AI is being used across companies, often without IT teams having full visibility into which tools employees are using, what data they are accessing or the risks they may introduce, according to South African managed services provider Onsite IT and its software partner Jamf.
While the findings apply broadly to enterprise IT environments, the briefing focused specifically on the Apple ecosystem, where AI tools running natively on Mac devices have created a particular visibility challenge for IT teams.
Executives from Onsite IT and Jamf recently hosted a briefing for local tech business leaders to unpack the results of Jamf’s global AI Governance Survey, conducted in the second quarter of 2026 among 687 IT and security respondents. The survey found that AI adoption has outpaced AI governance.
According to the findings, 72.9% of companies have deployed AI in some form, 81.7% reported AI-related risk exposure, and 22% had already experienced an AI-related cost or security incident.
The survey also found that companies with the most advanced AI deployments reported incidents at the highest rate, with deeply integrated adopters experiencing incidents about 40% more frequently than companies still exploring AI.
According to the companies, the reason is architectural. AI agents run natively on devices, configure themselves through files that change with each vendor release, and operate with the permissions of the signed-in user. They argue that many of the security controls companies rely on – including network proxies, cloud access brokers and cross-platform endpoint tools – monitor the wrong layer.
“Every organisation we spoke to this week gave the same answer to the same question: they do not know what AI is running on their Mac devices,” said Clayton Campbell, MD of Onsite IT. “That is not a technology failure, it is a visibility gap – and it is now one that can be closed on the platform businesses already run. Boards asking about AI risk can be shown evidence rather than a policy document.”
Campbell said the survey showed that incident rates increased as AI adoption matured, with deeply integrated AI programmes reporting incidents at 27.1%, compared with 19.4% among early-stage adopters.
SA market overview
Asked how the South African market compares with international counterparts, Campbell said the survey did not include SA but that the companies believe local trends mirror the global picture.
“AI is already in almost every organisation. It has usually arrived from the bottom up rather than through a formal rollout, and adoption is running well ahead of governance," he said. "If anything, the local stakes are higher, because South African organisations carry POPIA obligations and many also serve customers in regulated markets abroad, which brings cross-border AI rules into play.”
Freek de Jonge, regional sales manager at Jamf, said: “AI is following the same curve, faster. Governance that lives at the operating-system level is how productivity and control stop being a trade-off.”
The companies said regulatory requirements add urgency. High-risk obligations under the EU AI Act take effect in December 2027, while South African companies already have obligations under POPIA because personal information processed by AI tools remains personal information.
They added that procurement questionnaires increasingly ask companies how AI use is governed and that policy documents alone are no longer considered sufficient.
According to Onsite IT, companies deriving the greatest benefit from AI are also experiencing the highest number of AI-related incidents, making governance rather than prohibition the priority.
“Organisations cannot govern what they cannot see," said Campbell. "On the Mac, most AI now runs on the device and through developer tools – and the network and cloud controls organisations already own were never designed to detect it.
"Framing the issue as a choice between allowing or blocking AI is a false dichotomy. Blocking AI tools undermines the productivity businesses seek, while allowing them without oversight increases risk.”
Share
