In April, South Africa's Draft National Artificial Intelligence (AI) Policy made news headlines when it was officially withdrawn by Communications and Digital Technologies Minister Solly Malatsi. The reason? The document contained fake, AI-generated academic references. For Jonathan Oaker, founder and CEO of CloudZA, this incident highlights the risks of using AI without adequate governance and oversight. CloudZA covered this topic in its previous post here.
According to Oaker, good AI governance starts with understanding your data. “What type of data have you got? Is it personally identifiable information? Is it internal information? Is it linked to the business’s intellectual property? Once you’ve answered these questions, you can start putting data into different categories.”
After assessing your data, you need to carry out the same exercise for the AI tools you’re using, he says. Look into where each model gets its data, how it was trained, what it can and can’t do, and what level of access the tools have to business information. This matters because you need to choose the right model not only to fit your usage needs but also to meet your business’s governance requirements.
The next step, he says, is to consider return on investment. Think about what you are going to invest in your AI strategy for the next six months or year, and what results you are hoping to get. Are you going to use the most advanced model available, or would a more basic model work for your needs?
From day one, Oaker believes businesses using AI must embrace Open Telemetry, which tracks how AI applications and large language models (LLMs) are used and provides some form of observability. “You can't govern what you can't see. You need to know what's running, who built it, what data it uses and when it was last reviewed,” he adds.
There are also various tools that allow businesses to “lock down” their AI environment and restrict what AI tools employees can use, what data those tools can access, how that data is handled and what actions AI systems are permitted to take. For example, Amazon Bedrock is a managed platform for building governed AI applications, while Amazon Quick is an AI assistant that provides employees with a managed AI workspace. Tools like Ollama allow organisations to run models on their own infrastructure, keeping sensitive prompts and data within a controlled environment.
For small business owners debating an AI subscription but not needing an enterprise-ready package, Oaker suggests a team licence. But be sure to turn off the setting that allows the AI company to use your conversations to train its models. “If you do go with the enterprise version, you can further bake governance and control into it by layering your existing identity and access management policies on top of that,” he says.
With AI governance, there are many ways to manage it, but you can usually go either enterprise or open source. “What you pick all depends on where the organisation is in its AI journey. I always advise that you start with open source and then move over to enterprise if that makes more sense. Either way, if you’re a business that can't fail and you deal with a lot of data that's identifiable, then I'd recommend talking to a service provider or partner that can properly assess your environment and make sure you have the right controls and governance in place to use AI to do what it does best, which is help businesses move faster.”
As our regulatory landscape takes shape, it’s important to remember that retrofitting governance later is complex and costly. Failing to consider governance when using AI can expose businesses to data breaches, legal liability and reputational damage. Businesses that move early to prioritise governance will gain a competitive advantage through client trust, regulatory readiness and operational maturity. Governance isn't coming; it's already here. The question is whether you're ahead of it or scrambling to catch up.
Share
