AI Governance Policy, which is a mandatory standard that covers: a) AI ethical principles; b) rules related to privacy, transparency, accountability, human autonomy, robustness, security, and intellectual property; c) an AI risk management process; d) an AI governance process which that adds an AI Ethics Committee to the IT governance process, with new roles and responsibilities. It is intended to maximise AI benefits and minimise risks in legislative and administrative and legislative dimension
Name in original language
Política de Governança de Inteligência Artificial na Câmara dos Deputados
Initiative overview
Beyond an AI policy, this Artificial intelligence governance is integrated into the corporate governance, the IT governance, the data governance with a view to ensuring that the use, development, contracting, and implementation of AI systems occur in an ethical, secure, transparent, responsible manner, and aligned with institutional purposes. The AI Governance Policy aims to:
- a) ensure that the use of AI is guided by ethical principles, including good faith, legitimate purpose, transparency, data protection, non-discrimination, fairness, security, robustness, human oversight, and respect for the integrity of results;
- b) guarantee that AI systems are not developed, contracted, or used without observing formal mechanisms for risk assessment, continuous supervision, and traceability;
- c) ensure that any AI system strictly observes applicable legislation, especially the Brazilian Data Protection Law, internal data protection, information security, and IT governance standards;
- d) establish formal processes for authorisation, supervision, documentation, monitoring, and decommissioning of AI systems, considering the entire lifecycle;
- e) regulate the use of generative AI, including requirements for prompts, instructions, autonomous or semi-autonomous agents, usage standards, and human review mechanisms;
- f) ensure that personal data and data with restricted access are only processed by AI systems as authorised by the competent managers, prohibiting misuse, unnecessary use, or use in computing environments that compromise the security, privacy, or sovereignty of the data;
- g) prohibit the use of AI systems that produce discriminatory, harmful, biased, illegitimate results, or results incompatible with the institutional purposes of the Chamber of Deputies;
- h) ensure that users are informed when interacting with AI agents;
- i) establish mechanisms for continuous supervision of AI systems, including monitoring of failures, security incidents, biases, hallucinations, inconsistencies, and unexpected behaviours;
- j) ensure that business managers, data managers, technical areas, and competent collegiate bodies act in accordance with defined roles and responsibilities.
Other relevant details
The AI governance model, established at the Brazilian Chamber of Deputies, includes an Ethics Committee on the use of AI, integrated with the IT Steering Committee and the Strategic Management Committee of the Chamber of Deputies. Additionally, the defined AI risk management process encompasses risk assessments conducted in three phases of an AI system's lifecycle: a) before authorisation to initiate an AI project; b) during the development/implementation of an AI system; and c) after the AI system becomes operational (in continuous monitoring).
Results, outcomes and impacts: One expects to ensure that innovation occurs safely, transparently, and aligned with public administration values and democracy. Expected results include: strengthening the legislative process through responsible AI deployment in parliamentary activities; defining responsibilities and creating coordination mechanisms between technical areas; protecting fundamental rights and data privacy in legislative operations; establishing ethical standards for AI use in lawmaking and parliamentary oversight; positioning the Chamber as a reference among world parliaments in AI use.
Challenges and lessons learned: Initially, we only intended a policy with practices for the responsible use of AI. But throughout the discussions, we realised that much more than just a list of ethical principles to be followed was needed. We needed a set of governance and risk management processes with well-defined roles and responsibilities.
