Brazil is beginning to occupy a position that is hard to ignore in the global artificial intelligence market. According to data released by OpenAI in August 2026, the country is among ChatGPT's three largest markets by weekly active users, generates around 215 million messages per day, and ranks second worldwide in the number of developers using the company's API. In the enterprise market, the number of ChatGPT Enterprise licenses in Brazil grew fivefold in one year.
That volume is beginning to show up in investment decisions: OpenAI began commercial operations in São Paulo, establishing its first office in Latin America and its first in the Americas outside the United States. During the same period, Alibaba Cloud opened its first cloud region in Brazil, with two data centers and local infrastructure for computing, storage, networking, databases, and artificial intelligence services.
These are different moves, but they point to the same issue: Brazil already has enough scale to justify a closer presence by major AI and infrastructure providers.
Enterprise adoption, however, brings challenges different from those faced by individual users.
The model is only one part of the architecture#
When a company purchases access to an LLM, the model represents only one part of the environment needed to put it into production.
In regulated industries, identity, access management, encryption, private connectivity, observability, traceability, data retention, incident management, leak prevention, and integration with enterprise systems also come into play.
CD/ANPD Resolution No. 19/2024, which regulates international transfers, requires these operations to be associated with legitimate, specific, explicit, and disclosed purposes, to use a lawful basis and valid transfer mechanism, and to be limited to the data necessary for the intended purpose. The regulation also reinforces accountability principles and requires effective measures capable of demonstrating compliance with the rules and the effectiveness of the controls adopted.
The financial system has an additional layer. For institutions covered by CMN Resolution No. 4,893, procuring significant data-processing, data-storage, and cloud-computing services involves prior assessment of the provider's capacity, contractual requirements, monitoring, and the institution's own capacity to manage the contracted services.
In cases stipulated by regulation, the procurement must also be reported to the Central Bank. When significant services are provided abroad, the countries and regions where services may be performed and where data may be stored, processed, and managed become part of that analysis.
The update introduced by CMN Resolution No. 5,274 in December 2025 expanded and detailed the minimum cybersecurity controls, including authentication, encryption, intrusion prevention and detection, information-leak prevention, traceability, vulnerability management, access controls, and secure configurations.
For a regulated company, therefore, adopting a new AI provider involves much more than signing a contract and obtaining an API key.
Why hyperscalers have an advantage#
AWS, Azure, and Google Cloud are already present in many large Brazilian companies. That means many clients already have negotiated contracts, completed procurement processes, security teams familiar with the platform, configured private networks, IAM, KMS, logs, SIEM, and governance policies.
When an AI model is consumed within that same environment, some of the technical and administrative complexity is reduced.
This context helps explain why major providers are expanding their AI offerings beyond model access. Anthropic, for example, allows different ways of using Claude within the AWS ecosystem, including Amazon Bedrock, AWS Marketplace, and arrangements that use AWS authentication and billing.
For an enterprise client, that integration can mean fewer vendors, less friction in the approval process, and an architecture closer to the controls the company already uses.
The same movement is visible in other ecosystems. Azure AI Foundry, Amazon Bedrock, and Vertex AI are evolving into broader platforms, bringing together models, identity, observability, evaluation, security, and services aimed at application and agent development.
Model manufacturers themselves have also begun expanding their offerings to specific sectors and use cases. OpenAI has launched products aimed at Healthcare and Financial Services, while Anthropic has been developing its own solutions for financial services, healthcare, and life sciences, as well as specialized products in areas such as security and scientific research. Google and other providers are following a similar path.
This shows an important market shift: competition is beginning to involve not just model quality but also the ability to deliver integrations, controls, data, tools, and workflows appropriate to each industry, reducing the effort required to put AI into production in complex enterprise environments.
Direct procurement still has some differences#
Purchasing directly from a model provider can also offer important enterprise capabilities. OpenAI, for example, offers features such as Zero Data Retention for eligible organizations, Enterprise Key Management, access controls, auditability, and different configurations related to data storage and processing.
Even so, some capabilities depend on region, product, or procurement arrangement. Today, for example, Brazil is not among the configurable data-residency regions for OpenAI's API, which does not mean using the service is incompatible with the LGPD. International data transfer is not prohibited by Brazilian law, but it must comply with the grounds and mechanisms provided for in the LGPD and ANPD regulations.
For companies, the analysis involves questions such as the purpose of that processing, which data really needs to cross the corporate-environment boundary, which transfer mechanism applies, which controls should be used, and how to demonstrate afterward that those rules were followed.
This is where architecture, security, legal, privacy, and governance begin to converge.
There is also a trade-off#
The integration offered by hyperscalers solves several problems at once, but creates another. Platforms such as Bedrock, Vertex AI, and Foundry allow different models to be used within a common environment, which means that, from this perspective, they can reduce lock-in to a particular model.
Replacing Claude with another model available within the same platform, for example, tends to require fewer changes than rebuilding the entire infrastructure around the application.
At the same time, each new component integrated into the hyperscaler increases dependence on that platform: IAM, KMS, observability, private networks, databases, agents, evaluation services, policies, and billing begin forming an increasingly coupled architecture. Lock-in stops being concentrated in the LLM and starts existing in the operational infrastructure.
This may be one of the most important architectural decisions of the coming years.
An opportunity for the Brazilian market#
The growth of AI use in Brazil raises an interesting question: there may be room for an infrastructure layer created specifically to operate AI in regulated Brazilian environments, capable of understanding the LGPD, ANPD regulations, and sector-specific requirements without being limited to a single model or hyperscaler.
It could operate between enterprise applications and AI providers, evaluating context, data classification, purpose, industry, and corporate policies before a request is sent to the model.
This layer could decide which data may leave the company's environment, which information must be removed, masked, tokenized, or pseudonymized, which models and regions may be used, which tools an agent is authorized to execute, and in which situations an action requires human approval.
It could also record the decisions taken and controls actually applied, creating evidence for audits, incident investigations, and accountability. Some governance would then cease to exist only in documents and would instead be executed and recorded while the application operates.
The architecture could continue allowing OpenAI, Anthropic, Google, or models made available through hyperscalers, while regulatory intelligence would remain above those providers.
This design also creates a possible answer to the lock-in problem: keeping some policies, decisions, and evidence outside the platform responsible for inference.
The next stage of AI infrastructure in Brazil#
As AI moves from isolated experiments to systems that access data, call APIs, and perform real actions, the environment needed around the model grows. Providers have already noticed: models are being accompanied by private networks, observability, evaluation, identity, agents, security, development tools, and offerings specific to regulated industries.
Brazil, because of its scale and the level of regulation in sectors such as finance, insurance, and healthcare, could become a particularly interesting market for this kind of infrastructure. The arrival of new cloud regions, major providers' growing local presence, and increased enterprise use of AI are signs of this evolution.
The challenge now is to build an operational layer that can combine innovation, portability, and local requirements without turning every new AI application into a new regulatory-integration project.
Sources:
OpenAI — presence and adoption in Brazil: openai.com/index/expanding-our-presence-in-brazil/
OpenAI — data controls, retention, and data residency: developers.openai.com/api/docs/guides/your-data
Alibaba Cloud — first cloud region in Brazil: alibabacloud.com/pt-BR/press-room/alibaba-cloud-launch-first-cloud-region-in-brazil
ANPD — Resolution No. 19/2024 on international data transfers: gov.br/anpd — CD/ANPD Resolution No. 19
ANPD — International Data Transfers: gov.br/anpd — International Data Transfers
Central Bank — CMN Resolution No. 4,893, cybersecurity and cloud procurement: bcb.gov.br — CMN Resolution No. 4,893
Central Bank — CMN Resolution No. 5,274/2025, updated controls: bcb.gov.br — CMN Resolution No. 5,274
AWS/Anthropic — Claude Platform on AWS, IAM, and AWS integration: docs.aws.amazon.com/claude-platform/
AWS Marketplace/Anthropic — Claude Platform procurement and billing: aws.amazon.com/marketplace — Claude Platform
Microsoft — Foundry availability in Brazil South: learn.microsoft.com/azure/foundry/reference/region-support
Microsoft — observability for AI applications and agents:learn.microsoft.com/azure/foundry/concepts/observability