AI Governance Review
Your staff are probably already using AI. Does the business know what information is going into it?
Our AI Governance Review is being developed for South African businesses that want practical rules for using generative AI responsibly without unnecessarily blocking useful technology.
The review starts with how your business actually uses AI.
Rather than beginning with a generic policy, we identify which tools are being used, what information employees are entering, where AI output is relied on, which vendors are involved, and where the consequences of an error would be material.
The review can consider
- Employee and contractor use of generative AI
- Client, customer and confidential information
- Personal information and POPIA considerations
- Human verification of material AI output
- AI vendor terms and data-handling provisions
- Intellectual-property and content risks
- Automated or AI-assisted decision-making
- Incident escalation when AI use causes a problem
Possible outputs
Depending on the organisation and scope, the engagement may result in an AI-use policy, employee guidelines, a risk register, vendor-review checklist, human-verification procedure, privacy controls and an incident-response process.
This is not intended to make every business operate like a regulated technology company. The controls should be proportionate to the way the organisation actually uses AI and the risks attached to that use.
AI governance review: practical questions
What does the review look at first?
We start with actual use: which tools employees use, what information is entered, where AI output influences decisions, which vendors process data and where an error could have material consequences.
Is this only for technology companies?
No. The service is intended for ordinary businesses and professional firms using AI in administration, marketing, drafting, analysis, customer service or internal decision-making without a dedicated legal or governance team.
What can come out of the review?
Depending on scope, outputs can include an AI-use policy, employee rules, human-verification procedures, vendor-review questions, privacy controls, an AI risk register and an incident-escalation process. Broader technology-law questions can be addressed through our AI, Digital and Technology Law practice.
Start here
Request an AI Governance Review.
This gives us a first picture of how AI is already being used inside the organisation and where the highest-risk areas may be.
Submitting this form does not by itself create an attorney-client relationship. We will first review the enquiry, complete any required conflict checks and contact you about the appropriate next step.
