AI Governance Becomes a Business Decision: What Riachuelo and Vivara Will Discuss at Fórum E-Commerce Brasil 2026

The official agenda of Fórum E-Commerce Brasil 2026 features, on July 30, 2026, at 11:50 AM, in the Technology & Innovation Plenary, a panel with a direct message in its title: "AI Is No Longer a Technology Decision". At the table sit Roberto Portella (Managing Partner at CIONET), Ney Santos (VP of Technology at Riachuelo) and Marcus Multary (Chief Information & Digital Officer at Vivara). The central thesis, according to the official description, is that the competitive differentiator "lies in business decisions, in leadership, in governance and in the ability to turn potential into results."

It's a framing that sounds almost obvious to those who lead, and dangerously vague to those who build. So it's worth doing the work the plenary will probably not do in detail: translating "AI governance" into technical decisions that land in the repository of whoever writes the code.

Why the Discourse Shifted From Technology to Governance

The reason isn't philosophical, it's economic. Calling a model via API stopped being a barrier: any team can integrate GPT, Claude or Gemini in an afternoon. When technical capability becomes a commodity, what remains as a differentiator is what you do with it under constraint: sensitive customer data, LGPD (Brazil's data protection law), cost per token at retail scale, and confidence that the system won't hallucinate a price or leak a customer's CPF (Brazil's individual taxpayer ID).

Companies like Riachuelo and Vivara operate huge catalogs, high-volume customer service and highly personal purchase data. For them, the bottleneck was never "being able to use an LLM." It's deciding which use cases are worth the risk, who's accountable when things go wrong, and how to measure whether it generated revenue or just cost inference. That's governance. And governance, when done well, is code and infrastructure, not a slide.

What "Governance" Becomes in the Repository

The trap of the executive panel is stopping at the principle ("we need responsible governance"). Whoever implements it needs the layer below. A plausible roadmap for a Brazilian organization to structure this:

| Business decision | Corresponding technical implementation | |---|---| | "We can't leak customer data to the model" | Anonymization/PII stripping layer before the prompt; zero retention on the API; separate logging | | "We need to know why the model answered X" | Trace of every call (prompt, retrieved context, response) with observability like LangSmith/Langfuse | | "AI can't make up a price or policy" | RAG with a versioned source of truth + output validation (schema, guardrails) | | "How much does this cost per month?" | Token metrics per use case, with cost attribution by area | | "Who approves a new use case?" | Evaluation pipeline (eval set) before deployment, not after |

Notice that every line in the left column is the kind of sentence a VP of Technology says on a panel. The right column is what separates a company that talks about AI from one that ships AI into production.

The Eval Set Is the Governance No One Sees

If there's one technical piece that materializes all of this, it's the evaluation set. Before putting a customer service assistant live, the team needs a set of labeled cases: real customer questions, with the expected answer and the limits of what the model cannot say. Running that eval on every prompt or model change is the equivalent, in the AI world, of the automated tests that already exist in the backend.

A skeleton of what that looks like in practice:

eval_cases = [
    {
        "input": "Qual o prazo de troca de um anel?",
        "expected_contains": ["30 dias", "nota fiscal"],
        "must_not_contain": ["desconto", "garantia vitalícia"],
    },
    # ... hundreds of cases versioned in the repo
]

def run_eval(model_fn, cases):
    fails = []
    for c in cases:
        out = model_fn(c["input"]).lower()
        ok = all(t in out for t in c["expected_contains"]) \
             and not any(t in out for t in c["must_not_contain"])
        if not ok:
            fails.append(c["input"])
    return len(fails), fails

It's an illustrative example, not code from Riachuelo or Vivara. But it shows the idea: AI governance that doesn't turn into automated regression testing is just good intentions. When the panel talks about "turning potential into results," that's what's embedded in it, without the glamour of the stage.

What Changes for the Brazilian Developer

The optimistic reading of the topic is that there's still room for those who build. If the decision moved out of the technical team and became a C-level agenda item, the developer stops being "the one who integrates the API" and becomes the one who designs the guardrails, the observability and the cost. That's more responsibility and, in practice, more power to influence the product.

The skeptical reading: "AI is no longer a technology decision" can become an excuse for decisions made far from those who understand latency, context cost and model limits. An executive who promises an autonomous customer-service agent without understanding that a poorly calibrated RAG hallucinates, or that context window has a price, is creating technical debt under the name of strategy.

The balance point, and what the Brazilian developer should take from a panel like this, is to demand that every strategic AI decision come with three concrete questions attached: what's the eval set, what's the cost per case, and what happens when the model gets it wrong. If leadership doesn't have those answers, governance is still PowerPoint.

When This Discourse Does NOT Apply

It's worth the caveat: not every company needs an AI governance committee. For a small team testing an internal chatbot, setting up all this apparatus is overengineering, and it stalls an experiment that should be cheap. The governance structure makes sense when there's scale (volume of real customers), sensitive data and brand exposure, exactly the profile of Riachuelo and Vivara. For everyone else, starting with a good eval set and basic observability already covers 80% of the risk.

The panel takes place in the Technology & Innovation Plenary, from 11:50 AM to 12:30 PM on July 30, 2026, and the full agenda is on the official website of Fórum E-Commerce Brasil 2026. For those who build, the value won't be in the thesis, which is already consensus, but in any concrete detail Ney Santos or Marcus Multary give about how they structured this within nationwide-scale retail operations. That's the part that doesn't fit in the title.