No. In Brazil, artificial intelligence may help analyze tests, suggest possibilities and organize clinical information, but it has no authority to make a final diagnosis instead of a physician. CFM Resolution No. 2,454/2026, effective since August 26, 2026, reserves final decisions on diagnosis, prognosis, prescriptions and other medical acts for human physicians. It also establishes transparency, documentation and patient-protection duties.
The Brazilian Federal Council of Medicine (CFM) adopted the resolution on February 11, 2026, and it was published in the Federal Official Gazette on February 27. Its scope concerns professional ethics and medical institutions in Brazil: it does not mean that every AI tool has been clinically validated or authorized by the Brazilian Health Regulatory Agency (Anvisa).
What can AI do during a medical appointment?
A system may detect patterns in images, suggest differential diagnoses (possible conditions that a doctor must distinguish), flag risks or help organize information in a health record. These outputs are computational suggestions, not automatically valid clinical decisions. The physician must weigh them against symptoms, medical history, physical examination when relevant and scientific evidence.
Under Articles 18 and 19 of the resolution, the system cannot replace or constrain the physician's final authority. Doctors may accept or reject an AI recommendation and may decide not to use the tool when they consider it inappropriate, provided they comply with technical and ethical standards. Clinics also must not impose policies that subordinate medical judgment to an algorithm's recommendation.
Matrix: technological support, decisions and accountability
| Situation | Possible AI role | Limit and responsible party |
|---|---|---|
| Medical test or image | Highlight findings and suspicious patterns | The physician assesses the output in its clinical context and determines the interpretation |
| Diagnosis and prognosis | List possibilities or estimate risks | The physician remains responsible for the conclusion and decision in the case |
| Treatment and prescriptions | Suggest approaches or flag inconsistencies | Treatment decisions and prescribing remain medical acts |
| Communication with patients | Help prepare information | Diagnosis, prognosis or treatment decisions cannot be communicated by AI without human mediation |
| Data and health records | Organize information and support documentation | Use as decision support must be recorded; confidentiality and security remain mandatory |
Is the doctor still responsible after following a wrong suggestion?
Using AI does not remove a physician's professional ethical responsibility for medical acts. The CFM requires a critical assessment of recommendations and a record in the patient's chart when AI supports medical decisions. Simply stating that software suggested a diagnosis is insufficient: the suggestion must make sense for the individual patient.
There is an important qualification. The resolution also guards against unfairly holding physicians responsible for failures attributable exclusively to the AI system when they can demonstrate diligent, critical and ethical use. This is not blanket immunity: any civil or criminal liability depends on separate legal requirements and the circumstances of the case.
What rights do patients have?
Patients must receive clear, accessible information when AI provides relevant support in their care. The resolution requires respect for their autonomy, including an informed refusal to use the technology. It also preserves rights such as information about treatment options, a second opinion, privacy and freedom from experimental interventions without specific consent.
In practical terms, patients can reasonably ask which system was used, for what purpose, whether the physician checked its output and how their information is protected. Declining a particular tool is not automatically the same as declining medical care. Care arrangements must take the clinical circumstances and applicable rules into account.
Can health information be uploaded to any chatbot?
No. Health information is classified as sensitive personal data under Brazil's General Data Protection Law (LGPD). Processing it requires an appropriate legal basis, a defined purpose and security safeguards. Consent is not the only lawful basis provided by Article 11 of the LGPD, but sharing information with any vendor cannot automatically be assumed lawful.
The CFM resolution requires confidentiality, integrity and security, including safeguards for data used to develop, train, validate and operate systems. Before placing identifiable patient information into a tool, healthcare professionals and providers must assess purpose, access, contracts, security controls and terms of use. A general-purpose chatbot does not become a suitable clinical environment merely because it produces plausible answers.
What changes for hospitals and clinics?
Institutions developing or using AI must conduct a preliminary risk assessment, considering factors such as health impact, human intervention and data sensitivity. The resolution uses four risk categories: low, medium, high and unacceptable. It also requires governance, auditing and monitoring processes. Institutions adopting their own AI systems are subject to provisions for an AI and Telemedicine Committee coordinated by a physician.
The requirements apply to systems already being developed or used when the resolution took effect, not just future purchases. Classification in a particular case depends on the system's characteristics and intended purpose.
The CFM and Anvisa regulate different matters
CFM Resolution No. 2,454/2026 governs professional conduct and responsible medical use of technology. Anvisa, by contrast, regulates products subject to health surveillance. Under RDC No. 657/2022, software intended for certain medical purposes may qualify as software as a medical device (SaMD), including cloud-based and mobile applications.
Anvisa explains that automatic diagnosis, triage or treatment-suggestion functions may bring software within the medical-device framework, whereas exclusively administrative tools are treated differently. Classification and regulatory requirements depend on the product's stated intended use and features. Compliance with CFM rules does not replace any required Anvisa authorization, and medical-device regularization does not transfer final medical decisions to an algorithm.
The key principle for patients and professionals is clear: technology may support clinical reasoning, but decisions must remain under medical supervision, with proper records, transparency and data protection. This guide is based on regulatory documents. It is not a software test, a hospital audit or a diagnostic-accuracy assessment of any specific tool.
