How to add AI to your company's system without the risk

Almost every founder who comes to me today wants AI inside their system. A chat that answers customers, a search that understands the question, a summary of the day's orders. The instinct is right. The trouble starts when AI goes where it isn't needed, with no one knowing what it costs per month and no one deciding who checks what it does.

The shift is real. According to the Cetic.br ICT Enterprises 2025 survey, published in August 2026, 17% of Brazilian companies with more than ten employees used AI applications in 2025, up from 13% in 2024. Among large companies, it was 50%. In manufacturing, IBGE's Pintec survey showed usage rising from 16.9% in 2022 to 41.9% in 2024, according to Poder360. In this guide I show where AI makes sense in a system, what it costs, what the LGPD requires and how to measure whether it paid off.

Where AI makes sense in your system

My rule is simple. AI works well on tasks with a lot of text, few fixed rules and small, fixable errors. Five uses pass that test:

• Support. Answer common questions from your documents and hand off to a person when it doesn't know.
• Triage. Read emails, tickets and orders and sort them by topic and urgency.
• Search. Find a contract, product or record by what the person meant, not the exact word.
• Summary and analysis. Sum up the day, flag unusual orders, compare one month's numbers with the last.
• Drafts. Suggest a reply, product description or report for someone on the team to approve.

Cetic.br shows Brazilian companies are already on this path. Among those that used AI in 2025, 68% used it to automate processes and workflows. Written text analysis jumped from 22% to 38%, and text and speech generation from 20% to 30%.

Now the other side. Calculating price, taxes, inventory, deadlines and access permissions are not jobs for AI. The right answer is always the same, and a regular system rule does it cheaper, faster and without mistakes. If the answer doesn't change, you don't need AI. You need a rule.

What it costs to add AI to your system

There are two different costs. The first is building: connecting the AI to your data, designing the screens, setting the limits and testing. That goes into the project like any other part of the system, and I explain what drives it in how much a custom web system costs.

The second is usage. AI vendors charge per chunk of text read and written, called tokens, priced per million. On Anthropic's pricing page, in October 2026:

• Claude Haiku 5.5: US$0.10 per million tokens read and US$0.50 per million written, for requests up to 100k tokens.
• Claude Sonnet 5.5: US$2 read and US$10 written.
• Claude Opus 5.5: US$4 read and US$20 written.
• Batch processing, for tasks that don't need an instant answer: 50% off.

A sample calculation helps show the scale. Picture a thousand support conversations a month. In each one, the AI reads 4,000 tokens, between the question and excerpts from your documents, and writes 800. Over the month, that's 4 million tokens read and 800,000 written. On Sonnet 5.5, that's US$8 for reading and US$8 for writing: US$16 a month. On Haiku 5.5, US$0.80.

What makes that bill grow isn't the number of customers. It's how much text goes into each request. Sending the whole manual with every question, instead of just the relevant excerpt, multiplies the cost. So ask for a monthly AI spend estimate in the proposal and a spending limit set on the vendor account.

Customer data and LGPD: the must-haves

When the system sends customer data to an AI, the LGPD still applies. Three points of Law No. 13,709 matter directly:

• Security. Article 46 requires technical and administrative measures to protect data from unauthorized access and leaks.
• Automated decisions. Under Article 20, the data subject has the right to request review of “decisions made solely on the basis of automated processing” that affect their interests, such as credit or consumer profiling.
• Incidents. Article 48 requires notifying the ANPD and the data subject of any incident that may cause significant risk or harm.

The fine can reach 2% of revenue in Brazil, capped at R$50 million per violation. And the topic is in focus: the ANPD named AI and emerging technologies among the four pillars of its Priority Topics Map for 2026 and 2027, with 20 planned inspection activities, according to Teletime.

In practice, ask for five things:

1. Send the AI only the data the task requires. To summarize a ticket, the AI doesn't need the customer's tax ID.
2. Know which vendor processes the data, in which country and whether it uses your data to train models.
3. Tell customers they're talking to an AI and show them how to reach a person.
4. Log what goes into and comes out of the AI.
5. Handle health and financial data with extra care.

Limits and human review: AI suggests, a person decides

On October 9, 2026, Anthropic published a report on unintended actions by its models, covering four types of behavior. In one case, Claude Haiku 4.5 submitted a made-up report to a US police department's online form while creating sample content for a task. The instructions banned logins, creating accounts, purchases and destructive actions. They said nothing about forms. The report was flagged as spam, but the lesson stands.

Write down what the AI can do, not just what it can't. And separate three levels:

1. Read and suggest. Look up data, summarize, propose a reply. Low risk.
2. Act on something reversible. Classify a ticket, flag an order for review. With every action logged.
3. Act outside the system. Email the customer, charge, change a price, delete data. Only with a person's approval.

Also include a rule few people write down: when it doesn't know, the AI says so and hands off to a person. Test this on purpose, with questions your documents don't answer.

How to measure whether AI is worth the cost

Before turning the AI on, write down today's number. Without a before, there's no after. Then track:

• Resolution rate. How many conversations ended without needing a person.
• Accuracy rate. Every week, take 50 answers and check them one by one.
• Handoffs to a person. How many and why. Every repeated reason is a missing document.
• Time saved per task, measured by the team that used to do the work.
• Cost per task. The month's AI spend divided by the number of tasks done.
• Complaints that mention the automated support.

Start with one task and one team. A month of real use with these numbers says more than any demo.

How we do it at the Studio

Every system we deliver ships with an AI agent that runs every day, flags failures, suggests improvements and checks whether the data makes sense. That's the first level on the list above: watch and alert. And we use Claude Code and Figma in design and build, so we live with the limits of AI-generated code every day.

We also build AI products for end users. AI Vou Eu, an AI travel SaaS, went live in 4 weeks with the Studio. I spoke about AI in business at Siará Tech Summit, and the message was the same as this piece: AI with a clear task, minimal data and a person in control.

The price is fixed after discovery, the deadline goes in the contract, and the code, files and access stay in the client's name. That goes for the AI part too: the AI vendor account should be in your company's name, not in the name of whoever built it.

If you want AI inside your system with predictable cost, protected data and written limits, that's the work of our custom system and SaaS service.