The Camaçari-Galeão Pipeline Opens Before Brasília Writes The Statute

Three hundred million reais, call it fifty-five million dollars at today's cross, buys a lot of lidar racks, labelling workstations, and offshored engineering talent on secondment visas. It buys an R&D complex at an old international airport, parked right next to a presidential inauguration photograph and sold to the local press as the beginning of a Latin American autonomy stack. What it does not buy, and what the receiving country has not yet figured out how to supply, is the rule under which any of that fleet will be allowed to drive itself on a federal highway at scale.

BYD announced the investment on 3 September 2026, siting the lab at Galeão International Airport in Rio de Janeiro. Three months earlier, in a company release dated 29 May 2026, BYD had already committed to bringing its "God's Eye" driver-assist system to Brazilian showrooms starting in 2027. The release describes the XUANJI A3 chip as supporting L3 and L4 operation, with over 2,100 trillion operations per second when three chips sit stacked in a single car. That is a vendor benchmark, Chinese-measured, run on roads that look nothing like a São Paulo monsoon. I would want it stressed against a Belém downpour, a Minas Gerais pothole, and a Rodovia dos Imigrantes rush-hour before signing off on anything, and I would want someone other than the company doing the stressing.

The lab in Rio is one half of the vertical setup. The other half is BYD's Camaçari plant in Bahia, the old Ford Brazil factory that Ford vacated in January 2021 after a century on the ground and five thousand layoffs in Camaçari alone, which BYD then took over the shell of under terms signed with Lula and governor Rui Costa in 2023, and which began serial production of locally assembled electric vehicles in mid-2026. The pattern is familiar enough to anyone who watched the past decade of industrial transitions in Brazil: a Chinese operator picks up ground an American rival abandoned, and the local state accelerates the handover with incentive packages attached. What is unfamiliar is that this handover carries software with it. Sheet metal is governed by one well-worn set of rules written in the 1960s and refined ever since; a learning system that steers the sheet metal is governed by rules Brazil has not yet written, and will not be helped by borrowing wholesale from either Brussels or Washington, each of which is answering a different question about a different industry structure.

Brazil has a strong general data-protection statute, the LGPD. It has an active regulator, the ANPD, with a published regulatory agenda for 2026 and 2027. The agenda's priority topics, as summarised in Baker McKenzie's briefing on the 2026-2027 biennium, run through artificial intelligence oversight, biometrics, children's data, and international transfers. What they do not include, and what no sectoral regulator in Brasília has yet issued, is a vehicle-specific rulebook: who may run which level of autonomy on which federal road, who owns the data captured by a car's cameras while it does so, who audits the model when it misses a pedestrian in a São Luís rain squall, and who gets to say whether the training set stays in-country or rides an over-the-air pipe back to a cloud BMS in Shenzhen.

That gap is wider than it sounds. BYD alone accounted for roughly half of Brazil's 223,912 electrified-light-vehicle registrations in 2025, 112,915 units per Diálogo Américas citing ABVE figures. The same reporting carries a number that is directional rather than measured, that roughly 90 per cent of collected vehicle data transmits back to China. The piece names no auditor behind that figure, and the methodology for a claim of that shape is almost never published, so treat it as the direction of travel rather than the gauge. The underlying point survives the caveat. The data pipe exists. Over-the-air updates exist. The companies with contractual control over both are, by their own disclosure, Chinese joint ventures operating under PRC data-sharing law.

Mexico sits in the same bind with less room to move. Chinese brands took 22 per cent of Mexican light-vehicle market share in the first half of 2026, on total volume above 885,000 units. MG Motor runs 99 dealerships there, BYD 80, JAC 60, Great Wall Motor 58. Washington is already moving. The proposed Connected Vehicle Security Act of 2026 would prohibit Chinese-made connected software from the US market starting in 2027, with hardware restrictions phased in by 2030. Senator Tammy Baldwin's letter to President Sheinbaum made the pressure explicit for Mexican-made exports under the USMCA review window. BYD has already quietly paused its planned Mexican plant under tariff risk. The manufacturing bet has flipped from Mexico-into-US to Brazil-into-Mercosur, which is why Rio got the cheque.

The arithmetic of that pivot is why Brasília's response matters at a different scale than São José dos Campos' did when Embraer first argued with the FAA. A dispute over one aircraft type-certification is a courtroom proceeding. A rule for a fleet that will, by 2028, be a majority of Brazilian electric sales and a double-digit share of the overall light-vehicle market is a statute. Those are different categories of work, with different staffing, different consultation windows, different political coalitions behind them, and the one is not a template for the other.

It is worth answering the privacy argument on its own terms before deciding what to do with it. Jen Caltrider at Mozilla, who runs that organisation's long-running Privacy Not Included audit, has pushed back on the frame that Chinese cars are uniquely dangerous. Her 2023 study of 25 brands found every single one, BMW and Ford and Toyota and Tesla included, failing on consumer-privacy grounds. Land Rover logs last-parked location by default. Kia collects voice and draws behavioural inferences from it. Caltrider is correct that this is not uniquely a Chinese problem. She is also correct, and says so in the same piece, that this does not resolve the Chinese problem. Jurisdiction over the pipeline, and the ability of a national intelligence service to compel disclosure of what runs through it, is a separable harm from baseline commercial leakage. The policy question is not which brand misbehaves most. It is which jurisdiction's law reaches the data when it does.

I remember watching a European OEM try to launch a connected-vehicle service in a Latin American market around 2019 and discover that nobody, not the carrier, not the regulator, not the dealer federation, held the schema for the telematics data flowing back to Stuttgart. The regulator eventually asked for an in-country mirror and got one, then spent six months arguing with the OEM's lawyers over what, exactly, counted as mirrored. Those six months are the shape of the gap I keep coming back to. Rules without institutional plumbing produce exactly that kind of stall, and a stall is time the operator spends collecting under terms the state never actively consented to.

That is the hole in the Latin American stack. Brazil can argue the merits of German versus Chinese data practice forever, and the argument changes nothing on the ground as long as the LGPD remains a general statute with no vehicle-specific implementing rule, no cybersecurity certification regime for ADAS components, no auditable logging requirement for OTA updates, no in-country storage obligation for camera-captured footage of public streets, and no public register of which agency is responsible for enforcing any of it. Those are five distinct pieces of regulation. Each would normally take between eighteen months and three years to draft, consult, and enact. BYD's own public launch window for its driver-assist stack in Brazil is eighteen months from now. The pencil is on the wrong side of the schedule.

I keep thinking about who will service these cars when the ADAS misfires. A dealer tech in Belo Horizonte with a laptop, dialling into a Shenzhen diagnostic server through an OTA pipe his federation never got the schema for, trying to work out whether the lane-keep assist that put a Mercado Livre delivery driver into a guardrail was a model bug, a sensor failure, or an edge case the training set had never seen. He will do his best. People in that chair always do; they did it for Volkswagen's analogue cars in the 1990s, Toyota's hybrids in the 2010s, and Hyundai's early infotainment stacks somewhere in between. What is different this time is who holds the file after he closes it.

Tarry Singh is the founder and CEO of Real AI (realai.eu), an enterprise AI advisory and deployment firm working with global enterprises on production agent systems, model risk, and AI sovereignty strategy. He also leads Earthscan (earthscan.io) for Energy AI startup, and is a founding contributor to the EU-funded HCAIM and PANORAIMA programmes for responsible AI education across European universities. He writes at tarrysingh.com.