AI Governance and Policy
AI governance that lets your firm adopt AI with confidence
AI governance is the set of policies, roles, approvals and controls that decide how an organisation uses AI, and Rhentech builds and runs it for firms in Pretoria and Johannesburg. It gives the chief executive a defensible answer for clients, insurers and regulators, and gives staff a clear, safe way to use AI to grow the business.
30 minutes, free of charge. We respond within one business day.
- Built for regulated firmsPolicy written for your regulator and sector, not a generic template.
- ISO/IEC 42001 structuredOrganised to the international AI management system standard, ready for certification if you want it.
- Senior-ledA senior consultant owns the programme from workshop to board report.
What does an AI governance programme include?
Seven components, delivered as a programme and then run as a managed routine.
- 01
AI use policy
A written AI use policy your staff can follow: approved tools, what data may and may not go into them, when output must be checked by a person, and how to report a mistake without blame. Drafted for your sector and approved by your board.
- 02
Roles and accountability
Who owns AI risk, who approves a new tool, and who responds when something goes wrong. Agreed and recorded before an incident forces the question.
- 03
Tool and vendor approval
A short, repeatable intake for new AI tools and AI features in existing software: security, data handling, retention, training rights, data location and exit terms. Approvals in days, not months.
- 04
AI risk register and impact assessments
Every AI use case is recorded with its data, its owner, its risk rating and its controls. Higher-risk uses get an impact assessment before they go live.
- 05
Regulatory and standards alignment
ISO/IEC 42001:2023 is the international standard for an AI management system: the policies, roles, risk assessments and controls an organisation uses to govern AI. We align your programme to it, to POPIA, including section 71 on automated decisions and section 72 on cross-border transfers, and to expectations from the FSCA, the Prudential Authority and your sector regulator.
- 06
Staff AI literacy
Role-based training so people understand what the tools can and cannot do, how to protect client data, and how to check output. Short, practical and recorded as evidence.
- 07
Monitoring and board reporting
Monitoring of approved and unapproved AI use, with a quarterly report to the board on adoption, incidents, risk and value. Governance becomes a managed routine, not a one-off document.
What you're being asked to demonstrate
The five regulatory threads regulated South African organisations most often need to address. Refreshed quarterly.
-
POPIA & the Information Regulator
- Current state (May 2026)
- POPIA in full force since 1 July 2021 with active enforcement. Section 71 explicitly covers automated decision-making: data subjects can refuse decisions made solely by automated means. No AI-specific Code of Conduct issued yet, though one is widely expected.
- Upcoming milestone
- Information Regulator continues to issue enforcement notices through 2026; AI-specific guidance expected but not yet scheduled. Sector Codes of Conduct under §60 of POPIA are the most likely vehicle.
- What it means for a regulated South African organisation
- SA organisations using AI must rely on general POPIA conditions (lawful processing, purpose limitation, minimality, and security safeguards under §19) applied to AI workflows. Section 71 in particular requires meaningful human review of any solely-automated decision affecting a data subject.
-
FSCA + SARB Prudential Authority
- Current state (May 2026)
- FSCA and PA published a joint AI in Financial Services report (2024) signalling a principles-based, technology-neutral stance. A Joint Standard on Cybersecurity and Cyber Resilience (2024) sets baseline expectations. No dedicated FSCA guidance on AI has been announced.
- Upcoming milestone
- Conduct of Financial Institutions (COFI) Bill progress through Parliament; expected to consolidate market-conduct oversight including AI use. Likely 2026 to 2027 implementation.
- What it means for a regulated South African organisation
- SA financial organisations should expect AI-related questions in supervisory dialogues. Model risk, fair treatment of customers, and operational resilience are the live frames. FAIS-licensed advisors using AI-driven advice tools should document oversight.
-
ISO/IEC 42001:2023
- Current state (May 2026)
- Voluntary certifiable AI Management System standard. SA training and certification capacity in place via BSI and SABS-affiliated bodies. Adoption nascent and largely driven by export-facing organisations.
- Upcoming milestone
- Continued accelerating adoption through 2026 as procurement clauses propagate, particularly from European counterparties to SA suppliers.
- What it means for a regulated South African organisation
- Not a legal requirement but increasingly a procurement gate, particularly for SA organisations serving European customers. Organisations with ISO 27001 already in place can typically certify in 6 to 9 months.
-
SAHPRA, HPCSA & healthcare AI
- Current state (May 2026)
- SAHPRA published an AI/ML Software-as-a-Medical-Device framework in September 2025, one of the more advanced sector AI documents in SA. HPCSA Booklet 20 sets clinical-practice expectations for AI use by registered practitioners.
- Upcoming milestone
- SAHPRA framework moves from guidance to enforcement through 2026. POPIA Health Code of Conduct (in development) will integrate.
- What it means for a regulated South African organisation
- Healthcare AI in SA is more clearly regulated than most sectors. SaMD classification, clinical safety case, post-market surveillance, and HPCSA-approved oversight are non-negotiable for clinical-decision-support tools.
-
Cross-border & AU AI Strategy
- Current state (May 2026)
- African Union Continental AI Strategy adopted 2024. SA's draft National AI Policy was withdrawn 26 April 2026 (16 days after publication) after ~10% of references were found fabricated. SA has explicitly chosen a sector-specific multi-regulator model.
- Upcoming milestone
- No SA horizontal AI law in prospect for the medium term. EU AI Act's extraterritorial provisions (2 Aug 2026) apply to SA organisations placing AI on the EU market.
- What it means for a regulated South African organisation
- SA organisations must navigate by sector and by export market. The EU AI Act is the most concrete cross-border driver. International frameworks such as the NIST AI RMF inform procurement expectations from international counterparts.
The regulatory position as of May 2026.
What has AI governance delivered?
An anonymised engagement. Client names are never published.
- AI usage audit and governance
Situation: A boutique asset manager with a FAIS Category II licence expected an FSCA visit focused on AI. Staff had used AI research tools for 14 months with no documented model-risk framework.
Outcome: Full AI inventory delivered and a model-risk framework put in place, aligned to ISO/IEC 42001. The supervisory dialogue passed without an enforcement signal, and the framework has since helped win two institutional mandates.
How does an AI governance engagement work?
Three entry points. Most firms start with a briefing or workshop, then build, then run.
-
Executive briefing or policy workshop
Your leadership team agrees its position on AI: where it should create value, what risk it will accept, and the principles the policy will follow.
-
Governance programme
We draft the policy, roles, approval process and risk register, align them to the standards that matter to you, and launch them with training.
-
Monitoring and review
Ongoing monitoring, vendor approvals, policy updates and quarterly board reporting. It can be combined with managed IT under one relationship.
What do leaders ask about AI governance?
Not answered here? Ask it on the call.
What is AI governance?
AI governance is the set of policies, roles, approval processes and controls that decide which AI an organisation uses, for what, with which data, and under whose accountability. Good governance speeds adoption, because staff know what is allowed. It also gives you evidence when a client, insurer or regulator asks how AI is controlled.
Is there a South African AI law we must comply with?
Not yet. The first Draft National AI Policy was withdrawn in April 2026 after fictitious, AI-generated citations were found in it, and a revised draft was reported in October 2026 as due for ministerial input by the end of November. Meanwhile POPIA already governs personal information used in AI, including automated decision-making under section 71.
What are financial regulators expecting?
On 24 April 2026 the Prudential Authority told supervised financial institutions that frontier AI shortens the time between a vulnerability being found and exploited, and that supervisory focus is moving from awareness to execution. Joint Standard 2 of 2024 on cybersecurity and cyber resilience, effective from 1 June 2025, remains the baseline. AI governance is now part of that supervisory conversation.
Do we need ISO/IEC 42001 certification?
Not by law. It is increasingly requested in procurement, particularly by international clients, and building to it makes certification a short step if one asks. We structure your programme to the standard and you decide whether to certify.
How long before we have a working AI policy?
The executive briefing or policy workshop is a half or full day. A first policy, roles and approval process follow as a programme with milestones agreed in writing at the start. We do not publish a standard timetable, because it depends on how many teams and tools are in scope.
Can AI governance run alongside our managed IT?
Yes. The monthly governance retainer covers monitoring, vendor approvals, policy updates and board reporting, and it can be combined with Rhentech managed IT. Technical controls such as data-loss prevention and conditional access then enforce the policy, not just describe it.
Free consultation
Make AI an advantage your board can defend.
A 30-minute call with a senior consultant about where your firm stands on AI and the fastest route to a working policy. We respond within one business day.
Or call 012 012 5072 or message us on WhatsApp.
What happens next
- 01You tell us briefly what has landed on your desk.
- 02We respond within one business day to arrange a time.
- 03A 30-minute call with a senior consultant, and an honest view of what to do first.