The rapid adoption of artificial intelligence (AI) is creating a growing gap between what companies can deploy and their ability to govern it.
This emerged during a panel discussion at the recent TrendAI Spark 2026 in Sun City. The panel consisted of Norbit Williams, GM of supplier management IT and OT at Eskom; Roopesh Mohabeer, CISO/DPO at Warwyck Private Bank; and Nickey Mannya, director of cyber security and next-generation solutions at Westcon-Comstor. The session was moderated by Shaahid Amod, strategic partner manager for the African cluster at TrendAI.
Williams said companies should be careful not to allow governance requirements to become so restrictive that they prevent effective use of AI. He pointed to the disconnect that can emerge when companies introduce new technologies faster than they update their policies and governance frameworks.
“There's a massive gap because you have a set of AI tools in place, yet the governance does not align. One of the key principles we have is that we do not want to over-govern, because it prevents us from utilising AI capabilities as effectively as we can,” Williams said.
For Williams, the answer is not to create governance for governance's sake. Companies must understand where AI is being used, what risks those applications introduce and how existing policies need to change.
Companies should recognise that AI should support decision-making rather than automatically become the decision-maker, he said.
“The decision is because you verified what AI said,” he added, stressing the importance of human involvement in decisions influenced by AI.
AI adoption already happening
The panel's discussion highlighted that AI adoption is not necessarily waiting for formal enterprise strategies.
Mohabeer said companies are already seeing employees use AI tools, creating a need for security teams to understand what information is being sent to external platforms and what comes back from them.
“What information is being sent out of the network?” is one of the questions companies must answer, he said.
Mohabeer said information generated by AI also needs to be checked rather than accepted automatically.
“Whatever is being provided from the AI, we have to keep verifying and validating it. We can’t simply take whatever AI says at face value,” he said.
He identified human oversight as another important safeguard, arguing that companies require a clear checkpoint where people can review AI-generated outputs before they are acted on.
This is particularly important for a financial services organisation, where inaccurate or inappropriate AI-generated information could have significant consequences.
Pressure from the board
AI adoption is also being driven from the top, with executives and boards increasingly asking what the technology can deliver for the business.
Mohabeer said leadership often wants to see immediate results, but companies should set realistic expectations about how quickly AI can deliver value.
His company has therefore focused on specific use cases where productivity gains and better use of resources can be demonstrated, he added. This approach allows the company to prove value before committing to broader investment, rather than attempting to deploy AI across the business without first understanding the results.
Mannya said the same principle applies to the broader AI strategy: companies should first understand what they are trying to achieve instead of adopting technology simply because it is available.
He warned against the pressure to “keep up” with the market if there is no clear business problem being addressed.
The executive conversation, he said, must move from “we need AI” to understanding what the business actually requires and why a particular technology is being considered. The focus should be on whether the technology can improve the way people work and deliver meaningful value, rather than adding another tool to an already complex technology environment.
He pointed to the importance of education as companies introduce AI, saying employees need to understand the tools available to them and how they can be used effectively.
He noted that companies should consider their specific operating environments when developing their AI strategies. What works for a global company may not necessarily work in the South African context.
Mannya said companies should therefore consider local requirements and the needs of their own employees and customers rather than simply replicating approaches used elsewhere.
The panellists agreed that AI governance cannot be treated as a once-off exercise. As companies introduce new AI applications, governance frameworks will have to evolve alongside them.
Share
