AI Usage Audit
An AI usage audit shows which AI your firm already uses, and what data leaves
An AI usage audit is a structured review of which AI tools your people use, what personal information flows into them, what the vendor terms allow, and where AI output is relied on without review. It gives the chief executive one evidence-based picture of AI risk and opportunity, before a client, an insurer or the Information Regulator asks for it.
30 minutes, free of charge. We respond within one business day.
- Evidence, not a surveyFindings come from logs and device data, checked against what staff tell us.
- Senior-ledThe consultant who scopes the audit runs it and presents it.
- Mapped to regulationEach finding is tied to POPIA, the FSCA and Prudential Authority, or your sector regulator where it applies.
What does an AI usage audit cover?
Seven workstreams, scoped in writing before we start.
- 01
Shadow AI discovery
Shadow AI is the use of AI tools by staff without the organisation's approval or oversight. We find it through network, identity and device data, including browser extensions and AI features switched on inside software you already pay for.
- 02
Data flow mapping
We trace what goes into each tool: client documents, personal information, source code, financial records. Each flow is classified by sensitivity and by where the data is processed, including whether it leaves South Africa.
- 03
Vendor terms review
We read the terms your staff accepted: whether prompts are used for model training, how long data is retained, where it is processed, and who owns the output.
- 04
Reliance on AI output
We identify where AI output reaches clients, decisions or filings without a human check. Section 71 of POPIA gives people the right not to be subject to certain decisions based solely on automated processing, so unreviewed AI decisions are a legal question as well as a quality one.
- 05
Regulatory mapping
Findings are mapped to POPIA, including section 19 security safeguards and section 72 cross-border transfers, and to sector expectations from the FSCA, the Prudential Authority, the Legal Practice Council or healthcare regulators.
- 06
Controls and policy gap
We compare your current policy and technical controls, such as data-loss prevention, conditional access and DNS filtering, with what your exposure requires.
- 07
Risk-ranked register and roadmap
The deliverable is a register of every AI tool in use, a risk ranking of each finding, and a roadmap ordered by impact. It is written for the board, with the technical detail attached.
What has an AI usage audit delivered?
An anonymised engagement. Client names are never published.
- AI usage audit and governance
Situation: A boutique asset manager with a FAIS Category II licence expected an FSCA visit focused on AI. Staff had used AI research tools for 14 months with no documented model-risk framework.
Outcome: Full AI inventory delivered and a model-risk framework put in place. The supervisory dialogue passed without an enforcement signal, and the framework has since helped win two institutional mandates.
For organisations where the regulator will ask
The AI Usage Audit is built for regulated mid-market organisations where "we don't know" is not a defensible answer when AI use shows up in an inspection, a client questionnaire, or a contract review.
- Financial services and fintech
- Legal and professional services
- Healthcare and life sciences
- Accountancy and audit firms
- Insurance
- Regulated manufacturing
How does the audit run?
Three stages. The first conversation is free; the audit itself is a scoped engagement.
-
Consultation
A conversation with a senior consultant about the AI tools you know of, what you suspect, and what is driving the question: a client, a regulator, an incident or a board.
-
Discovery and analysis
We agree in writing which systems, teams and data types are in scope, then gather the evidence from network and identity logs, device data, a short staff survey and interviews.
-
Findings and roadmap
You receive the register, the risk ranking and a prioritised roadmap, and walk through them with the consultant who ran the audit. Many clients move straight into governance or implementation.
What do leaders ask before an AI usage audit?
Not answered here? Ask it on the call.
What is an AI usage audit?
An AI usage audit is a structured review that discovers which AI tools are in use across an organisation, what data flows into them, what the vendor terms permit, and where outputs are relied on without review. It produces a risk-ranked register and a remediation plan. It is the usual first step before writing an AI policy or investing in AI projects.
Do we need to wait for the national AI policy?
No. The first Draft National AI Policy was published for comment on 10 April 2026 and withdrawn later that month after fictitious, AI-generated citations were found in it, and a revised draft was reported in October 2026 as due for ministerial input by the end of November. POPIA already applies to personal information processed through AI tools, so an inventory and a usage policy can be put in place now.
Is staff use of public AI tools a POPIA issue?
It can be. Pasting client or employee personal information into a tool whose terms allow retention or training is processing under POPIA, and sending it to a provider abroad engages section 72 on cross-border transfers. The audit shows where that is happening and what to change.
Are regulators asking about AI yet?
Yes. On 24 April 2026 the Prudential Authority told supervised financial institutions that frontier AI compresses the time between a vulnerability being found and exploited, and that its focus is moving from awareness to execution. Outside financial services, the Information Regulator expects the same POPIA safeguards for AI as for any other processing.
Will the audit disrupt staff or feel like surveillance?
No. Discovery relies mainly on logs and device data you already hold, plus a short anonymised survey and a few interviews. Findings are reported by role and team, not by named individual, and the aim is safe approved tools rather than blame.
What happens after the audit?
Most firms move to an AI policy and governance programme, approve a set of tools with the right settings, or start a first implementation project with milestones. Governance, monitoring and optimisation can then run as a monthly retainer, on its own or alongside managed IT.
Free consultation
Know what AI is doing inside your firm before anyone else asks.
A 30-minute call with a senior consultant about your AI exposure and what an audit would cover. We respond within one business day.
Or call 012 012 5072 or message us on WhatsApp.
What happens next
- 01You tell us briefly what has landed on your desk.
- 02We respond within one business day to arrange a time.
- 03A 30-minute call with a senior consultant, and an honest view of what to do first.