Itaú Generative AI Is Going Bank-Wide, With Governance as the Real Test

Itaú has moved its generative AI strategy from targeted pilots to 300,000 customers, with a goal of reaching its entire customer base during 2026. The Itaú generative AI program now combines ia.i, a conversational banking interface, with IARA, an internal platform for governing models, data, costs, and risks.

That pairing matters more than the chatbot alone. Itaú wants customers to use ordinary language instead of navigating separate menus for accounts, credit, cards, insurance, and investments. Yet every broader conversation increases the chance of an inaccurate answer, inappropriate recommendation, privacy failure, or unauthorized action.

The bank is therefore testing two promises at once. The visible promise is that banking can become simpler and more personal. The less visible promise is that Itaú can keep generative models controlled inside a highly regulated institution. Bank of America’s Erica and JPMorganChase’s internal LLM Suite offer useful reference points, but Itaú is trying to connect customer conversations, employee tools, and governed model access through one architecture.

Itaú Generative AI Moves From Pilots to a Bank-Wide Interface

The change is not simply that Itaú added another assistant to its app. It is turning conversation into an access layer for the bank.

Itaú introduced ia.i publicly in July 2026 after building narrower artificial intelligence features since 2024. The interface accepts text or voice requests through the Itaú app. It is designed to identify a customer’s intent and connect that request with the relevant banking capability.

The initial release reached about 300,000 customers. Itaú said it planned to expand access to approximately 3 million people by September, followed by its complete customer base before year-end. The bank has not publicly provided final adoption or active-use numbers for those later stages.

The customer rollout covers more than questions and account discovery. Itaú says ia.i can provide information, interpret commands, guide decisions, and initiate supported transactions. It can also transfer a customer to specialized human assistance when the conversation requires it.

That creates a different experience from a fixed chatbot. A scripted assistant usually matches a question with a prepared response or a narrow workflow. A generative interface can interpret varied language, combine context, and generate a response for the current situation.

Itaú says ia.i considers financial context, relationship history, goals, and life stage when responding. Those inputs could help customers avoid searching across unrelated menus. They also make accuracy, data boundaries, and transparency more important.

A customer asking about a card payment presents a limited information problem. Someone asking whether they can afford a purchase presents a broader judgment problem. The system must determine what data matters, what it is allowed to use, and when human support becomes necessary.

The rollout follows several smaller deployments. These included an investment assistant, Pix payments through WhatsApp, tools for small businesses, and voice-enabled payment hardware. Each project tested a more confined task before Itaú attempted a common conversational layer.

One earlier investment feature began with 10,000 customers in 2025. That staged approach gave Itaú a way to test responses, customer behavior, and escalation paths before addressing a much larger population.

The progression also explains why the 2026 announcement is significant. Itaú is no longer presenting generative AI as an isolated experiment. It is making the technology part of how customers discover and use established financial services.

That transition creates the article’s central tension. A conversational layer must feel open enough to be useful, while remaining constrained enough to operate safely. The interface can hide the bank’s complexity, but it cannot remove the obligations behind each answer or transaction.

Why ia.i Is More Than a Chatbot Rollout

Itaú is betting that customers will begin with an intention, not a product menu, and let the bank determine the correct path.

Conventional banking apps organize services according to the institution’s structure. Customers choose accounts, cards, payments, loans, insurance, or investments. They must know which category contains the task they want to complete.

A conversational interface reverses that sequence. A customer can state a goal, problem, or question first. The system then identifies the relevant product, information source, or workflow.

That distinction sounds modest until the request crosses product boundaries. A question about saving for a purchase might involve cash flow, an account balance, card obligations, and an investment position. A useful response requires more than language generation.

Itaú calls the contextual layer behind this experience Customer DNA. According to the bank’s AI deployment, the system supplies financial context for about 70 million customers. OpenAI models are among the models used within Itaú’s governed environment.

The scale does not mean every customer receives an unconstrained financial adviser. It means Itaú has built a context system intended to support different experiences across a large customer population. The available data and permitted actions still depend on the specific use case.

Itaú says customers can move between basic convenience and more specialized guidance inside the same interface. A user might ask for account information, execute a supported command, or seek help understanding an investment decision.

The bank also says ia.i adapts to the customer’s language and can communicate through voice or text. This flexibility can reduce the need to learn exact menu names. It could also make digital banking more accessible to people who struggle with complex app navigation.

However, natural language introduces ambiguity that buttons avoid. “Pay my bill” can refer to several obligations. “Can I spend this?” can mean a balance check, a budget question, or a request for personalized financial advice.

The system must resolve that ambiguity without creating false confidence. It needs to confirm sensitive actions, distinguish information from advice, and avoid implying certainty when customer data is incomplete.

Itaú’s own research with Grupo Consumoteca found that 80% of surveyed Brazilians wanted better organization for their financial lives. It also found that 65% wanted technology that could provide continuing financial guidance. These are company-sponsored findings, not independent measurements of ia.i adoption.

The survey still identifies the demand Itaú hopes to address. Many customers do not need another list of products. They need help connecting their financial information with a decision they are trying to make.

That is why the assistant is strategically important. The bank that controls the conversational starting point can influence how customers find services, understand options, and escalate problems. It can also collect valuable signals about unmet needs.

Those advantages bring corresponding duties. Customers must understand when they are interacting with AI, how recommendations are produced, and when a human can review an outcome. A convenient interface should not blur responsibility for consequential decisions.

For knowledge workers, the same principle applies beyond banking. A useful AI knowledge base needs permission-aware context, reliable retrieval, and clear source boundaries. Fluent output alone does not establish trust.

IARA Puts Governance Between Models and Money

IARA is the central mechanism in Itaú’s strategy because it separates model access from uncontrolled model use.

IARA is Itaú’s governance and orchestration platform for artificial intelligence. Orchestration means the platform can route a task among models and supporting systems instead of tying every application to one provider.

The platform gives internal teams controlled access to multiple models. OpenAI is one provider available through that environment, rather than the only model supplier embedded across every workflow.

This model-agnostic approach gives Itaú several options. A less expensive model can handle a routine task where speed matters. A more capable reasoning model can process a difficult request when higher cost and latency are justified.

IARA also lets the bank apply common policies across those choices. Itaú says the platform monitors model use, response accuracy, token consumption, and responsible AI requirements. Tokens are the units used to process text through language models.

Centralization does not automatically make an AI system safe. It can, however, create one place for access controls, logging, model evaluation, cost limits, and policy enforcement. Without that layer, each product team could build different safeguards and data practices.

Itaú’s legal department provides the largest disclosed example. According to the bank, its legal AI solution works across more than 90 million documents and completes over 2 million tasks each month. The company reports efficiency gains ranging from 20% to 80% across different process stages.

Those percentages cover a wide range and come from Itaú, not an independent audit. They should not be treated as a universal productivity result. Legal document reading also differs from customer-facing financial guidance.

The example still demonstrates why orchestration matters. Processing a legal archive requires document permissions, retrieval, model selection, traceability, and output monitoring. The model generates only one part of the result.

Itaú says IARA keeps sensitive information within the bank’s context while controlling how applications access outside models. That boundary is essential when prompts may include customer, employee, transaction, or legal information.

The platform also supports observability, which means teams can inspect how systems behave after deployment. In banking, monitoring cannot stop when a model passes a launch evaluation. Customer language, fraud patterns, model behavior, and underlying products all change.

A model update can improve reasoning while altering refusal behavior. A revised product policy can make an older response incorrect. A new attack method can expose weaknesses that were absent during development.

IARA therefore needs to govern the full system lifecycle. That includes data access before a request, routing during processing, and review after the response. It also includes incident investigation when an answer produces harm or confusion.

The architecture resembles the direction taken by other large banks. JPMorganChase launched LLM Suite as a controlled generative AI environment for employees. The firm said the platform reached more than 200,000 onboarded users within eight months.

Itaú’s strategy extends the shared-platform idea toward customer conversations. That is a more exposed test because a customer can act on an answer immediately. Employees often have training, internal documentation, and review processes that consumers lack.

The choice of several models is another practical safeguard, but it creates management work. Itaú must continuously compare model quality, cost, latency, privacy terms, and behavior. A provider change cannot weaken a regulated workflow without detection.

No governance platform can remove every failure. Its value lies in making controls consistent, evidence visible, and intervention possible. That is a more credible foundation than relying on a model’s fluency or brand reputation.

The Competitive Pressure Is a Simpler Banking Interface

Itaú’s rivals are not competing only on model quality. They are competing to become the first place customers express financial intent.

Banks have used machine learning for fraud detection, credit analysis, personalization, and service routing for years. Conversational AI changes the presentation layer, not the existence of automation.

Bank of America offers the clearest large-scale precedent. Its virtual assistant Erica launched in 2018, before the current generative AI cycle. By August 2025, the bank reported more than 3 billion client interactions and nearly 50 million users.

The bank’s Erica usage data also shows the discipline behind a mature assistant. Bank of America said Erica used a controlled library of more than 700 responses and had received over 75,000 updates.

That design prioritizes predictable outcomes over open-ended generation. Itaú is pursuing a broader generative interface, but the Erica example shows why continuous maintenance matters. A financial assistant becomes an operating service, not a finished software feature.

Nubank also started testing a generative credit assistant with a restricted customer group in 2023. Its initial scope covered questions about credit limits, secured credit, NuPay, and personal loans. The limited launch reflected the risks of moving immediately into personalized credit discussions.

These approaches create pressure on every retail bank with a complex application. Once customers can state an intention directly, menu-heavy experiences begin to look inefficient. The comparison shifts from feature count toward how quickly the bank understands and completes a request.

Itaú has an advantage in the range of services it can connect. Accounts, cards, insurance, credit, payments, and investments can all contribute context. That breadth can produce more useful guidance than a single-purpose assistant.

It can also create conflicts. A bank may benefit when a customer adopts another product. The customer needs confidence that generated guidance reflects their interests, eligibility, and risk profile rather than an unmarked sales objective.

The interface must therefore preserve distinctions among education, assistance, recommendation, and promotion. Those categories carry different expectations. Combining them inside one friendly conversation could make their boundaries difficult to see.

Generative AI also gives technology providers more influence over banking interfaces. Model vendors supply language and reasoning capabilities, while banks contribute data, workflows, compliance rules, and customer relationships.

Itaú’s multi-model architecture reduces dependence on any single vendor. It does not eliminate external reliance because frontier models, cloud systems, and specialized infrastructure still evolve outside the bank.

The strategic contest is therefore not Itaú against OpenAI, or one bank against one model provider. It is controlled institutional context against generic model intelligence. The bank must prove that its data and governance produce a safer, more useful experience.

If ia.i succeeds, competitors will face pressure to unify their own assistants across products. A fragmented chatbot for support questions will look less capable beside an interface that can interpret goals and complete transactions.

If ia.i struggles, the industry may favor narrower assistants with carefully bounded actions. Banks could continue using generative AI internally while keeping consumer tools more deterministic.

That outcome would not mean the technology failed. It would show that high-stakes customer conversations require a different balance from document summaries, drafting tools, or employee search.

Itaú’s Scale Promise Meets Regulated Reality

The unresolved issue is whether Itaú can preserve accuracy, consent, and human accountability as ia.i expands beyond controlled cohorts.

Brazil’s financial system imposes requirements around security, consumer protection, data handling, recordkeeping, and operational resilience. Generative AI adds uncertain outputs to that existing framework.

The Banco Central do Brasil has identified artificial intelligence as an area requiring study of risks and effects across financial institutions. Updated cybersecurity rules also emphasize access controls, traceability, secure integration, testing, and infrastructure protection.

These requirements align with IARA’s stated purpose. However, Itaú has not publicly released detailed error rates, escalation rates, customer satisfaction results, or breakdowns of incidents involving ia.i. The available case studies focus mainly on architecture and intended benefits.

That evidence gap matters because deployment size alone does not establish quality. A system can reach millions of accounts while receiving limited active use. It can also handle simple requests well while struggling with unusual or consequential questions.

Three risks deserve particular attention.

First, generated answers can sound more certain than their evidence supports. In a banking context, an incorrect explanation can affect spending, borrowing, insurance, or investment behavior.

Retrieval from approved information can reduce this risk, but it cannot remove ambiguity. Product terms change, customer circumstances differ, and the model may combine correct facts into an unsuitable conclusion.

Second, personalization depends on personal data. The Brazilian data protection authority has highlighted risks involving prompts, model outputs, data sharing, retention, transparency, and the reuse of personal information.

The authority’s generative AI radar emphasizes that innovation must remain compatible with Brazil’s General Data Protection Law. It also notes that users may place their own data, or another person’s data, into prompts without recognizing the consequences.

For Itaú, governance must cover more than training data. It must address the information assembled for each interaction, the data sent to each model, the resulting response, and any record retained afterward.

Third, automated assistance can become an automated decision in practice, even when the system technically offers only guidance. Customers may follow a confident answer without requesting human review.

Brazil’s data protection agenda includes work on Article 20 of the LGPD, which addresses review of decisions based solely on automated personal-data processing. Itaú must maintain clear lines between conversational support, recommendations, and decisions that affect customer interests.

Human escalation is an important safeguard, but its design will determine its value. A transfer that loses the conversation’s context creates frustration. An escalation that happens only after an error may arrive too late.

The bank also needs to guard against prompt injection, fraud, account takeover, and social engineering. An attacker could attempt to manipulate the assistant, extract information, or trigger a sensitive workflow through deceptive language.

Confirmation steps remain necessary for transactions. The conversational layer should not weaken authentication simply because the request sounds natural. Convenience must end where authority remains uncertain.

Bias presents another challenge. A model can produce different tones, assumptions, or guidance for customers who phrase similar needs differently. Itaú says its responsible AI policies address bias, but it has not published detailed external evaluation results for ia.i.

Economic viability is another unproven part of the plan. Model usage creates variable costs, particularly when conversations require long context or deeper reasoning. Routing tasks across models can control spending, but broader adoption can still increase total consumption.

Itaú’s reported employee expectations also need validation. The bank anticipates that AI tools can give relationship managers three times more time for customer interactions. It expects service to become twice as fast and conversations up to three times more effective.

These are forward-looking company expectations. The terms “time available” and “effectiveness” can depend on internal measurement choices. Public reporting should eventually distinguish projected benefits from observed results.

A responsible assessment therefore has two sides. Itaú has disclosed a credible governance architecture and several meaningful deployments. It has not yet supplied enough independent or longitudinal evidence to confirm that the architecture works across its entire customer base.

Three Signals Will Decide Whether Itaú’s Bet Works

The next phase should be judged by verified behavior, not by the number of customers who receive an icon inside the banking app.

The first signal is sustained customer use after broad availability. Itaú should disclose active users, repeat use, completed tasks, abandonment, human transfers, and customer satisfaction. Growth from 300,000 eligible customers to universal access matters only if people trust the interface with real financial needs.

The second signal is evidence about accuracy and safeguards. Useful reporting would include error categories, successful transaction confirmations, complaint volumes, response corrections, and serious incidents. It should also explain how IARA evaluates different models before and after deployment.

Any publication from the Banco Central or Brazil’s data protection authority will add an external benchmark. The central bank is already studying AI risks in financial institutions, while the data authority is developing guidance around automated decisions and responsible data processing.

The third signal is whether competitors broaden their own assistants. Bank of America has proven that a constrained financial assistant can support enormous interaction volume. JPMorganChase has shown that a governed internal platform can reach hundreds of thousands of employees.

Itaú is trying to combine those paths. It wants customer-scale conversation, employee productivity, contextual financial data, and multiple model providers inside one controlled framework.

A successful rollout would strengthen the case that generative AI can become a primary interface for regulated services. A retreat toward narrow questions would support the opposite conclusion. It would suggest that deterministic workflows remain safer for consequential customer actions.

Developers and enterprise buyers should watch how Itaú divides responsibility across the model, orchestration layer, banking systems, and human staff. That division will matter in healthcare, insurance, legal services, and other regulated fields.

Customers should ask a simpler question whenever ia.i offers guidance: can the answer show its basis, its limits, and a reliable path to human review?

The Itaú generative AI strategy will not be decided by whether ia.i can hold a fluent conversation. It will be decided by whether the bank can make that conversation accurate, accountable, economical, and useful at full scale.