PL 2338 vs ISO 42001: what they share and how they differ
PL 2338 and ISO 42001 share 11 of 24 control themes and 9 checks. 46% of ISO 42001 requirements can be proven with checks PL 2338 already uses, 35% the other way round.
Under discussion
PL 2338
Preparing for the Brazil AI Bill (PL 2338/2023)
20 requirementsNext Oct 2026
Voluntary
ISO 42001
How to prepare for ISO/IEC 42001 certification
13 requirementsNext Dec 2026
11/24shared control themes
9shared checks
46%of ISO 42001 requirements covered by PL 2338 evidence
35%of PL 2338 requirements covered by ISO 42001 evidence
At a glance
| PL 2338 | ISO 42001 | |
|---|---|---|
| Jurisdiction | Brazil | International |
| Kind | Bill | Certifiable standard |
| Status | Under discussion | Voluntary |
| Binding | No same | No same |
| Object analysed | AI system | Organisation |
| Scope | Developers, distributors and appliers of AI systems. | Organisations providing or using AI systems. |
| Territorial reach | Systems provided or used in Brazil. | International. |
| Penalties | Senate text: up to BRL 50M or 2% of turnover per infringement; suspension. | None; certification lost or refused. |
| Qualification axes | PL 2338 risk level, Role (Art. 4) | System impact level (Cl. 6.1.4) |
| Roles | Developer, Distributor, Applier | Provider, User, Producer |
| Requirements | 20 | 13 |
| Next milestone | Oct 2026, Vote pushed past the October 2026 elections | Dec 2026, CEN-CENELEC JTC 21 harmonised standards for the AI Act (prEN 18286 QMS) |
Theme by theme
requirements per theme
PL 2338ISO 42001
Governance
Assessment
Build
People & use
Lifecycle & third parties
What they share: one piece of evidence, two frameworks
9
| Code | Check | Requirements PL 2338 | Requirements ISO 42001 |
|---|---|---|---|
| VER-004-01 | Documented data governance (collection process, bias, quality) | ||
| VER-004-02 | Input data relevant and representative in view of the intended purpose | ||
| VER-008-03 | Competent overseers assigned to the system | ||
| VER-005-01 | Complete technical documentation compliant with Annex IV | ||
| VER-007-01 | Instructions for use complete and compliant with Art. 13 | ||
| VER-006-02 | Automatic logging operational and compliant | ||
| VER-020-D-01 | FRIA carried out in accordance with Art. 27 | ||
| VER-022-F-01 | Risk and incident response procedure | ||
| VER-026-F-01 | Contractual responsibilities documented between provider and third parties |
Differences: requirements specific to each framework
Requirements with no check serving the other framework: the extra work.
PL 2338
13
BR-01
Preliminary assessment Arts. 12, 29
BR-02
Excessive-risk practices Art. 13
BR-03
Information on interaction with AI Art. 5 I
BR-04
Synthetic content identifier Art. 19
BR-06
Right to explanation Arts. 6 I, 7
BR-07
Contestation and human review Arts. 6 II, 6 III, 9
BR-09
Applier documentation Art. 18 I.a, I.c, I.f
BR-12
Security testing Art. 18 II.c
BR-13
Monitoring of results Art. 18 I.b
BR-17
General-purpose and generative AI Arts. 29, 30
BR-18
Training content and opt-out Arts. 62, 64
BR-19
Public-sector duties Arts. 22, 23
BR-20
Remuneration of rights holders Art. 65
ISO 42001
7
ISO-4.3
Scope of the AIMS Cl. 4.3, 4.4
ISO-5.2
AI policy Cl. 5.2, A.2
ISO-5.3
Roles, responsibilities, reporting of concerns Cl. 5.3, A.3
ISO-6.1.2
AI risk assessment and treatment, Statement of Applicability Cl. 6.1.2, 6.1.3
ISO-7.2
Competence and resources Cl. 7.2, A.4
ISO-9
Internal audit and management review Cl. 9.2, 9.3
ISO-10
Timelines
PastSet in the textPotentialTo verify
May 3, 2023PL 2338 · Filed in the Senate
Dec 18, 2023ISO 42001 · ISO/IEC 42001 published
Dec 10, 2024PL 2338 · Senate approval
May 2025PL 2338 · Special committee in the Chamber of Deputies
May 2025ISO 42001 · ISO/IEC 42005 (impact assessment)
Jul 2025ISO 42001 · ISO/IEC 42006 (certification bodies)
Oct 2026PL 2338 · Vote pushed past the October 2026 elections
Dec 2026ISO 42001 · CEN-CENELEC JTC 21 harmonised standards for the AI Act (prEN 18286 QMS)
Jun 2027PL 2338 · Possible adoption and start of the vacatio legis
Run these requirements across all your AI systems
TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.