The regulation of the Electronic Registration Authority (AR Eletrônica) marks an important shift for the remote issuance of digital certificates in Brazil. ITI Normative Instruction No. 36 of April 29, 2026 sets out the requirements and procedures for confirming the identity of digital certificate applicants within ICP-Brasil, Brazil’s public key infrastructure.
Under the new model, the process can be fully digital and automated. But the core message is clear: automation only builds trust when identity is validated securely.
In sensitive journeys, digitizing steps is not enough. You have to prove there is a real person on the other side.
The new standard for remote issuance
The new rule raises the technical bar expected of digital certificate issuance processes.
The requirements include biometric validation, mandatory liveness detection, protection against biometric injection attacks, deepfake mitigation, device integrity and audit trails.
These points show that remote issuance cannot rely on a selfie, a user declaration or a simple image capture alone.
Identity has to be validated with consistency, real presence and auditability.
The impact goes beyond digital certificates
Although the regulation focuses on the digital certificate market, it signals a broader shift.
Any company that depends on remote identity now faces the same challenge: reduce fraud, prove real presence and keep the journey smooth.
That applies to onboarding, account recovery, data updates, digital signatures, transaction authentication and other critical journeys.
The question is no longer only “is the process digital?” but rather: “can the process stand behind the identity decision?”
Security cannot turn into abandonment
Tightening control does not mean building a heavy journey.
When validation is long, confusing or full of repetitive steps, users tend to abandon the process. When validation is weak, the company takes on more risk.
The balance lies in combining security, accuracy and experience. Authentication has to prove real presence without turning protection into friction.
Trusted identity as infrastructure
AR Eletrônica reinforces a trend: trusted digital identity will increasingly be treated as critical infrastructure.
Companies that run sensitive journeys will need to record, audit and stand behind validation decisions with greater clarity.
Fortface was built for this scenario, combining facial authentication, certified liveness detection, anti-injection barriers and a journey designed for both security and usability.
Because in the digital environment, trust does not start with automation. It starts with the certainty that a real person is there at a decisive moment.
