In today’s healthcare environment, where digital solutions are being integrated at scale into clinical and administrative workflows, the use of artificial intelligence systems, including large-scale language models and generative AI tools, is rapidly increasing.
At the same time, there are increasing regulatory and institutional expectations aimed at deploying these technologies with governance, traceability, and controls commensurate with the risks, especially when working with health data that is recognized as sensitive personal data.
In Brazil, this debate has reached an important milestone with the recent publication of Resolution No. 2,454/2026 by the Federal Medical Council. Resolution No. 2,454/2026 establishes standards for research, development, governance, auditing, monitoring, training, and responsible use of AI models, systems, and applications in healthcare.
The CFM is Brazil’s national agency regulating medical ethics and works in conjunction with regional medical councils that oversee and investigate ethical violations within their respective jurisdictions. In this context, the CFM resolution serves as a normative reference for the organization of medical practices and services based on medical technical guidance, with specific implications for supervision and ethical professional oversight.
Although not a general law, this new regulation therefore serves as a sector-specific standard of care for the use of AI in healthcare, influencing internal policies, treatment pathway design, and even supplier contracting, validation, and monitoring standards.
Purpose and approach: lifecycle, proportionality and transparency
Resolution No. 2,454/2026 states that its aim is to promote technological development and efficiency of health services in a safe, transparent, fair and ethical manner, in the interests of patients and in compliance with fundamental rights. To achieve this objective, we take a lifecycle approach, where validation and controls accompany the system from conception and testing to implementation, updates, retraining, and monitoring in production.
