Ninety-five percent of Brazilian companies already use generative AI. On its own, that number looks like a win. The problem shows up in the next question: how many of those companies can say where the data feeding that AI comes from, who can access it, and what happens when a model makes a bad call based on it? According to the same research, almost none.
The 2026 AI Readiness Survey, run by Bain & Company with Microsoft — over 1,200 business leaders surveyed —, puts three numbers side by side that rarely get analyzed together: 95% of companies in Brazil use generative AI; 83% lack an adequate data governance framework; and only 41% achieved a positive financial return in the first 12 months. Mass adoption, almost no governance, returns concentrated in a minority. These aren’t three separate problems. They’re the same problem seen from three angles.
The pipe decides what comes out of the tap
Picture the sales team at a mid-size company using an AI assistant to rank which leads a rep should call first. The model itself is solid — trained on sales history, cross-referencing customer profile with purchase likelihood. The problem is the customer base feeding that model: part of it lives in the CRM, part in a spreadsheet marketing keeps on the side, part in a legacy system nobody maintains properly anymore. None of those three sources has a clear owner, none goes through a quality check before entering the model, and when the model makes an embarrassing call — ranking a customer who cancelled six months ago as top priority — nobody can say which of the three sources caused it.
The rep stops trusting the list. Goes back to prioritizing by gut feeling, the old way. The AI investment stays on the budget, still gets mentioned in the board meeting as a “strategic initiative,” but in practice has quietly become a tool nobody really uses. That is exactly the mechanics behind the 41% figure: it’s not that the model is bad. It’s that the water running through the pipe is dirty, and no AI — no matter how sophisticated — purifies at the output what went in contaminated at the input.
What “data governance for AI” actually means
The term sounds abstract until it’s broken down into four concrete pieces, none of which require a data science team to exist:
Source catalog. For every AI use case in production, being able to name exactly which datasets feed that model — and who owns each one. Without this, an error can’t be investigated: nobody knows where to look.
Role-based access control. Not every piece of data should be available to every model, and not every model should be available to every user. Sensitive financial data feeding a customer-facing chatbot is a leak waiting to happen, not a remote hypothesis.
Quality checkpoint before input. Validating that data is complete, current, and in the expected format before it feeds a production model — not after the wrong decision has already gone out. It’s the difference between reviewing a contract before signing it and trying to undo it afterward.
Decision audit trail. When an AI recommends, approves, or prioritizes something, it needs to be possible to reconstruct later which version of which data drove that decision. Without this, every AI decision is a black box — even to whoever built the model.
None of these four pieces is about the AI model itself. All of them are about what happens before the model — which explains why so many companies invest heavily in the tool and almost nothing in the foundation underneath it.
Formalize the data before automating the decision
That’s also the read from innovation executive João Paulo Batistella, who has held leadership roles at Ericsson, Telefônica/Vivo, and spent five years as CEO of EISA, when he argues that AI depends on process formalized into data — not on knowledge that only exists in someone’s head. Data governance is that same principle applied before a company even picks which model to use: if nobody can name a piece of data’s origin, quality, and owner, that data isn’t ready to drive an automated decision, no matter how advanced the model on the other end is.
That’s why treating governance as an IT task — a cataloging project someone will get to “when there’s time” — is the same mistake, in different clothes, as treating AI adoption as a technical decision rather than a business one. Bad data governance rarely shows up as a security incident. It shows up as a strange decision nobody can explain, a report the board stops trusting, and an AI project that quietly stops being used.
Start small, but start with the right risk
This doesn’t mean building bank-grade governance infrastructure before launching any AI project. For a low-risk use case — an automatic meeting summary, say — a simple one-page checklist is enough. For a use case that touches money, customer data, or decisions that affect people — credit approval, support prioritization, resume screening —, the four pieces above stop being best practice and become a prerequisite. The most common mistake isn’t skipping governance. It’s applying the same level of rigor — or the same level of neglect — to both cases.
The question that separates companies from that 83% without governance is easy to ask and hard to answer on the spot: for the company’s main AI use case today, can anyone name, in under a minute, where the data comes from, who can access it, and how to audit the last decision it produced? If the answer is no, the problem isn’t the model. It’s three steps before it.
Follow Eleva Tecnologia for more analysis on technology applied to business: follow @ElevaTechno on X, @elevatechnologies on Instagram or Eleva Technologies on LinkedIn, or learn about the group at elevatec.net/about.
