Digital Compliance and LGPD in the Financial Sector: Challenges in the Age of Artificial Intelligence.

Arlene Pereira da Silva Sacco; Thaís Helena Zero de Oliveira Pereira

DOI: 10.22167/2675-6528-202602680

Article derived from a Course Conclusion Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by Instituto Pecege for textual synthesis and organization.

Summary

The research analyzed the challenges and strategies associated with the application of digital compliance pillars to ensure compliance with the General Data Protection Law (LGPD) in an organizational context marked by the increasing use of artificial intelligence systems in the financial sector. A qualitative and descriptive approach was adopted, operationalized through a single case study, based on documentary analysis of public institutional reports from the period 2022 to 2024, as well as initiatives planned for 2025. The data were examined by content analysis, guided by analytical categories on digital compliance, LGPD, risk management, technical and organizational controls, transparency, and accountability. The results showed a progressive evolution of institutional maturity, with strengthening of formal governance structures, revision of regulations, training of employees, and adoption of technological controls aimed at protecting personal data and information security. It was observed that, from 2023 onwards, LGPD compliance began to be addressed more explicitly and structurally, culminating, in 2024, in the presentation of measurable evidence and the integration of governance, risk management, and digital transformation. It was concluded that the effectiveness of digital compliance, in environments that incorporate artificial intelligence, depends on the consolidation of institutional practices and the continuous evolution of governance and control mechanisms.

Keywords: Digital compliance; Artificial Intelligence; LGPD; Financial sector.

1. Introduction

The evolution of the Brazilian regulatory framework for data protection, driven by the enactment of Law number 13.709/2018, known as the General Data Protection Law (LGPD), has required organizations to implement robust governance models. These models aim to ensure transparency, security, and accountability in the processing of personal information (Brazil, 2018; Doneda, 2019). This regulatory scenario becomes more complex with the increasing integration of artificial intelligence (AI) systems into decision-making and operational processes, especially in the financial sector.

The incorporation of artificial intelligence presents significant challenges for regulatory compliance, due to algorithmic opacity and the difficulty of auditing its processes (Pasquale, 2015; O’neil, 2016). The LGPD, by combining a principled structure with the requirement for good practices and governance mechanisms, imposes on processing agents the need to mitigate risks and continuously demonstrate the effectiveness of the measures adopted (Mulholland and Gomes, 2021). In the financial sector, which deals with large volumes of data and has high operational criticality, the complexity is amplified by robust regulatory requirements (OECD, 2015; Belli et al., 2023).

Financial institutions increasingly rely on AI solutions for analysis, customer segmentation, and decision-making, using personal data as a central input for their business models (Moretti; Zuffo, 2023; Munhoz; Arima, 2021). Although artificial intelligence promotes efficiency and innovation, it also intensifies risks such as algorithmic discrimination, lack of explainability, and the potential for adverse impacts on the fundamental rights of data subjects (Motta and Rosa, 2024; Nardi and Lutzky, 2023). This digital transformation demands a redefinition of governance, internal controls, and accountability for the processing of personal data, with responsibility as a central principle of compliance (Bioni, 2020; Doneda, 2019).

In this context, the concept of digital compliance emerges as an evolution of traditional compliance models, integrating technological, organizational, and normative dimensions for the governance of digital data and systems. Unlike classic compliance, focused on formal adherence to norms, digital compliance encompasses the integration of institutional policies, technical controls, technological risk management, and accountability mechanisms. Its objective is to ensure continuous compliance in environments characterized by automation and the intensive use of data and artificial intelligence (Power, 2007; Bennett; Raab, 2018; OECD, 2015). Compliance, from this perspective, is a dynamic process that requires constant monitoring, updating of controls, and strengthening of organizational culture.

Effective digital compliance programs must align with systematic practices for identifying, assessing, and mitigating risks, especially those associated with automated data processing and algorithmic decision-making, according to international guidelines for corporate governance and risk management (OECD, 2015; Sadiq; Governatori; Namiri, 2015). The need to ensure privacy, security, transparency, and accountability in the use of AI by financial institutions, considering the inherent risks, regulatory expectations, and social demands for digital ethics, justifies the relevance of this study (Pasquale, 2015; Eccles; Ioannou; Serafeim, 2014).

Thus, the present study is justified by the need to analyze how digital compliance programs can be conceived, structured, and improved to ensure continuous compliance with the LGPD when AI technologies are widely integrated into decision-making, service, and operational flows. The scientific relevance lies in the scarcity of applied research that addresses, in an integrated manner, LGPD, artificial intelligence, and digital compliance in the financial context (Belli et al., 2023). The practical relevance, in turn, lies in providing a reflection oriented towards managers, compliance professionals, technology teams, and decision-makers on how to operationalize legal principles in complex technological environments (Power, 2007; OECD, 2020). Given this context, the work aimed to analyze the challenges in applying the pillars of digital compliance to ensure LGPD compliance in the use of artificial intelligence systems in a specific organization in the financial sector.

2. Material and Methods

The present study adopted a qualitative methodological approach of a descriptive nature, designed to understand complex phenomena in their real context. This choice allowed for an in-depth analysis of organizational practices, decision-making processes, and governance structures (Gil, 2008; Severino, 2016). The research was classified as descriptive, seeking to identify, systematize, and interpret declared practices, with analytical potential for analogous organizational contexts (Gil, 2010; Yin, 2015).

The empirical scope focused on a single institution in the financial sector, selected for the relevance of its operations, volume of personal data processed, and progressive incorporation of artificial intelligence solutions. This delimitation allowed for an analysis of the practical challenges in applying the pillars of digital compliance in an environment of regulatory complexity, aligning with the objective of investigating LGPD compliance in the use of AI systems.

The research instrument used was documentary analysis, applied to institutional reports of an ESG (Environmental, Social and Governance) nature. These documents, including Social, Environmental and Climate Responsibility Reports (RSAC), GRSAC Reports, and ESG Communication Plans, were chosen because they represent official sources for disclosing the studied organization’s corporate governance, socio-environmental responsibility, risk management, and regulatory compliance practices. They provided structured information on policies, internal controls, training, digital transformation, and personal data protection.

Data collection occurred between August 2025 and February 2026, through the survey and analysis of public institutional documents. Reports from 2022, 2023, and 2024 were analyzed, in addition to the ESG Communication Plan for 2025, aiming to capture the temporal evolution of organizational practices. Selection criteria included: public and institutional character; thematic relevance for corporate governance, personal data protection, risk management, and digital transformation; and the presence of information on intensive use of personal data and artificial intelligence technologies.

To explicitly state the normative references that supported the analysis, the following were considered: Law No. 13.709/2018 (LGPD), ANPD Resolutions and Guides (2020-2024), OECD Recommendations on Corporate Governance and Risk Management (2015), OECD Principles on Artificial Intelligence (2019), ISO/IEC 27001 (2013, rev. 2022), and ISO/IEC 27701 (2019). The data analysis was conducted through qualitative content analysis, according to Bardin’s (2016) methodological framework. An exploratory reading of the documents was performed to identify excerpts and evidence related to the governance structure, internal control mechanisms, privacy policies, and digital transformation initiatives.

Next, an analytical reading was carried out, guided by categories previously defined based on the study’s theoretical and normative framework, especially the pillars of digital compliance. The analytical categories used included: data governance; risk management; technical and organizational controls; transparency and accountability; compliance culture and training; and institutional communication on privacy and risks. The extracted information was grouped and interpreted according to these categories, considering the temporal evolution of practices between the documents from 2022 to 2025.

To synthesize the evolution of the identified practices, a maturity matrix based on analytical categories was developed. This matrix served as a complementary tool to the qualitative content analysis, representing the degree of development of practices related to the pillars of digital compliance over the analyzed period. The classification adopted an ordinal maturity scale ranging from zero to four, where level zero indicated absence of evidence and level four, consolidated practices with indicators and monitoring. The assignment of levels resulted from the systematic interpretation of the document content in light of the theoretical and normative framework, seeking to understand the contribution of institutional practices to risk mitigation and continuous compliance with the LGPD (Severino, 2016; Amaro, 2017).

3. Results and Discussion

The analysis of institutional documents, covering the years 2022, 2023, and 2024, revealed a consistent trajectory of institutional maturation. This process was manifested in the evolution of governance arrangements, risk management, and regulatory compliance, with a growing emphasis on personal data protection and the integration of compliance practices into digital transformation. Throughout the period, the consolidation of formal structures, the expansion of operational evidence, and the progressive introduction of technological controls were observed, reflecting an understanding of compliance as an integrated system of organizational governance, control, and accountability (Power, 2007; OECD, 2015).

The evolution of institutional maturity did not occur abruptly, but through gradual and cumulative advances, as identified in the categories of governance, risks and controls, policies and standards, transparency and channels, third-party management, training and culture, privacy/LGPD, cybersecurity, and AI/analytics. Initially, the focus was on organizing decision-making bodies and oversight mechanisms. Subsequently, operational and cultural practices were incorporated, culminating in the consolidation of digital controls accompanied by metrics and indicators, especially in the fields of data protection and information security.

In the 2022 GRSAC Report, the institution demonstrated a predominant emphasis on structuring social, environmental, and climate risk governance. The document detailed the definition of institutional roles, the competencies of boards, directorates, and committees, as well as the procedures for approval, regulatory review, and target monitoring. At this stage, compliance was treated from an organizational and regulatory perspective, establishing the institutional foundations for control and supervision, without explicitly detailing the technological dimensions of compliance (POUPEX, 2022).

Still in 2022, the RSAC Report (PRSAC) expanded its scope by articulating risk governance with operational and cultural aspects of compliance. The formalization of the Social, Environmental, and Climate Responsibility Policy, the strengthening of the Ombudsman’s Office as a channel for transparency, and the definition of socio-environmental criteria for suppliers were evidence that transcended mere structural description. Training actions, especially in money laundering prevention, and process digitalization initiatives indicated an initial convergence between operational efficiency, sustainability, and governance, although digital compliance was still in its incipient phase (POUPEX, 2022b).

The 2023 RSAC Report marked a significant turning point, by explicitly incorporating personal data protection and compliance with the General Data Protection Law (LGPD). Compliance became supported by privacy policies, data subject service channels, systematic information security training programs, and records of cybersecurity initiatives. The mention of training actions in analytics and artificial intelligence reinforced the growing centrality of digital technologies in institutional functioning, indicating that compliance is not restricted to formal rules, but integrates technological and organizational dimensions, with risk management in digital environments aligned with accountability and transparency (Doneda, 2019; Mulholland; Gomes, 2021; POUPEX, 2023).

This maturation trajectory was consolidated in the 2024 PRSAC/ESG Report, which presented more robust and measurable evidence. The adoption of international reporting standards, the disclosure of quantitative indicators, and the description of specific technological controls, such as the implementation of data loss prevention (DLP) solutions, monitoring of data subject requests within legal deadlines, and external evaluation of the privacy program, indicated a higher level of institutional maturity.

Additionally, the structured mapping of operational risks, advances in the automation and monitoring of Anti-Money Laundering and Terrorist Financing Prevention (AML/CFT), and the use of artificial intelligence in customer service, accompanied by experience and satisfaction metrics, evidenced the transition to an integrated compliance model, data-driven and technology-supported (POUPEX, 2024). This evolution reinforces the understanding that regulatory compliance, in contexts of data use and AI systems, depends not only on formal policies but also on institutional arrangements, continuous training, and adequate technological infrastructure.

The analysis also showed that digital transformation and the adoption of data-based technologies, including automation and artificial intelligence applied to customer service processes and operational efficiency, coexist with structured risk mitigation efforts. The digitalization of processes and electronic document management are configured as strategic initiatives, simultaneously contributing to operational gains, information traceability, and strengthening of data governance, in line with the principles of privacy by design and privacy by default (Cavoukian, 2010).

However, the documents indicate that the expansion of these solutions demands continuous updating of controls, especially regarding explainability, human supervision, and the governance of data use in automated environments. Artificial intelligence governance, despite records of using AI-based solutions for customer service support and capacity-building and innovation initiatives, is still in a development stage, without the formalization of a specific system along the lines recommended by international frameworks such as the NIST AI Risk Management Framework and the ISO/IEC 42001 standard.

Another relevant result refers to the integration between compliance, risk management, and the ESG agenda. The analyzed reports demonstrate that practices associated with governance, privacy, operational risk management, and social, environmental, and climate risks are treated in an articulated manner, in alignment with both the regulatory requirements of the financial sector and international reporting standards. This finding converges with the literature that understands ESG as an inseparable element of contemporary corporate governance, especially in data-intensive financial institutions (Eccles; Ioannou; Serafeim, 2014; Friede; Busch; Bassen, 2015).

The integrated reading of the documents indicates that the analyzed period reflects, on the one hand, the consolidation of digital compliance oriented towards LGPD and information security and, on the other hand, the emergence of still initial signs of AI governance. These signs configure a plausible agenda for institutional deepening, necessary to ensure regulatory compliance and risk management associated with the use of AI systems in the financial sector, in line with the principles of reliability and accountability highlighted in international guidelines (NIST, 2023; ISO/IEC).

However, the results also show that, despite the existence of formal structures and consolidated governance and compliance practices, challenges persist related to the growing complexity of the regulatory and technological environment, especially given the expansion of the use of artificial intelligence-based solutions. The absence of sufficient transparency regarding the AI systems used is observed, to some extent, which limits the institutional capacity to fully demonstrate compliance with applicable norms and the presence of all accountability elements, such as leadership and supervision, systematic risk assessment, specific policies and procedures, as well as monitoring and verification mechanisms (Vainzof, 2021).

A relevant aspect observed in the analysis of the reports refers to the need to reconcile the principles of transparency and accountability with the confidentiality requirements inherent in the financial sector. Unlike organizations whose processes can be widely disclosed, financial institutions operate in environments characterized by the protection of strategic information, sensitive personal data, and security mechanisms that cannot be fully exposed to the public without generating additional risks to the organization itself or to the holders of personal data.

In this context, the effectiveness of control mechanisms should not be evaluated exclusively by the detailed disclosure of adopted procedures, but by the institutional capacity to demonstrate that these procedures exist, are monitored, and produce verifiable results. Traceability plays a central role in this process, as it allows for the reconstruction of decisions, the recording of relevant events, the identification of those responsible for critical activities, and the production of evidence of compliance for internal and external audits. Although the analyzed reports do not technically detail the registration and monitoring mechanisms used by the institution, the existence of formal risk management processes, performance indicators, external evaluation of the privacy program, and the implementation of technological controls, such as data loss prevention (DLP) solutions, suggests the adoption of structures aimed at generating auditable evidence and supporting the principle of accountability.

From an auditing perspective, accountability in confidential environments occurs through the production of indirect evidence of compliance. Instead of making sensitive operational information public, the organization demonstrates the existence of policies, monitoring processes, periodic evaluations, training programs, and performance indicators related to privacy, information security, and risk management. This model allows control bodies, independent audits, and governance instances to assess the effectiveness of controls without compromising the confidentiality required by the regulated environment in which the institution operates.

The discussion becomes even more relevant given the growing incorporation of solutions based on artificial intelligence. AI systems can introduce risks related to algorithmic opacity, difficulty in explaining the results produced, and the eventual reproduction of biases present in the data used for training or parameterization. In financial environments, these risks can impact customer service processes, segmentation, product granting, or other decisions supported by automated models.

In this sense, the mitigation of algorithmic biases depends less on the public disclosure of the models used and more on the existence of robust governance mechanisms, capable of ensuring human supervision, periodic validation of results, monitoring of deviations, management of technological risks, and documentation of automated decisions (NIST, 2023; OECD, 2019; EUROPEAN UNION, 2024). The analyzed reports indicate important advances related to training in analytics and artificial intelligence, strengthening risk management, and adopting technological controls aimed at protecting personal data.

However, sufficient documentary evidence was not identified to confirm the existence of a formalized AI governance structure, with specific processes for assessing algorithmic impacts, monitoring biases, or auditing the employed models. This finding does not necessarily represent an absence of controls, but it highlights a typical limitation of studies based on public documents, in which a significant part of the technical mechanisms remains protected for legitimate reasons of institutional security and confidentiality (NIST, 2023; OECD, 2019).

Therefore, the analysis suggests that the future evolution of maturity in digital compliance may be associated with increased transparency on algorithmic governance practices, even if carried out through aggregated indicators, supervisory reports, or independent assessments, while preserving the confidentiality requirements that characterize the financial sector. The findings reinforce the need for continuous evolution of digital compliance programs, with special emphasis on improving risk assessment, systematic monitoring, employee training, and strengthening the organizational culture of data protection and responsible use of digital technologies.

4. Conclusion

This study analyzed the challenges and strategies associated with the application of digital compliance pillars to ensure compliance with the General Data Protection Law (LGPD) in an organizational context marked by the increasing use of artificial intelligence systems in the financial sector. A progressive evolution of institutional maturity was observed, with the strengthening of formal governance structures, the review of regulations, the training of employees, and the adoption of technological controls aimed at protecting personal data and information security. It was noted that, starting in 2023, LGPD compliance began to be addressed more explicitly and structurally, culminating in 2024 with the presentation of measurable evidence and the integration of governance, risk management, and digital transformation. The main contribution lies in the articulation of the concepts of digital compliance, LGPD, and artificial intelligence, offering an integrated analysis of the challenges and interdependencies between data governance, technology, and regulatory compliance in the financial sector, providing subsidies for the improvement of policies and control mechanisms for the responsible use of artificial intelligence.

However, the research presented limitations due to its predominantly qualitative and descriptive approach, based on the documentary analysis of public institutional reports, without including in-depth empirical investigation in other organizations or access to internal documents. This characteristic restricted the ability to technically detail some AI control and governance mechanisms, such as algorithmic impact assessment and bias monitoring. It is suggested for future studies to expand transparency on algorithmic governance practices, even if through aggregated indicators or independent evaluations, while preserving the confidentiality requirements of the financial sector. The findings reinforce the need for continuous evolution of digital compliance programs, with an emphasis on improving risk assessment, systematic monitoring, employee training, and strengthening the organizational culture of data protection and responsible use of digital technologies.

Bibliographic References

BELLI, Luca et al. IA generativa e LGPD: transparência, desafios regulatórios e caminhos para a conformidade. Rio de Janeiro: Fundação Getulio Vargas, 2023. Disponível em: <https://repositorio.fgv.br>. Acesso em: 06 fev. 2026.

BRASIL. Lei nº 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados Pessoais (LGPD). Diário Oficial da União, Brasília, DF, 15 ago. 2018.

DONEDA, Danilo. O direito fundamental à proteção de dados pessoais. Rio de Janeiro: Forense, 2019.

MORETT

MULHOLLAND, Caitlin S.; GOMES, Rodrigo Dias de Pinho. Inteligência artificial e seus principais desafios para os programas de compliance e as políticas de proteção de dados. In: FRAZÃO, Ana; MULHOLLAND, Caitlin (org.). Inteligência artificial e direito. São Paulo: Revista dos Tribunais, 2021.

O’NEIL, Cathy. Weapons of math destruction: how big data increases inequality and threatens democracy. New York: Crown, 2016.

OECD. Corporate governance and compliance. Paris: OECD Publishing, 2015.

PASQUALE, Frank. The black box society: the secret algorithms that control money and information. Cambridge: Harvard University Press, 2015.

Article originating from the Final Course Work of the Specialization in Compliance and ESG of the MBA USP/Esalq

To learn more about the course, click here and access the MBX Academy platform