7.6 The security framing: trusted stack, CLOUD Act, TCU

The US "trusted stack":

• American AI Exports Program (Commerce, under EO 14320). It calls for full-stack consortium packages, with a "No Country of Concern" requirement. [V] Federal Register, 10 Apr 2026
• USTDA (Colombia): "advancing trusted, U.S.-aligned digital infrastructure", positioning US firms, and "U.S.-made advanced computing systems… protecting systems against malign influence". [V] USTDA
• Pax Silica (State, Dec 2025): "reducing excessive dependencies" and "protecting critical infrastructure from improper access". [V] BNamericas
• Peru: Ambassador Navarro said, "in a reference to China", that AI from extra-hemispheric suppliers represents a national security threat. [V] BNamericas
• The competitor: BNamericas says Huawei runs 12 data centers in the region and offers 30% discounts on its AI models. [V] BNamericas (company-level claim, not independently checked)

Brazil's sovereignty counter-frame: TCU Acórdão 1380/2026 (full ruling read).

• The case. TC 008.857/2025-3; rapporteur Minister Antonio Anastasia; plenary session of 27 May 2026; unanimous. It covers the Nuvem de Governo run by Serpro and Dataprev. [V] ruling PDF
• The CLOUD Act finding (para 101). The AWS data-processing clauses "permite interpretações que admitam a submissão a ordens de autoridades estrangeiras sob legislações como o CLOUD Act". AWS Outposts' adherence is rated "parcial", with dependence on the public region and "sujeição parcial a jurisdição estrangeira". Poder360 reports the "low" sovereignty rating. [V] TCU; [V] Poder360
• The order. A remediation plan within 180 days.
• Both blocs are already inside. Serpro selected AWS Outposts, Google Distributed Cloud Hosted and Huawei Cloud Stack. Dataprev selected AWS, Huawei HCS and Oracle DRCC. Brazil's state cloud is hedged between US and Chinese suppliers. [V] TCU

The Chinese side and Palantir.

• Pecém, the Brazilian project with the largest announced investment figure, is ByteDance's. The race is a US–China contest, and Brazil hosts both. [V]
• Palantir: beyond the Satellogic link (Direction 4), no Palantir hosting or Latin American government data-center contract was found. [U]