CFM 2.454 Regulates the Physician, Not the Software. What That Means for Your Brazilian Sites
Most of what has been written about Brazil's new AI resolution in English is accurate and still leaves sponsors with the wrong mental model.
The framing almost everyone reaches for is that Brazil has published its AI rulebook, alongside the EU AI Act and the FDA's draft guidances, and that the task is to work out where NexTrial or any other system sits inside it. That framing produces a specific and expensive mistake, because Resolução CFM nº 2.454/2026 is not a product regulation. It does not classify software. It does not clear, register, certify or approve anything.
It regulates doctors.
That single distinction determines whether your compliance work in Brazil is aimed at the right object, and almost every English language treatment of the Resolution skips past it.
What the instrument actually is
The Conselho Federal de Medicina is Brazil's federal medical council. Its authority comes from Lei nº 3.268/1957, and its resolutions bind physicians and the institutions operating under medical technical direction. Enforcement runs through the Regional Councils, the CRMs, as an ethical and disciplinary proceeding under the Código de Ética Médica.
The consequence of a breach is not a product recall or a marketing authorization withdrawn. It is a proceeding against a named physician.
Resolution 2.454/2026 was adopted on 11 February 2026, published in the Diário Oficial da União on 27 February, corrected by a retificação on 5 March, and enters into force 180 days after publication, on 26 August 2026. It runs to 23 articles and three annexes.
One note on that date, because the English commentary is not consistent. Article 23 counts the 180 days from publication, not from adoption. Counting from the 27 February publication gives 26 August. Counting from the 11 February adoption gives 10 August, and several alerts have published that figure. The instrument says publication.
Nowhere in those 23 articles is there a conformity assessment, a registration requirement, a notified body, a performance threshold, or a submission pathway. The Resolution points at scientific validation and at ANVISA without defining either.
That is not a drafting oversight. It is the correct shape for the instrument, because CFM has no jurisdiction over products. It has jurisdiction over the people who use them.
Why your existing file does not travel
A sponsor arriving in Brazil with an AI-assisted process typically carries one of two things. Either a European technical file, built for the AI Act's high-risk obligations and the medical device regulations, or an American credibility assessment built along the lines of the FDA's January 2025 draft guidance on AI supporting regulatory decision-making, which as of this writing remains draft.
Both are documents about the system. Both were produced by, or on behalf of, whoever built it.
Neither answers the question a CRM would ask, which is about a physician's conduct in a specific clinical decision on a specific date. Did the investigator exercise independent judgment. Was the use of AI recorded. Was the patient told. Could the investigator have declined, and would anything at the institution have penalized them for declining.
Those are not questions your technical file was written to answer, because no regulator had previously asked them in binding form.
The inverse holds as well, and is worth stating because it catches people the other way. Compliance with the Resolution does not clear a product for the Brazilian market. If your tool has a diagnostic or therapeutic purpose it falls under ANVISA's software as a medical device framework, RDC 657/2022, with its own classification and registration path. Two regimes, two objects, two sets of obligations. Satisfying one says nothing about the other.
The provisions that reach clinical research
Four, in descending order of how much work they create.
Article 4, item V requires the physician to record in the patient's record that AI was used as decision support. Not that a policy exists. Not that a system is deployed. That it was used, in this decision. For a trial, that lands squarely in source documentation, which means it lands in monitoring, in the source data verification plan, and eventually in an inspection.
Article 21 provides no transition. The Resolution applies to systems already in development and already in use at entry into force. Whatever AI touchpoints exist at your Brazilian sites today are in scope from 26 August, not from the next protocol amendment.
Article 20 brings research, studies and pilot projects explicitly within the ethical principles of research and of care. It is a single sentence and it is the hook that connects a professional conduct resolution to the trials system.
Annex III requires that oversight bodies be able to access audit and monitoring reports, and names CONEP among them where research is involved. That is the wiring. A resolution about physicians now has a defined interface with the research ethics system.
That last provision has a complication worth knowing about.
The body the Resolution names no longer holds those functions
Lei nº 14.874/2024 created the Sistema Nacional de Ética em Pesquisa com Seres Humanos, Sinep, and Decreto nº 12.651/2025 of 7 October 2025 stood up the Instância Nacional de Ética em Pesquisa, Inaep, as the national body. Inaep succeeds CONEP. It issues research ethics norms, credentials and accredits the CEPs, supervises them, and sits as the appeal instance over their decisions. Inaep published its internal rules in the Diário Oficial da União on 6 April 2026 and has been issuing votes and public consultations since.
CFM 2.454 was adopted on 11 February 2026, four months after the Decree, and its Annex III names CONEP.
Read purposively, the obligation is to give the research ethics oversight body access, and that body is now Inaep with the CEPs beneath it. But the Resolution says what it says, and Article 22 reserves to CFM the resolution of interpretive doubts. This is a strong candidate for exactly that. Until it is resolved, an institution should provide the access rather than argue that the named recipient has changed.
The CEPs themselves now split into two categories. A CEP credenciado reviews low and moderate risk research. A CEP acreditado is required for high risk, which covers new drugs, vaccines and procedures not previously used in humans.
That distinction carries a fact sponsors should plan around. In a voting document from its own proceedings, Inaep recorded that eight accredited CEPs reviewed 874 protocols and amendments between 5 November 2025 and 26 January 2026, and that all eight sit in the state of São Paulo. Inaep flagged the concentration itself, noting sustained pressure on very few committees and a risk of operational overload.
Eight accredited committees nationally, in one state, holding ethics review for every high risk protocol in Brazil. Whatever CFM 2.454 adds to your documentation load, this is the structural constraint on your Brazilian activation timeline, and it is independent of it.
Interim norms still apply during the transition. Existing Conselho Nacional de Saúde resolutions remain in force until Inaep issues its own, to the extent they do not conflict with Lei nº 14.874/2024 or the Decree.
What it asks of the systems themselves
The Resolution does not regulate vendors. It does something less direct and, commercially, more consequential: it tells physicians and institutions what to demand.
Article 3 gives physicians an explicit right to refuse systems lacking adequate scientific validation or relevant regulatory certification, and a right to clear information on how a system works, its purposes, limitations, risks and level of scientific evidence.
Annex III directs institutions toward open, auditable, interoperable solutions in preference to closed ones, requires bias monitoring with output stratification, names the Technical Director as the accountable officer, and requires that audit and monitoring reports be available to oversight bodies.
Read together, that is a procurement specification written by a regulator. It does not prohibit any particular architecture. It does establish what a physician is entitled to ask for and what an institution is expected to prefer, and those two things shape purchasing more reliably than a prohibition would.
It is worth being precise about the limit of that argument. Annex III expresses a preference, not a ban. A closed system is not unlawful in Brazil on 11 August. It is simply harder to defend at the moment someone asks the institution why it chose that one.
The output that satisfies the requirement
Set the product question aside and look at what the three core obligations have in common.
A human must hold the decision. The use must be written into the record. The reasoning must be available to an auditor.
An output that reports how confident a model is satisfies none of the three. It is not a decision, because it hands interpretation back to the clinician without resolving anything. It is not a record of why, because it reports a degree of certainty rather than a basis. And it is not inspectable, because the reasoning it summarizes cannot be reconstructed by anyone reading it afterward.
That is not a criticism CFM made. The Resolution says nothing about confidence scores. It is what follows from the three requirements once you hold them next to the artifact most AI systems in clinical settings actually produce.
What to do before the next monitoring visit
Inventory every point at your Brazilian sites where a model output reaches a physician investigator. Not every point where AI exists in your stack, only the ones that touch a clinical judgment.
For each, establish three things. Whether the investigator can decline it and whether anything in the site's incentives penalizes declining. Whether its use is being written into the record in a form that would survive an inspection. And whether you could hand an auditor a reconstruction of how the output was reached, rather than a number describing how sure the system was.
Where the answer to any of those is no, that is the work. It is smaller than a European conformity file and it is aimed at an object your existing documentation was never built to cover.
FAQ
Does CFM Resolution 2.454/2026 apply to clinical trials in Brazil?
Yes, in part. Article 20 states that research, studies and pilot projects involving AI in medicine must align with the ethical principles of research and of care. Annex III entitles the research ethics oversight body to access audit and monitoring reports where research is involved. The Resolution is not a clinical trials regulation, but it reaches any Brazilian site where a physician investigator uses AI in a clinical decision.
Does ANVISA clearance satisfy CFM 2.454?
No. The two regimes govern different objects. ANVISA regulates the product under the software as a medical device framework. CFM regulates the conduct of the physician and the governance of the institution. A tool can hold ANVISA registration and still be used in a way that breaches the Resolution, and a tool outside ANVISA scope can still trigger obligations for the physician using it.
Does the Resolution bind technology vendors, sponsors or CROs?
Not directly. CFM derives its authority from Lei 3.268/1957 and binds physicians and the institutions under medical technical direction. Enforcement runs through the Regional Councils of Medicine as an ethical and disciplinary proceeding against a named physician. Vendors, sponsors and CROs are reached indirectly, because physicians and institutions are now required to demand things of them.
Is there a transition period for AI systems already in use in Brazil?
No. Article 21 states that the Resolution applies to AI systems already in development or already in use at the date it enters into force. There is no grandfathering provision and no phase in. A tool deployed in 2024 is subject to the full Resolution as of 26 August 2026.
Does CFM 2.454 still refer to CONEP after the Inaep transition?
Annex III names CONEP. Lei 14.874/2024 created the Sinep and Decreto 12.651/2025 stood up Inaep, the Instância Nacional de Ética em Pesquisa, which succeeds CONEP and now credentials and accredits the CEPs. The Resolution was adopted after that Decree and was not updated. Read purposively the access obligation runs to Inaep and the CEPs, and Article 22 reserves interpretive questions to CFM.
When did CFM Resolution 2.454/2026 take effect?
The Resolution was adopted on 11 February 2026 and published in the Diário Oficial da União on 27 February 2026. Article 23 sets a vacatio legis of 180 days counted from publication, which places entry into force on 26 August 2026. Some commentary gives 10 August, which counts 180 days from the 11 February adoption date rather than from publication. Article 23 counts from publication. A retificação published on 5 March 2026 amended the wording of Article 16.