The infrastructure play nobody's talking about
When you read that Itaú is deploying generative AI across its entire customer base—we're talking approximately 70 million customers in one of the world's most regulated banking sectors—your first instinct might be to focus on ia.i, the conversational interface they're rolling out. Text, voice, WhatsApp integration, the works.
But the real story is IARA. It's the governance and orchestration platform Itaú built first, before scaling customer-facing AI. And it's the kind of unsexy infrastructure decision that separates companies who ship AI demos from companies who ship AI products that survive contact with regulators, auditors, and enterprise risk committees.
Carlos Eduardo Mazzei, Itaú's CTO, is explicit about this: "IARA is a fundamental platform, because it ensures we can have governance and observability in a highly regulated environment." That's not marketing speak. That's the recognition that in banking, you don't get to move fast and break things. You get to move fast because you didn't break things.
What IARA actually does
IARA isn't a model. It's a layer that sits between Itaú's teams and multiple model providers—including OpenAI—and enforces three things simultaneously: cost control per token, accuracy of responses, and responsible AI policies.
Think of it as a policy engine with observability built in. Teams across the bank get controlled access to different models based on internal policies. The legal department, for example, uses IARA-mediated access to automate document reading and analysis across more than 90 million documents, executing over 2 million tasks per month with efficiency gains between 20% and 80% depending on the process stage.
Mazzei frames the problem clearly: "It is essential that this information be preserved, remain within the bank's context, and access models in a secure, governed way, with an understanding of token-use efficiency so that the entire solution is economically viable for the bank."
Token-use efficiency. Economic viability. These aren't afterthoughts—they're design constraints from day one.
The model portfolio strategy
Here's where it gets interesting. Itaú didn't pick a model. They picked a range of models, orchestrated through IARA, to handle everything from low-latency, cost-sensitive interactions to complex reasoning tasks.
Mazzei is clear about why: "OpenAI's models were very important in delivering this experience, because they were able to operate across this range of solutions. From the simplest ones, which need to be efficient in cost and latency, to more complex solutions, where reasoning and all the necessary grounding are required to provide an appropriate answer."
The GPT models are part of what Itaú calls "Customer DNA"—a financial context layer that maintains and enriches representations of customer needs, habits, and life stages for those 70 million users. But not every interaction hits the expensive models. The architecture routes requests based on what's actually needed.
This is the correct approach. A simple balance inquiry doesn't need the same compute as investment advice or contract interpretation. But most companies don't build the routing and governance infrastructure to make that distinction operational.
ia.i: the customer-facing layer
With IARA handling governance and orchestration, ia.i is the conversational interface customers actually see. Launched in 2024 with approximately 300,000 customers in the first phase, it's designed around three principles: interactivity, multimodality (text, voice, image, and clicks in the same experience), and individualization.
The use cases span the full banking journey—from checking an expense in an account statement to investment advice to transactions on WhatsApp. The goal, as Mazzei describes it, is making "the technology almost unnoticeable."
That's a high bar. The standard isn't "look at our cool AI"—it's "solve a real everyday problem" in a way that's direct, simple, and memorable. A study Itaú conducted with Grupo Consumoteca found that 80% of Brazilians want to better organize their financial lives, and 65% would like a financial copilot providing ongoing guidance. The demand is there. The challenge is delivery.
Mazzei notes that with the initial customer group, the bank is learning about "the real relationship between customer and product"—how people actually use it, where it adds value, where it doesn't. That's smart. Launch to a subset, instrument everything, learn actual behavior before scaling to the full base (planned for end of 2026).
Responsible AI as a product requirement
In a regulated sector, responsible AI isn't a nice-to-have—it's a blocking issue. Mazzei treats it as such: "When we talk about Responsible AI at the bank, it is a discipline we take great care with. We need customers to interact with the bank and our responses to align with our values and culture."
This includes bias mitigation in frontier models, continuous monitoring throughout the solution lifecycle, and ensuring safety, transparency, ethics, and regulatory compliance as the technology scales. It's baked into IARA's design.
The framing here matters. Most companies treat responsible AI as a compliance checkbox. Itaú is treating it as a product requirement and an architectural constraint. If you can't meet those requirements at scale, you don't get to scale.
AI First for employees, not just customers
The same intelligence layer powering ia.i also supports relationship managers, specialists, and customer service teams. The use cases range from automating simple tasks to enabling work that was previously unfeasible: meeting prep, issue summaries, plan development.
The bank's targets are aggressive: three times more time available for customer relationships, service up to twice as fast, conversations up to three times more effective. These aren't vague productivity vibes—they're specific efficiency multipliers.
Mazzei's framing: "This set of tools in the hands of relationship managers allows us to focus on what matters most: creating value for our customers." The AI handles the grunt work. Humans handle the relationship.
What this tells us about enterprise AI deployment
Itaú's approach inverts the usual pattern. Most companies start with a customer-facing demo, then scramble to build governance when regulators or risk committees start asking questions. Itaú built the governance platform first, then used it to enable rapid experimentation and deployment across multiple use cases.
The architecture—IARA as a centralized platform with observability, cost control, and policy enforcement—solves the "how do we actually operationalize this at scale" problem before it becomes a blocking issue. It's the difference between a proof-of-concept and a production system.
And the model portfolio strategy is worth noting. Real journeys combine low-latency interactions with decisions requiring deeper reasoning. Having a single model means you're either overpaying for simple tasks or underserving complex ones. A range of models, orchestrated through a governance layer, lets you optimize for both.
The lesson for anyone deploying AI in a regulated environment: build the platform that makes scale viable before you try to scale. Observability, cost control, and responsible AI aren't post-launch concerns. They're day-one architecture decisions.
Itaú is planning to expand ia.i to its entire customer base by the end of 2026, with capabilities including product simulations, sign-ups, and recurring financial analyses. That's a massive rollout. But with IARA in place, it's actually credible. The infrastructure is already there.