Generative artificial intelligence (GenAI) is among the fastest-adopted technologies in business history. Research from Google and Ipsos found that 70% of online adults in South Africa have used an AI chatbot, and three-quarters said AI is useful in the workplace.
However, many small and medium-sized enterprises (SMEs) are adopting GenAI in an ad hoc manner without considering the potential risks and costs. In most instances, adoption takes the form of an employee or business owner using a consumer-facing platform like Claude or ChatGPT for drafting emails, summarising documents or creating marketing collateral.
A global study from Harmonic Security found that nearly two-thirds of activity on personal and free-tier AI accounts is business use rather than personal. This points to business owners and employees using these tools for business purposes without clear guidelines about which platforms are acceptable, what information can be uploaded or how its use should be governed.
The risks of uncontrolled AI adoption
Uploading your business documents to an external AI service can expose confidential information such as customer details, contracts, pricing, intellectual property or internal strategy. Free consumer platforms may use this data to train their models.
There are also serious regulatory compliance risks to consider when transferring your business data to a platform outside of South Africa’s borders. Section 72 of South Africa’s Protection of Personal Information Act (POPIA) specifically regulates transfers of personal information to third parties in foreign countries and sets conditions under which such transfers may take place. Whereas laws such as the European Union’s GDPR apply only to data concerning natural persons, POPIA also covers information relating to juristic persons such as companies and close corporations. This distinction has a consequence few South African businesses have considered. Most commercial data-protection tools are built for international laws like GDPR rather than POPIA. Microsoft Purview, for example, has hundreds of built-in classifiers, including one that detects South African identity numbers — but none for company registration numbers, VAT numbers or B-BBEE certificates.
The same gap exists in most comparable data protection products. A supplier schedule or a client contract pasted into a chatbot would not register on any of them, but under South African law, information related to an organisation should be protected in the same way as personally identifiable information. Every international measurement of AI data exposure is, for a South African business, a floor rather than a ceiling.
Consumer-grade GenAI platforms potentially fail to meet a range of prescriptions under POPIA. Section 21 requires a responsible party to conclude a written contract with any operator processing personal information on its behalf, obliging the operator to maintain the security safeguards set out in Section 19. Free and consumer-tier services generally do not offer agreements of this kind, may retain conversation histories and use them for model training or subject them to human review. In practice, it may also be difficult for a data subject (like one of your customers) to exercise their right under Section 24 to request deletion of information the platform is no longer entitled to hold.
Responsible SMEs therefore need to anonymise and minimise the personal information they share with GenAI platforms, and consider moving to business-grade tools, which have financial implications. Cloud AI is priced for tokens consumed, so the bill grows in direct proportion to the volume of documents processed. The cost curve rises as the deployment succeeds, which is the opposite of the economics to which most software buyers have become accustomed.
Choosing the right AI for the job
This is why large companies are moving towards hybrid approaches that balance cloud AI with local processing for routine workloads, with the same pressures now reaching smaller businesses. This involves running simpler AI processes on computers in your own premises, while using the cloud platforms and their most advanced models for tasks that demand more complex reasoning.
A suitably specified PC or your servers could process relatively straightforward, high-volume tasks such as optical character recognition, document classification and summaries, extracting data from invoices, and routing and triage. More complex reasoning could then be sent to a cloud model – for example, generating and debugging substantial amounts of code or compiling and drafting a complex RFP.
Local processing can also play a role in protecting privacy. A document could be processed locally to identify and redact sensitive information before the remaining content is submitted to a cloud-based large language model (LLM). This creates a more controlled and auditable flow of information, allowing a business to balance compliance with efficient use of technology, though automated redaction is never perfect, and accountability stays with the business either way.
GenAI is a powerful technology, and it can be more than a chatbot or search engine. However, SMEs should set clear guidelines for employees, understand what data may be submitted to AI services, get expert advice on POPIA, and decide which workloads belong locally and which benefit from the cloud.
