AI in Brazilian Public Health: SUS, ANVISA, and the Ethical Limits of Artificial Intelligence in Brazil

The Real Picture: AI Is Already Inside SUS

In January 2026, Brazil's Ministry of Health announced the creation of the National Network of Smart Hospitals and Services for SUS (Rede Nacional de Hospitais e Serviços Inteligentes do SUS), a program bringing artificial intelligence, advanced connectivity, and precision medicine into the public health network, backed by R$1.7 billion (roughly $340 million) in funding secured in partnership with BRICS countries. The first phase covers 14 smart ICUs across 13 states, with one of the main hubs at the University of São Paulo's Hospital das Clínicas — around 800 emergency beds, with capacity to treat more than 20,000 patients a year.

According to Health Minister Alexandre Padilha, the technology can make triage up to five times faster. That's not a distant goal: Brazilian public hospitals already use algorithms to analyze thousands of imaging exams — CT scans, X-rays, MRIs — at a speed no human team could match, reorganizing the reading queue to bump the most critical cases to the top. A patient showing early signs of a stroke, or a suspicious lung nodule, can have their scan prioritized by the algorithm within minutes, not days.

The program also opened dialogue with global medical technology manufacturers — including China's Neusoft, which announced investment in an imaging equipment factory in Santa Catarina state, and Mindray, one of the world's largest hospital equipment makers — to accelerate the digitization of Brazil's public network. The government's stated goal isn't to replace healthcare professionals, but to provide technological support for faster, safer clinical decisions, especially outside major urban centers, where the shortage of specialists is most acute.

Where AI Is Already Working Inside the Public System

Pulling together what's already operational or in advanced pilot stages across SUS units, four use cases account for nearly all real-world deployment of the technology today.

The common thread across all four use cases is that none of them replaces the final medical decision — all of them act as a capacity multiplier in a system serving a continental population with a historically insufficient number of specialists relative to demand, especially outside the country's capital cities.

The Regulatory Framework: Who Regulates What in Brazilian Health AI

Unlike AI at work or in education, healthcare already had a robust, specific regulatory system in place before the explosion of generative AI itself — which changes the game compared to other areas still being regulated "by analogy." Three institutions split that responsibility, each with a different scope.

ANVISA: medical software as a device

Since 2022, Resolution RDC 657/2022 from Brazil's health regulator ANVISA created a specific regulatory regime for SaMD (Software as a Medical Device) — any software with a diagnostic, therapeutic, or clinical decision-support purpose must go through notification or registration, depending on its risk class (I through IV, following the international IMDRF matrix, harmonized with the FDA and European regulation). An AI system that analyzes a CT scan and flags a possible tumor falls squarely under this rule — and must demonstrate safety, performance, and clinical evidence before it can reach a SUS hospital.

CFM: who signs off, and who's responsible for the decision

What was missing until early 2026 was a specific text on the clinical use of AI itself inside the office and the hospital — ANVISA regulates the product, but didn't say who signs the final report. CFM Resolution 2.454/2026 filled that gap: it establishes that responsibility for the clinical decision always rests with the physician, even when they use AI support, sets out what needs to be documented in the medical record about the tool's use, and how the patient must be informed that an AI system took part in their diagnosis or treatment.

LGPD: health data is sensitive data

Brazil's General Data Protection Law (LGPD) classifies health data as sensitive personal data (Art. 5, II), with stricter processing rules than ordinary data — requiring, among other things, a specific legal basis (Art. 11) and reinforcing the right to review of automated decisions (Art. 20) whenever an AI system takes part in a decision that affects the patient, such as care prioritization or triage.

Confirmed vs. Not Yet Confirmed: Separating Policy From Expectation

Few areas mix government announcements, isolated pilots, and long-term promises quite like digital health. Before deciding what to expect from AI at your local health post, it's worth separating what's already policy and funded reality from what's still a goal or an open debate.

Confirmed

• The National Network of Smart Hospitals and Services for SUS exists and is running, with R$1.7 billion in funding, 14 smart ICUs in the first phase, and USP's Hospital das Clínicas as one of the main hubs.
• ANVISA has regulated AI-based medical software since 2022, via RDC 657/2022, with a four-tier risk classification and clinical-evidence requirements proportional to each system's risk level.
• The CFM has already established, via Resolution 2.454/2026, that clinical responsibility always rests with the physician, even with AI support, and that the tool's use must be documented and disclosed to the patient.
• The LGPD already protects health data as sensitive data, with the right to human review of automated decisions that affect the patient — this already applies today, in any unit using AI. We break down that right, with practical examples, in our guide to Brazil's LGPD and AI.

Not yet confirmed

• When the smart hospital network will expand beyond its first phase — the timeline for scaling nationally, beyond the 14 initial hubs across 13 states, has no public date yet.
• How PL 2338/2023 (Brazil's AI Law) will treat healthcare specifically in practice — the bill already classifies systems used in "evaluating criteria for public services" as potentially high-risk, but the final text on healthcare, including algorithmic impact-assessment deadlines, still depends on a vote in the lower house of Congress. We track the full legislative process in our guide to Brazil's AI Law.
• Whether and when the RNDS will achieve truly nationwide, uniform coverage — data integration between small municipalities and major centers remains uneven, which limits how far any AI relying on complete clinical history can actually reach.
• The medium-term impact on wait times at a national level — the reported speed gains (like "5x faster" triage) come from specific units within the pilot network; there's no consolidated national figure yet measuring this effect across all of SUS.

The Unique Challenges of Brazil's Public System

AI in healthcare faces similar technical and ethical challenges in any country. But Brazil's scale and inequality create obstacles a smaller or more homogeneous country simply doesn't have.

Continental scale with uneven infrastructure

SUS provides some level of care to more than 200 million people across a territory the size of a continent. An algorithm trained mostly on data from major urban hospitals — where most digitized medical data actually exists — risks performing worse for populations in Brazil's North and Northeast, regions historically underrepresented in Brazilian medical datasets. This isn't hypothetical: it's the same geographic bias pattern already documented in other countries with strong regional inequality.

Racial bias in a country that already measures health inequality by race

Brazil has decades of data from its own Ministry of Health showing racial disparities in maternal mortality, life expectancy, and access to early diagnosis between Black and white patients. An algorithm trained on the health system's own historical data risks learning — and reproducing at scale — that same pattern of inequality, even without any explicit instruction to do so. This is exactly the kind of scenario the Algorithmic Impact Assessment, required for high-risk systems under PL 2338, was designed to catch before a system goes live.

Data fragmentation across municipalities, states, and the federal government

The RNDS (National Health Data Network) and the Meu SUS Digital app have advanced interoperability, but Brazil still doesn't have a truly unified electronic health record across its more than 5,500 municipalities. That means an AI system needing a patient's complete clinical history may simply not have access to it if that person was treated in different municipalities over their lifetime — a structural limitation no algorithm, however sophisticated, can solve on its own.

Connectivity as a prerequisite for telehealth

Remote monitoring and telehealth — one of the most promising fronts for bringing AI to regions without specialists — depend on stable connectivity, still uneven in rural, riverside, and Indigenous areas. The technology that promises to shrink the distance between patient and specialist first runs into a more basic distance: access to quality internet.

Brazil vs. Other Countries: How Health AI Regulation Compares

Brazil isn't building this regulation in isolation. Comparing Brazil's design to other systems helps clarify whether the country is aligned, behind, or in some respects ahead.

The pattern that emerges is similar to what's seen in other areas of AI regulation in Brazil: the health-sector regulatory base (ANVISA and CFM) is already more mature and specific than Brazil's general AI regulation (still pending via PL 2338), putting Brazil in a relatively advanced position specifically on medical devices — even as it faces structural implementation challenges that the EU and the US, with internally less unequal health systems, don't face on the same scale.

Common Misconceptions About AI in Public Health

Among public health managers, healthcare professionals, and the general public, a few misunderstandings come up again and again when the topic is AI inside SUS:

• Assuming "ANVISA-approved AI" means "infallible AI": regulatory approval attests to minimum safety and performance within tested criteria — it doesn't eliminate the need for medical review, nor guarantee equal performance across every patient profile.
• Confusing a regional pilot with national policy: a hospital with cutting-edge AI in São Paulo doesn't mean the same technology is available at a basic health unit in rural Amazonas — unequal access to the technology itself is, in itself, a central ethical issue.
• Ignoring the right to explanation: patients (and healthcare workers) often don't realize they can, under the LGPD, request an explanation of how an automated triage or prioritization decision was made.
• Treating algorithmic bias as a purely "technical" problem, isolated from social inequality: a biased health algorithm is usually reflecting inequality that already existed in the data — fixing the code without addressing the social origin of the bias tends to mask the problem, not solve it.
• Overestimating how much AI solves physician shortages: the technology multiplies analytical capacity, but doesn't replace the structural need for more healthcare professionals in underserved regions.

Beyond the Possible: Where AI in Public Health Could Go

Moving past what's already confirmed public policy, it's worth exploring — with a grounded sense of what's technically plausible — scenarios that aren't yet reality inside SUS, but that come up often in debates about the future of Brazilian digital health.

Remote AI diagnosis for riverside and Indigenous communities via satellite: technically plausible, since low-earth-orbit satellite connectivity is expanding globally, but it depends on infrastructure investment that isn't yet part of the confirmed public timeline for the National Network of Smart Hospitals.

Real-time outbreak prediction cross-referencing SUS data with environmental data: technically possible and already explored in Brazilian academic research (such as studies linking dengue fever to climate-related vectors), but without a fully operational national predictive-surveillance system integrated into the public network yet.

A fully unified national electronic health record, with AI analyzing any patient's complete history at any unit in the country: this is the most distant scenario on the list. It depends first on solving the structural interoperability problem across more than 5,500 municipalities — a data-management challenge, not just an algorithmic one.

What to Do Now, In Practice

Regardless of how quickly the National Network of Smart Hospitals expands or when PL 2338 finally comes to a vote, there are concrete steps that make sense today for anyone who uses or works within Brazil's public healthcare system.

If you're a SUS patient

You have the right to formally ask whether an AI system took part in your triage, diagnosis, or care prioritization — and to request an explanation of the criteria used, under Article 20 of the LGPD. If you notice treatment differences that seem systematic by region, race, or socioeconomic profile, you can report this to your local SUS ombudsman and to Brazil's data protection authority, the ANPD.

If you're a healthcare professional

Document any use of AI tools in the patient's chart, as required by CFM Resolution 2.454/2026 — this protects both you and the patient. Keep active clinical skepticism: a decision-support system is exactly that, support, not a final verdict, and cases that "fall outside the algorithm's pattern" deserve extra attention, not less. If you're studying for or updating your credentials in the field, our AI for Nursing guide covers AI-assisted study techniques for clinical coursework.

If you're a public or hospital manager

Before adopting any clinical AI system, confirm its ANVISA regularization as SaMD and require performance evidence from populations comparable to yours — not just generic international studies. Prioritize investment in data interoperability (RNDS) before investing in algorithms alone: even an excellent model has limited value without a patient's complete historical data, however strong its isolated technical performance.