Brazil’s Secretaría Especial de la Receita Federal de Brasil adopted Ordinance (Portaria) RFB No. 647 of February 5, 2026, published in the Official Gazette on February 12, 2026, establishing a comprehensive Artificial Intelligence (AI) Policy within the institution.

The regulation defines principles, governance structures, risk management procedures, and technical safeguards for the development, procurement, deployment, monitoring, and decommissioning of AI systems. It reinforces mandatory human oversight, ensuring that AI solutions support — but do not replace — legally assigned decision-making powers of public officials.

The ordinance introduces structured AI governance through a tripartite decision model (business, technical, and strategic/ethical oversight), mandatory risk classification, traceability and audit requirements, and enhanced controls for generative AI systems, including the appointment of designated curators responsible for monitoring accuracy, bias, and potential hallucinations. Additionally, the regulation prioritizes AI model sovereignty, cybersecurity safeguards, data protection compliance, and strict limitations on the use of personal and confidential data in AI systems, particularly in external or non-sovereign environments.

While the measure does not establish product-specific technical standards, it creates a robust public-sector AI governance framework that significantly impacts institutional IT infrastructure, third-party AI contracting practices, compliance procedures, and internal digital transformation strategies within Brazil’s federal tax administration.

Why?

The Ordinance establishes a comprehensive and binding Artificial Intelligence governance framework within Brazil’s Federal Revenue Service. It introduces mandatory human oversight, formal risk classification, auditability, traceability, model sovereignty requirements, and strict controls on the use of personal and confidential data.

The regulation significantly affects:

• Development, procurement, and deployment of AI systems
• Use of generative AI tools
• Contractual obligations with third-party AI providers
• IT infrastructure governance and cybersecurity controls
• Institutional compliance and internal accountability structures

Although it does not impose product-level technical certification requirements (e.g., telecom, EMC, RF, etc.), it fundamentally restructures AI governance, risk management, and operational controls within a major federal authority.

Who?

• Public officials and employees of the Federal Revenue Service
• IT and cybersecurity departments
• AI developers and data science teams
• Third-party AI solution providers and contractors
• Legal and compliance teams
• Vendors offering cloud-based or external AI models
• Internal audit and risk management units

Conclusion

This represents a high-impact regulatory development in Brazil’s public-sector digital governance framework. It formalizes institutional AI oversight, strengthens accountability and data protection controls, and imposes structured compliance obligations across the AI lifecycle. While it does not introduce market access barriers or certification requirements for commercial devices, it significantly influences public-sector AI procurement, deployment strategies, cybersecurity posture, and contractual models with AI technology providers.