Is software reverse engineering a crime in Brazil? What the law says

Why this question came back

Searches for whether software reverse engineering is a crime grew in October 2026, with the attention around REA, a tool that puts AI agents to work on reverse engineering, and the ArtCraft apps, presented as alternatives to Adobe programs. If an AI can take a program apart in hours, the natural question is: is that allowed?

This text summarizes what Brazilian law says. It's informational, not a legal opinion: for a concrete case, consult a lawyer who specializes in intellectual property. Other countries have their own rules, mentioned briefly below.

What Brazilian law protects in software

Law 9,609/98, known as the Software Law, says in article 2 that computer programs receive the same protection regime as literary works, under copyright law. And the Copyright Law (Law 9,610/98), in article 8, excludes from protection ideas, normative procedures, systems, methods and mathematical concepts as such.

In practice: the code, which is the program's expression, is protected. The idea, the functionality and the result the program produces are not. Two programs can do the same thing without one infringing the other, as long as one doesn't copy the other's code.

What the Software Law expressly allows

Article 6 of Law 9,609/98 lists situations that don't infringe the rights of the program's owner:

• ✓Making a backup copy of a legitimately acquired program.
• ✓Quoting the program in part for teaching purposes, identifying the program and its owner.
• ✓Being similar to a preexisting program when the similarity stems from the application's functional characteristics, technical standards or the lack of another form of expression.
• ✓Integrating a program into an application or operating system when this is technically indispensable to the user's needs, for the exclusive use of whoever performed the integration.

So where does reverse engineering stand?

None of the items in article 6 mentions reverse engineering. The last two are the most cited in interoperability discussions, but the interpretation isn't settled, and the law doesn't expressly prohibit the practice either. It's a gray area: what defines the risk is what you do with the analysis.

Luca Schirru's master's thesis, defended at UFRJ in 2015, is one of the academic references on the legal viability of reverse engineering computer programs in Brazil, for those who want to go deeper.

When reverse engineering becomes a problem

The risks show up in at least five situations:

• ✓Copying or distributing the code: article 12 of the Software Law provides for detention of six months to two years or a fine for anyone who infringes a program's copyright, and imprisonment of one to four years and a fine when the reproduction is for commercial purposes, without authorization.
• ✓Breaking copy protection: article 107 of the Copyright Law holds liable for damages anyone who alters, removes or disables technical devices that prevent or restrict copying.
• ✓Breaching the license agreement: many terms of use prohibit reverse engineering. Even when it isn't a crime, it can lead to contract termination and damages.
• ✓Using confidential information: the Industrial Property Law (Law 9,279/96, article 195) treats as unfair competition using, without authorization, confidential information obtained through a contract or job, even after the relationship ends.
• ✓Copying the look: closely reproducing a product's visual identity can lead to unfair competition and trade dress disputes, even if the code is original.

What about elsewhere?

In the United States, court decisions such as Sega v. Accolade (1992) and Sony v. Connectix (2000) accepted disassembling programs as fair use when the goal was compatibility. In the European Union, Directive 2009/24/EC allows decompilation under strict conditions, when it's indispensable to obtain the information needed for interoperability with an independently created program.

Brazil has no equally explicit rule. Foreign decisions serve as a reference for the debate, but they don't settle a concrete situation there.

What changes with AI

The law hasn't changed: the same rules apply whether someone analyzes a program by hand or with an AI agent. What changed is scale. An analysis that would take weeks can be done in hours, by more people, which increases both legitimate uses and abuses.

There's also a new confidentiality question. When you use an agent, parts of the analyzed program are sent to the AI model provider. If the software belongs to your company, or to a client, check the provider's terms and prefer plans that don't use data to train models.

Good practices for analyzing software without headaches

A few rules greatly reduce the risk:

• ✓Only analyze your own software or software you have written authorization from the owner to analyze.
• ✓Read the license agreement before you start.
• ✓Record the purpose of the analysis, such as security, interoperability or documentation.
• ✓Don't distribute third-party code, snippets or programs.
• ✓Don't bypass DRM, license checks or other protections.
• ✓If you're building a compatible product, separate those who analyze from those who write the new code (clean room).
• ✓If you find a security flaw, notify the vendor before disclosing it.
• ✓When in doubt, consult an intellectual property lawyer.

How SINOON helps

Tools like REA will show up in technology teams' daily work, with or without an internal policy. In the AI governance and data protection track of our AI consulting, we help companies define clear usage rules, including what may or may not be analyzed and how to handle customer data, always together with the legal team. For the full picture, read the guide to reverse engineering with AI.