An employee asks an AI assistant to summarise a client meeting, redraft the follow-up e-mail and check the wording against internal policy. It takes a few minutes and produces work that reaches a customer, yet none of it lands anywhere a compliance team can retrieve it. And when none of that is captured, an organisation cannot supervise how AI is being used, reconstruct an outcome or show that a person reviewed anything before it left the building.
The new record
E-mail, Microsoft Teams, WhatsApp Business, voice and collaboration platforms still have to be captured, but mature organisations treat that coverage as the baseline rather than the goal. “The market has moved from asking whether every messaging channel can be captured to asking whether every material interaction with AI can be reconstructed,” says Eric Wiggins, Product Marketing Director at Smarsh. A 2024 survey by South Africa’s Financial Sector Conduct Authority (FSCA) and Prudential Authority found adoption above 50% among banking respondents, with data privacy and protection identified as the most significant AI risk in the sector. “Can we prove what the AI was asked, what it produced, what information it used, who relied on it and what happened next?” questions Wiggins.
The costliest mistake Wiggins is seeing is treating AI as a productivity tool without keeping enough context to reconstruct how its output entered a business process. An access log will show that an employee used an AI system without showing what was submitted, what the model returned, whether anyone checked it or whether it shaped advice, policy or a customer communication.
In April 2026, the Department of Home Affairs suspended two senior officials after fictitious references (that appeared to be AI-generated) were found in the Revised White Paper on Citizenship, Immigration and Refugee Protection, then withdrew the affected reference list and began reviewing every policy document produced since November 2022. “The real exposure is not simply that an AI system may produce an inaccurate answer,” warns Wiggins. “It is that the organisation may be unable to reconstruct how the answer was created, reviewed, approved, distributed and acted upon.”
Beyond channels
Fragmentation now runs across models and agents as well as channels. A customer interaction might begin in e-mail, be summarised in Microsoft 365 Copilot, rewritten in Claude Enterprise, approved in Microsoft Teams, completed on a call and governed one piece at a time; each fragment survives while the decision chain does not. “Each new model becomes another integration, another policy set and another evidentiary gap,” explains Wiggins.
Smarsh currently captures records from ChatGPT Enterprise, Microsoft 365 Copilot and Claude Enterprise, with the available content varying by platform and API. For Claude Enterprise, that covers prompts, responses, uploaded files, edited prompts, regenerated answers and incognito chat activity, routed into the same archive that holds e-mail, voice, mobile and social records. Capture Mobile does the same for WhatsApp Business through a verified business profile on Meta-supported APIs. “For mature organisations it is becoming baseline communications governance rather than the end state,” adds Wiggins.
Residency is harder to pin down once AI is involved, because a single interaction can trigger several data movements. Section 72 of the Protection of Personal Information Act (POPIA) allows personal information to leave South Africa only where an applicable basis exists, such as adequate protection in law, binding corporate rules or agreements, consent or certain contract-related grounds. But a prompt carries customer information, an uploaded document is processed in another region, an embedded AI service may call a third-party model, and logs and metadata sit with sub-processors that never appear on an architecture diagram. The question is no longer only where the archive sits, but where prompts, attachments, retrieved documents, responses, embeddings, audit data and backups are processed, whether the provider retains any of it and whether it feeds model improvement.
The proof layer
Once interactions are captured in context, compliance teams can identify unapproved advice, legal teams can reconstruct AI-assisted work during an investigation, security teams can see sensitive information being typed into a model and model-risk teams can examine recurring inaccuracies and patterns of over-reliance.
That capability changes the first question a CIO puts to a capture vendor, from which AI platforms are supported to what can be proved about each interaction. “A list of supported AI platforms does not answer that,” ends Wiggins. “The measure is whether the organisation is capable of producing a complete, contextual and defensible record of how AI influenced the business decision or recommendation.”
Share
