Brazil's 560 facial-recognition projects run without a national law. Other democracies are now weighing the same choice.

At Rio de Janeiro's Integrated Command and Control Center, a wall of screens shows the city in real time. When a military police facial-recognition camera flags a biometric match against a database of outstanding arrest warrants, an officer at the center identifies the closest patrol and sends it to conduct a stop. The CICC is the state security forces' main technology hub, and the chain from alert to street-level response is the clearest window into how Brazil is operationalizing face-matching at scale.

Brazil now has more than 560 facial-recognition projects nationwide, more than double the count two years ago, according to O Panóptico, a civil-society organization that tracks the deployments. The majority are run for public security by local governments or police forces. Some are also deployed in private spaces, including schools. Most of the projects sit outside any federal statute, and Brazilian legislators have not yet passed a law that governs how the systems can be used, audited, or constrained.

The build-out is outrunning the law. In the European Union, the AI Act specifically prohibits real-time biometric surveillance of publicly accessible spaces in most cases and bans untargeted scraping of facial images from the internet or closed-circuit cameras. In the United States, facial recognition by local police and federal agents has become controversial because of wrongful arrests and the use of the technology to identify protesters. Brazil has neither a baseline prohibition nor a baseline permission. The country is in the gap between the two.

Wrongful arrests are already on the record. Brazilian media and civil-society groups have tracked a string of cases in which the system flagged the wrong person, often a young Black man whose face resembled a warrant subject's, and the result was a street stop, a detention, or both. Researchers who study the deployments say the pattern is not a string of one-off errors but the predictable output of matching a low-resolution surveillance image to a curated warrant list without a human-in-the-loop review of the match before force is dispatched.

Thallita Lima, research coordinator at O Panóptico, calls facial recognition a "supposedly quick solution" to public security. Lima and other researchers argue that the speed of the technology is part of the danger. It compresses the time between a false positive and a coercive police response into minutes, and it gives officers less reason to apply judgment at the point of contact. Fear of crime, in their reading, is doing the work that a statute has not yet done, and fear is producing a permissive default.

The Brazilian experiment is now producing a policy model that other democracies are importing or rejecting in real time. Brazilian civil-society groups and legislators are drafting specific guardrails, including limits on real-time use in public spaces, mandatory accuracy thresholds, independent audit rights, and rules on how biometric databases are built and shared. The EU AI Act is the version of those guardrails that has been written into binding law. The US system, which has neither a federal floor nor a federal prohibition, is the version that has produced the most public backlash.

For any jurisdiction now facing the same fork, Brazil shows what happens when the law follows the cameras. The country deployed at speed, accepted wrongful arrests as the cost of doing business, and is now racing to retrofit a statute. The EU wrote the statute first, then narrowed the deployments. The contrast crystallizes the choice: a deploy-first model that is paying its bills in court, in the press, and at the door of the patrol car, and a rules-first model that has accepted slower rollouts in exchange for fewer of those bills.

The guardrail bills now in Brazil's legislature will decide which model the country runs under by the end of the year. If they pass before the next wave of municipal deployments, Rio's CICC will operate under a federal statute for the first time. If they do not, the next 12 months of camera expansion will keep running on the permissive default that fear of crime has set.