Brazil’s Federal Revenue Service Formalizes AI Governance through Ordinance RFB No. 647/2026

On February 5, 2026, the Federal Revenue Service of Brazil, known as Receita Federal do Brasil (RFB), took a definitive step toward digital modernization by officially establishing its Artificial Intelligence Policy. This landmark move was enacted through the issuance of Ordinance RFB No. 647/2026, a regulatory framework designed to provide clear principles and safeguards for the ethical integration of AI within the agency's operations. The policy covers the entire operational lifespan of AI systems, ranging from initial development and procurement to ongoing monitoring and eventual decommissioning, ensuring that all processes remain compliant with data protection laws and the privacy of citizens.

This new policy is strategically aligned with the broader Brazilian Artificial Intelligence Plan (PBIA) for the 2024–2028 period, which seeks to establish Brazil as a global frontrunner in AI governance. At the heart of the RFB’s approach is the non-negotiable requirement for human oversight. The ordinance explicitly prohibits autonomous decision-making by algorithms, positioning AI as a supportive tool rather than a final authority. While artificial intelligence can assist in complex data analysis and initial sorting, every final administrative decision must be reviewed and authorized by a human public official.

Building on previous successes with human-monitored fraud detection systems, the RFB is now mandating higher standards for transparency and accountability. All AI systems deployed must demonstrate explainability, auditability, and strict traceability to prevent algorithmic bias. Furthermore, the ordinance sets firm boundaries against the use of technology for mass surveillance or the psychological manipulation of citizens, emphasizing that AI must never infringe upon fundamental human rights or constitutional guarantees.

The management of AI-related risks is now a shared responsibility within the RFB structure. Operational units handle business-specific risks, while the IT department focuses on technical integrity and cybersecurity. The Comitê de Tecnologia e Segurança da Informação (Committee for Information Technology and Information Security) serves as the primary governing body, overseeing ethical considerations and strategic performance. Notably, the policy includes a strict clause for external vendors, prohibiting the use of Federal Revenue data to train any third-party AI models.

Despite the internal clarity of the document, legal analysts have raised concerns regarding the administrative limits of such an ordinance. The debate centers on whether an internal regulation is sufficient to govern matters that directly impact taxpayer rights, such as the selection of individuals for audits or the imposition of financial penalties. Some legal experts argue that under the principle of legal reserve, such powers should be codified by the National Congress rather than through administrative decrees, potentially leading to future litigation over the boundaries of the RFB's authority in this sensitive sphere.

This initiative is part of a larger national ambition reflected in the PBIA 2024–2028, which earmarks 23 billion Brazilian Reals over four years for technological infrastructure. This investment includes the development of one of the world’s five most powerful supercomputers, aiming to transform Brazil into a global innovation hub. Ordinance RFB No. 647/2026 thus represents a pivotal moment in tax administration, attempting to strike a delicate balance between rapid technological advancement and the rigorous protection of legal rights in the digital age.