Most South African Information Officers can describe their POPIA programme in some detail — the processing register, the operator agreements, the breach response plan. Far fewer can name the AI tools their staff use day to day. That gap matters. Section 19 of POPIA requires every responsible party to “take appropriate, reasonable technical and organisational measures” to secure personal information. Section 71 adds a layer for any decision with legal or substantially similar effect taken solely by automated processing: meaningful human review, the right to make representations, and sufficient information about the underlying logic. Neither defence works if the organisation cannot tell the Regulator which AI tools are in use, who is using them, or what data has been pasted into them.
The shape of shadow AI in South Africa
The pattern is now familiar across the South African mid-market. At a Sandton legal firm, paralegals lean on the free tier of a popular consumer chatbot to summarise long matters and draft first-pass correspondence. In the finance team of an asset manager, a manager trialled Microsoft Copilot for six weeks before IT was looped in. At a Cape Town marketing agency, a client services lead routinely pastes draft campaign briefs — including client lists and contact details — into an open AI tool to “tidy up the tone.”
None of these people are reckless. They are responding to commercial pressure with the tools easiest to reach. But almost every one of those tools is hosted in the United States, which raises a separate POPIA question the organisation has typically not addressed: the Section 72 conditions for cross-border transfer of personal information. The Information Officer in each case has no register of which tools are in use, no record of what data has been disclosed, and no signed agreement with the operator. The Section 19 safeguard regime presumes a known surface. Shadow AI is, by definition, the unknown surface.
Why an inventory beats a policy as a first step
The instinct in many organisations is to publish an AI usage policy and consider the matter handled. That is the wrong sequence. A policy governing tools you cannot see is aspirational. The Information Regulator’s expectations under Section 19 presume the responsible party knows its own processing — which categories of personal information are involved, where they flow, on what legal basis, and with what safeguards. You cannot establish controls over an inventory you have not built.
The same logic applies to organisations working toward ISO/IEC 42001 alignment. The standard is a management system: a set of controls layered over a defined scope. Until the scope is mapped, the control catalogue has nothing to govern.
What a credible AI Usage Audit covers
A focused AI Usage Audit produces a fact base, not opinions. The categories of finding worth paying for are:
- Shadow tool discovery. Every AI tool actually in use across the organisation, by whom, on which devices, and with what data — discovered through technical scanning, browser and DNS log review, vendor-spend analysis, and structured interviews.
- Data egress mapping. A clear picture of what personal information is leaving the South African perimeter, to which jurisdictions, and through which tools.
- Vendor terms of service review. A plain-language reading of each material vendor’s terms covering commercial rights, intellectual property rights, and model-training rights on content submitted by the organisation or its clients.
- POPIA mapping. Section 19 safeguards assessed against the actual processing observed; Section 71 exposures identified for any solely-automated decisions; Section 72 conditions tested for every cross-border data flow.
- Sector overlay. For financial services, the joint FSCA and Prudential Authority expectations set out in the November 2025 AI in the South African Financial Sector report. For healthcare, the SAHPRA Communication MD08 2025/2026 on AI/ML-enabled medical devices and HPCSA Booklet 20. For legal practice, the client-confidentiality and supervision principles signalled by the courts in Parker v Forsyth and Mavundla v MEC. For audit firms, ISQM 1 coverage of GenAI tooling.
- Employee usage patterns and training gaps. A realistic picture of who is using what, and where the organisation’s tooling provision is leaving staff to improvise with consumer products.
What the deliverable looks like
The output is three artefacts a Board can read and an Information Officer can defend:
- An executive register of AI tools in use — the canonical inventory the organisation did not previously have.
- A risk-ranked exposure register — every finding scored against POPIA exposure, sector-regulator exposure, vendor exposure, and operational concentration risk.
- A remediation roadmap — sequenced, owner-assigned, with clear stop, restrict, or sanction decisions for each shadow tool.
The roadmap is what the Information Officer needs to defend the organisation in a Regulator inspection, and what a sector regulator will look for if the organisation sits inside FSCA, SAHPRA or HPCSA scope.
How Rhentech helps
We run AI Usage Audits as a senior-led, audit-first engagement. The consultant who scopes the work is the one who delivers it. The methodology is the same one we apply to cybersecurity audits — discovery first, structured findings, board-grade reporting — adapted for AI tooling and POPIA-aligned governance.
Where the audit surfaces material exposure, it feeds cleanly into an AI Governance and Compliance engagement: ongoing oversight of the tools the organisation chooses to keep, structured enablement on the tools it chooses to sanction, and continuous monitoring tuned to the regulators in your sector.
If you do not yet know which AI tools your organisation relies on, the right next step is a conversation. Book a free initial consultation with one of our senior consultants — we will walk through your environment, your sector exposure, and what a focused AI Usage Audit would cover in your case. The consultation costs nothing; the audit is a paid engagement, scoped to the size and complexity of the organisation.
This article is for informational purposes. It does not constitute legal advice. Consult qualified legal counsel for compliance matters specific to your organisation.