Inside a 200-Year-Old Bank’s AI Playbook: How Banco do Brasil, and the Rest of Financial Services, Actually Deploy AI

Key Takeaways

• Banco do Brasil, a 200-year-old public bank serving more than 80 million customers, built a unified AI governance framework with EY and IBM before scaling AI deployment further, treating governance as a precondition for trust rather than an afterthought.
• The bank’s approach combines EY’s Generative AI Lifecycle and Continuous AI Monitoring frameworks with IBM’s watsonx.governance toolkit, giving it real-time monitoring, explainability and traceability across its AI estate.
• Elsewhere in financial services, Italian insurer Unipol cut IT incident response time from 20 minutes to 90 seconds with an AI operations platform, while UK life insurance broker Reassured used AI-ready data infrastructure to personalise outreach by customer life stage.
• At global scale, JPMorgan Chase has extended LLM access to more than 200,000 employees, Mastercard’s AI fraud tools are used by 74 of the top 100 US banks, and Klarna’s 2024 customer service AI rollout became a widely cited case study in both AI’s potential and the limits of moving too fast, after the company partially reversed course in 2025.
• The pattern across all of these deployments is consistent: financial services firms are not adopting AI to replace judgment, but to make judgment faster, better monitored and, crucially, defensible to a regulator.

Financial services has a lower tolerance for error than almost any other industry adopting AI, and a correspondingly higher cost when that tolerance is breached. A retailer’s chatbot can hallucinate a return policy and apologise. A bank’s model that quietly discriminates in a lending decision, or an insurer’s system that denies a valid claim on flawed logic, can trigger a regulatory investigation, a class action, or the kind of reputational damage that outlasts the executives who approved the project. That asymmetry shapes everything about how the sector is actually deploying AI, and nowhere is it clearer than in the case of Banco do Brasil, the 200-year-old Brazilian bank that has made AI governance, not AI capability, its primary point of institutional pride.

The problem: a public bank with no room for a black box

Banco do Brasil is not a typical AI adopter. It is the oldest bank in Latin America, a public financial institution with regulatory duties to the Brazilian public, and, according to its own leadership, a company that plays what it calls a central role in the daily lives of the people it serves. That status creates a specific problem that a purely private, venture-backed fintech doesn’t face in the same way: the bank cannot simply adopt AI wherever it offers efficiency gains and clean up any resulting mess after the fact. It needed a way to bring AI into critical banking functions without compromising the trust, accountability and regulatory compliance that its public mission depends on, which meant governance had to be built into the adoption process itself, not bolted on once problems surfaced.

Rafael Rovani, the bank’s Head of Artificial Intelligence, framed the stakes in a way that doubles as a mission statement for the whole sector: “Banco do Brasil is over 200 years old and plays a central role in Brazilians’ lives. For us, AI doesn’t replace humans, it unleashes people’s potential by automating tasks. But that’s only possible with the right structure, culture and, most importantly, governance.” It is worth sitting with what that quote is actually claiming. Rovani isn’t arguing that governance slows AI down, or that it’s a necessary evil to be minimised. He’s arguing that governance is the enabling condition, the thing that makes broader AI adoption possible at all, rather than a brake applied afterward.

The solution: two frameworks, one system of control

To build that governance model, Banco do Brasil brought in two partners with complementary roles. Consulting firm EY designed the bank’s Generative AI Lifecycle and Continuous AI Monitoring frameworks, defining clear roles and responsibilities at every stage from model design through deployment, and building in rigorous evaluation processes such as benchmarking and vulnerability assessments for the foundation models underneath the bank’s AI applications. IBM then operationalised that strategy through its watsonx.governance toolkit, providing real-time monitoring, proactive alerts and customised metrics that give the bank a single, unified system of control across its entire AI estate, rather than a patchwork of separately monitored tools.

The combination gives Banco do Brasil something a growing number of regulators are starting to expect as a baseline rather than a bonus: the ability to validate every deployed AI model against standards for ethics, security and performance, with automated oversight across the full AI lifecycle, real-time monitoring and explainability for compliance purposes, and traceability and version control across its AI assets. That infrastructure is not static. The integration of IBM’s tools with EY’s frameworks is now being tested specifically against generative AI use cases, extending the same governance model that covers the bank’s existing AI deployments to the newer generation of applications built on large language models, rather than treating generative AI as a separate, less-scrutinised category.

Wider financial services AI usage: the pattern repeats, with variations

Banco do Brasil’s governance-first posture is not an isolated case. It shows up, in different forms, wherever financial services firms are moving past pilot projects into systems that actually touch customer money or customer data.

In Italian insurance, Unipol Assicurazioni, one of the country’s leading insurers, serving 16.8 million customers through its national agency network, faced a related but distinct problem: its IT operations team could only monitor about 26 percent of system events in near real-time, leaving the rest to slower, reactive processes that dragged down response times across the business. Unipol’s answer was NAMI, an AI-powered automation platform built on IBM’s watsonx ecosystem, combining watsonx.ai for generative AI use cases, watsonx Orchestrate for agentic workflows, and a multi-model approach blending Meta’s Llama, Mistral’s Pixtral AI and IBM’s own Granite models to match each task to the most suitable model rather than forcing every job through a single one. “With NAMI, we’re building an AI ecosystem that not only modernizes IT operations but also delivers predictive insights to guide smarter business decisions,” said Riccardo Perrotta, Head of IT Service Operations and Infrastructure at Unipol. The results were immediate and measurable: event response time fell from 20 minutes to 90 seconds, real-time event coverage rose from 26 percent to 100 percent, and incident handling time dropped by 90 percent.

The UK insurance market shows a third variation on the same theme, this time centred on personalisation rather than governance or operations. Reassured, the UK’s largest life insurance broker, had grown to serve a wide customer base without ever building a single, unified view of who those customers actually were, leaving outreach to run on broad, generic rules rather than anything tailored to an individual’s actual circumstances. “A 20 year old might need cover because they’re buying their first flat. That’s really different to a 55 year old interested in leaving a legacy for their family,” said Beth Whelan, Chief Data and Insights Officer at Reassured. Data consultancy FOIL was brought in to fix the underlying data problem before any AI layer was added on top. “The first step wasn’t just ‘you need AI, ML.’ But actually tying it back to something real and tangible to Reassured – ultimately what we realised was it was all about their customers,” said Mish Naik, Head of Strategy at FOIL. It is a small but telling detail: even in an engagement explicitly aimed at eventually enabling AI-driven personalisation, the actual first move was building a clean, unified data foundation, echoing the same “governance and data before intelligence” sequencing visible at Banco do Brasil and, for that matter, across most of the enterprise AI deployments this publication has covered.

Beyond these specific cases, the same dynamics are visible at much larger scale across the industry. JPMorgan Chase has extended its internally built LLM Suite, giving employees secure, compliance-controlled access to large language models from providers including OpenAI and Anthropic, to more than 200,000 staff, with the bank describing plans to expand to over a thousand distinct AI use cases. Mastercard’s AI-driven fraud detection tools are now used by 74 of the top 100 US banks and more than 2,000 clients globally, part of an industry response to a fraud problem industry researchers, in Nasdaq Verafin’s 2024 Global Financial Crime Report, estimated cost the global economy more than $485 billion. And Klarna’s 2024 customer service AI rollout, built with OpenAI and initially reported as handling the workload of roughly 700 full-time agents within its first month, later becoming the equivalent of more than 850 agents by 2025, has become one of the most closely watched case studies in the sector for a different reason: in May 2025, Klarna’s own chief executive publicly acknowledged the company had cut its human support capacity too aggressively and began rehiring for premium support roles. It is a useful corrective to any narrative that treats financial services AI adoption as an uncomplicated success story. Even a technically effective deployment can outrun the organisational judgement needed to calibrate it correctly, which is, in its own way, exactly the argument Banco do Brasil’s Rafael Rovani was making about governance in the first place.

What the pattern says about the sector

Set these cases side by side and a consistent logic emerges, one that has less to do with any particular vendor or model and more to do with what financial services firms have collectively concluded AI is actually for. None of these organisations, from a 200-year-old Brazilian public bank to a two-decade-old Swedish fintech, adopted AI on the premise that it would think for them. Banco do Brasil built governance before scaling. Unipol built unified monitoring before letting AI make autonomous decisions about which incidents needed human attention. Reassured built a clean data foundation before attempting personalisation. Even Klarna, the case most associated with AI moving fast, ended up publicly recalibrating rather than reversing course entirely. The institutions getting real, durable value from AI in financial services are the ones treating it not as a replacement for judgement, but as a way to make judgement faster to exercise, easier to monitor, and, when a regulator eventually asks, straightforward to explain.