into a chatbot to do the first screening. Sales has an assistant that suggests discounts per customer. Nobody decided any of this in a meeting. Each department solved its own problem with whatever tool was at hand — the same pattern behind what is now called shadow AI.
Of the three uses, two decide something about a person using personal data: who gets to the interview and who pays more. Both are already covered by data protection law today. And if a candidate asks for the decision to be reviewed, the company needs to be able to explain the criteria. With a prompt nobody saved, in a chatbot someone uses on a personal account, that is impossible.
As João Paulo Batistella, an innovation executive, argues, deciding how AI enters the business is a matter for the CEO and the board, not for IT. Regulation is the clearest case of that thesis: the question “where does our AI decide something about someone?” cuts across HR, sales, finance and customer service, and none of those areas answers for all of them. His summary applies to the legal side too: AI executes, humans are accountable.
Where to start: three steps before the law
1. Take an inventory of uses. A spreadsheet is enough. For each AI use in the company: which department, which tool, what data goes in, what comes out and who acts on it. Ask the teams. Don’t ask only IT, because much of the real usage never goes through it.
2. Classify by effect on people, not by technology. Two questions split the uses into four groups:
- Uses personal data and decides something about someone (hiring, credit, individual pricing, collections): top priority. This is where the high risk of any law lives, and where data protection law already applies today.
- Uses personal data but doesn’t decide (service summaries, draft emails to customers): take care of the legal basis, where the data ends up and who has access.
- Decides, but without personal data (inventory forecasting, routing): business risk, not third-party rights. Test quality before granting autonomy.
- Neither (brainstorming, internal copy editing): a clear usage policy is enough.
3. For the first group, design human review and record-keeping. Who can reverse the AI’s decision? Where are the criteria and the version of the prompt or model stored? How long does it take to answer a review request? It’s the same reasoning as the panic button: the moment a human takes over has to exist before the first case, not after.
The limit of this advice
None of this means stopping AI use or building a compliance department the company can’t afford. For most small and mid-sized companies, the inventory fits in an afternoon and shows that only two or three uses fall into the critical group. The text of Bill 2338 can still change in the Chamber, and the details of the obligations will depend on regulation. So it makes no sense to spend now on compliance with articles that may not survive the vote. It does make sense to know your own usage, because that part holds for any version of the law, and for the data protection law already in force.
The delay didn’t change the risk. It only changed the date when someone will ask you to show that you managed it.
For more analysis on AI, management and the changing rules of the game, follow @ElevaTechno on X, @elevatechnologies on Instagram or Eleva Technologies on LinkedIn, or learn more about the group at elevatec.net/about.
