Risk management in transportation and Brazil's Law 15.485

Brazil's Law 15.485 brought risk management in transportation into a more concrete conversation within transport companies: what data supports contracting, who is responsible for steps related to the CIOT (the Brazilian freight transport operation code) and what care should be taken when registration information feeds into sensitive decisions.

For fleet management, a practical way to start is to separate what the official source already states from what still depends on regulation. The law amends Law No. 13.703, of August 8, 2018, and Resolution No. 6.090/2026 of the ANTT (Brazil's National Land Transport Agency) indicates that earlier rules remain applicable insofar as they do not conflict with Law No. 15.485.

What changes in transport risk management

The first change is one of framing. Risk management is no longer treated only as an internal registration routine and now appears linked to legal provisions on transportation, the CIOT, data and the activities of risk management companies.

Law 15.485 provides that the ANTT will be responsible for regulating the procedures and conduct of risk management companies. This means the transport company should keep track of the agency's regulations before turning any interpretation into a definitive operational rule.

There is also a data protection point. The law requires risk management companies to comply with Law No. 13.709, of August 14, 2018, the LGPD (Brazil's General Data Protection Law). Since the dossier confirms this obligation in general terms, any detailing of procedures should be handled with dedicated legal and regulatory support.

CIOT: data, responsibility and compliance

One of the central provisions of Law 15.485 is that the CIOT must contain the data of the contracting party, the contracted party and the subcontracted party. This is the documentary core that the transport company needs to be able to identify clearly.

In operations involving a TAC (a self-employed cargo carrier in Brazil) or a carrier legally treated as equivalent to a TAC, responsibility for issuing the CIOT will lie with the party contracting the transport service. This scope prevents an overly broad reading: the rule should be applied within the reach indicated by the official source.

The law also brings a financial consequence. Non-compliance related to the CIOT will subject the offender to a fine of R$ 10,500.00. Since the amount comes from an official source, it should be treated as a regulatory risk tied to the record, not as a secondary detail of contracting.

Another clear-cut point is the payment settlement deadline, which may not exceed 30 business days. In addition, the ANTT may take measures capable of suspending the generation of a CIOT that does not comply with the minimum freight rate. These elements reinforce the need to check data and conditions before considering the operation to be in order.

Which data needs to be organized

The minimum base starts with the data of the contracting party, the contracted party and the subcontracted party, because the law requires this data in the CIOT. If the operation involves subcontracting, that role also needs to be visible in the record.

The second layer is the registry used in risk analysis. The official source mentions the operation of databases or registries of drivers' professional profiles and points to a prohibition related to the use, for the purpose of barring contracting, of information unrelated to the transport operation. Since this point has a specific legal scope in the law, practical use should be conservative: do not turn any available piece of data into grounds for barring contracting without checking the legal and operational context.

The third layer is personal data governance. The express mention of the LGPD does not detail registration procedures, but it confirms that risk management companies must comply with Law No. 13.709.

Where human analysis is still necessary

Human analysis remains important because the law combines mandatory data, registration, the LGPD and future ANTT regulation. A sensitive decision should not depend solely on the existence of a piece of information in a database; it needs to consider whether the data is related to the transport operation and whether there is an applicable rule for the case.

It is also prudent to separate a pending documentation issue from a bar on contracting. Missing data required for the CIOT may call for correction before moving ahead. Using registration information to prevent contracting, on the other hand, requires greater attention, especially when its relationship to the operation is not clear.

This care does not mean bringing the operation to a halt. It means keeping a person responsible for reviewing exceptions, documenting the justification and referring legal questions onward when the decision depends on interpreting Law 15.485 or ANTT regulations.

How to reduce legal exposure in day-to-day operations

Start with the CIOT flow. Check where the data of the contracting party, the contracted party and the subcontracted party is collected, who verifies each piece of information and at what point issuance is treated as complete.

Next, review the points where risk management generates a block, a refusal or a request for additional information. When the basis is a piece of registration information, record why it was considered related to the transport operation and avoid decisions based on data outside that scope.

Treat the LGPD as a mandatory point of attention, without presuming procedures that Law 15.485 does not detail in the passage confirmed by the dossier. What the official source supports is that risk management companies must comply with Law No. 13.709.

Finally, keep track of ANTT acts. Law 15.485 assigns the agency the regulation of the procedures and conduct of risk management companies, and ANTT Resolution No. 6.090/2026 indicates that the previous regulations remain applicable insofar as they do not conflict with the new law. The transport company's next step is to keep the process documented, proportionate and reviewable.