AI & Machine Learning Company in São Paulo

Three delivery shapes drive the range: a scoped AI proof of concept at Sao Paulo rates, a custom production ML model (Faria Lima-grade fraud scoring, credit decisioning, document extraction with Brazilian Portuguese NLP, demand forecasting at Mercado Livre-style cardinality), or full production AI systems with RAG, multiple models, fine-tuned Portuguese LLMs, and enterprise integrations. Scope drivers include data audit, a baseline model, a hosted demo, and an LGPD Article 20 review. Sao Paulo rates run above Belo Horizonte and Recife because of Faria Lima fintech compression on senior data science talent. We quote fixed fee on scoped phases.

LGPD (Lei Geral de Protecao de Dados, Law 13,709 of 2018) is the Brazilian general data protection law, enforced by the ANPD, which has been operationally active with guidance and penalties since 2022. The most AI-relevant article is Article 20, which gives data subjects the right to human review of decisions made solely by automated processing that affect their interests, including credit scoring, profile creation, professional and consumer assessments, and personality analysis. ANPD has published guidance on legitimate interest assessments for AI training, on personal data processing agents under Resolution 2 of 2022, and on international transfers under Article 33 and Resolution 19 of 2024. Our discovery phase produces an LGPD impact assessment, an Article 20 human-in-the-loop design when the use case warrants it, an ANPD-aligned consent or legitimate interest record, and a documented international transfer assessment if cross-border training or inference is in scope.

Substitutivo PL 2338/2023 is the Brazilian AI Bill working its way through the Senate, building on prior PL 21/2020 and aligning with EU AI Act risk-tiering. It classifies AI systems as excessive risk (prohibited), high risk (subject to risk assessment, transparency, human oversight, post-market monitoring, and ANPD coordination), and general purpose, with sector-specific rules layered for credit, employment, healthcare, education, and biometric identification. Even pre-enactment, Sao Paulo enterprises (Itau, Nubank, Mercado Livre) already operate under PL 2338-style governance because the BCB Communique 40,083, the Marco Civil da Internet, the CDC Consumer Defense Code, and the ANPD have collectively telegraphed the direction. Our discovery phase runs a PL 2338 risk classification on every AI engagement and ships high-risk builds with a documented risk assessment, transparency notice, human oversight design, and post-market monitoring plan.

Yes. We ship RAG, internal copilots, document extraction, KYC and KYB pipelines, and agent workflows for Brazilian banks and fintechs. For BCB-regulated clients we stay inside Brazilian regions where mandated (AWS sa-east-1, Azure Brazil South, GCP southamerica-east1), apply BCB Resolution 4658 cybersecurity controls and Communique 40,083 AI guidance, layer Circular 3978 AML hooks when the use case touches transaction monitoring, and produce the model risk documentation internal audit needs. We have patterned deployments after public engineering content from Itau, Nubank, and Bradesco, including strict PII redaction (CPF, CNPJ, conta corrente, agencia numbers, RG, CNH), Brazilian Portuguese prompt injection defences, human-in-the-loop review gates aligned with LGPD Article 20, and evaluation harnesses that run before every production push.

When a project requires genuine research, particularly on Brazilian Portuguese language modelling, rare-event detection at Mercado Livre scale, or novel reinforcement learning in production, we scope collaborations with USP (Universidade de Sao Paulo), UNICAMP (Universidade Estadual de Campinas), ITA, PUC-Rio, or Maritaca AI rather than overselling in-house capability. Our core team handles applied engineering, MLOps, and productionisation, which is where most Sao Paulo AI projects actually stall. For standard work (RAG with Sabia-3 or fine-tuned Llama 3 on Brazilian Portuguese, classical ML, computer vision on known architectures) no academic partner is needed. We will tell you up front which bucket your problem fits and we have introduced Sao Paulo clients to the USP Center for Artificial Intelligence (C4AI) industry partnership when it fits their roadmap.

Brazilian Portuguese (PT-BR) diverges from European Portuguese (PT-PT) and from Spanish enough that off-the-shelf multilingual models often underperform on Brazilian production data. PT-BR uses voce as the dominant second-person pronoun (PT-PT uses tu, and many Spanish-speaking foreigners assume Brazil speaks Spanish, which it does not), relies heavily on gerundios (estou fazendo vs estou a fazer in PT-PT), and uses different vocabulary across the domains AI most often touches: financial terms (cheque especial, parcelamento, boleto have no direct PT-PT or Spanish equivalent), legal terms (CPF, CNPJ, NF-e are Brazil-specific), and consumer terms (geladeira vs frigorifico, tela vs ecra, celular vs telemovel). We fine-tune on Brazilian-only corpora (Maritaca Sabia, Carolina, brWaC, OSCAR-BR), evaluate against ENEM, BLUEX, and ASSIN2 benchmarks, and have Brazilian linguists review training data quality. Generic multilingual evaluation overstates performance on Brazilian production traffic.

At Nubank scale (100M-plus customers, real-time card and PIX authorisation), fraud and credit ML run on a streaming architecture (Kafka or Kinesis ingestion, Flink or Spark Streaming feature computation, low-latency feature store via Feast or Tecton on Redis or DynamoDB) with sub-200ms p99 inference budgets at authorisation time, batch retraining nightly, and challenger model shadow deployments running continuously. Models are typically XGBoost or LightGBM ensembles for tabular fraud and credit signals (SHAP for explainability, which BCB increasingly expects), with deep learning reserved for embedding generation on transaction sequences and device telemetry. Bureau data integration covers Serasa, Boa Vista, SPC Brasil, and Quod. Open Finance Brasil consent-based data sharing is now a feature input where the customer journey supports it. Our engagements ship at this architecture pattern, not as scaled-down toy implementations.

We default to AWS sa-east-1 (Sao Paulo), Azure Brazil South (Sao Paulo) with Brazil Southeast (Rio) for DR, and GCP southamerica-east1 (Sao Paulo) for storage, training, and inference. For LLMs that must stay in Brazil under LGPD Article 33 international transfer constraints or sector regulation, we use Maritaca Sabia-3 (Brazilian-hosted Portuguese frontier model) or self-host Llama 3 and Mistral with Brazilian Portuguese continued pretraining on Brazilian GPU instances. Cross-border processing through Anthropic, OpenAI, or Cohere is acceptable when an Article 33 international transfer assessment signs off, typically for non-sensitive internal tooling or with documented Standard Contractual Clauses aligned with ANPD Resolution 19 of 2024. We document residency in the model card and the data processing agreement so ANPD auditors and your DPO have a clear answer.