Senzo Mbhele, managing director, Cloud On Demand
There is a version of AI governance that looks like a hundred-page policy document, a steering committee and a six-month implementation roadmap. Most businesses do not need that version. What leaders actually want is straightforward: AI that works, that is safe, and that they can explain to a board if something goes wrong. Another committee or another consultant with a twelve-month roadmap is not governance. It is avoidance dressed up as process.
The good news is that governance does not have to be complicated. In fact, the moment it becomes complicated, it usually stops being useful. What it does need to be is intentional.
South Africa’s regulatory environment is moving. The country’s Draft National AI Policy entered the Cabinet approval process in early 2026, and is expected to be gazetted for public consultation during this year, with sector-specific regulatory instruments anticipated from 2027 onwards.¹ The organisations that treat this period as preparation time will be in a fundamentally stronger position than those that wait.
Three things that actually matter
For most businesses, practical AI governance comes down to three things. The first is visibility. Most businesses are already using AI. They just haven’t admitted it yet. It surprises me how often AI tools are already embedded across a business before anyone has mapped them. A simple audit of where AI is being used, what data it touches and who has authorised it is the foundation everything else builds on. You cannot govern what you have not acknowledged.
The second is being clear about data. Defining which data is in scope, who is accountable for it and what the retention rules are is not a technical question. It is a business decision. For South African organisations operating under POPIA, this is not optional. The question is whether you are making those decisions deliberately or by default.
The third is building a feedback loop. Governance is not a document, it is a habit. The organisations that get this right assign clear ownership, review AI outputs periodically and create a simple way for teams to flag concerns when something does not look right. None of that needs to be formal. It needs to be consistent.
Familiar discipline, newer context
What I find encouraging is that most businesses already have the instincts for this. The same discipline that goes into financial controls or data security applies here. AI governance is not a different kind of thinking. It is familiar thinking applied to a newer context.
In that process, the channel partner has an important role to play. Most businesses do not need another layer of theory. They need help turning broad principles into practical decisions about which tools are approved, what data can be used, who signs off, and how risks are escalated when something looks off. This is where good partners add real value. They help clients move from uncertainty to clarity, not by creating bureaucracy, but by putting workable guardrails in place that support innovation and make governance easier to act on.
The businesses I see managing governance well are not the ones with the biggest budgets. They are the ones who have found advisors that help them make decisions rather than defer them. Good governance does not slow AI down. Done well, it gives leadership the confidence to move faster, because the guardrails are already in place.
Most organisations do not have a governance problem. They have a visibility problem. Once you can see what is in play, the decisions around data, ownership and oversight become far more straightforward. That is why the most practical place to start is with a simple audit. Not as a compliance exercise, but as a way to create clarity and give leadership the confidence to move.
Source:
1. South Africa: AI policy mov
