Sixty four percent of African employees say they used AI at work in the past year, ahead of the 54% global average, and 76% believe it genuinely improves the quality of their work, according to PwC’s 2025 Africa Workforce Hopes and Fears Survey, which polled 1,753 workers across South Africa, Kenya, Nigeria, Morocco and Algeria and was published in November 2025. On the surface that is a good-news story about a continent moving fast. The uncomfortable part sits in a separate finding: most of the businesses those employees work for have not built anything resembling proper governance around how that AI use actually happens.
The adoption numbers, and the gap behind them
A separate study of more than 350 senior finance and IT executives, run by enterprise software firm OneStream, found that only 19% of those executives pull the majority of their AI inputs from a single, centralised enterprise system, meaning most AI use inside a typical business draws on scattered, unmanaged data sources rather than anything an organisation actually controls. And yet 79% of the same executives said they believe their data governance can support large-scale AI adoption, as reported by TechFinancials. That is a significant confidence gap: the belief that governance is adequate does not match what the same executives say about how fragmented their actual AI inputs are.
A Gartner survey of 360 organisations found a concrete payoff for closing that gap: businesses that deploy specialised AI governance platforms are 3.4 times more likely to achieve high governance effectiveness, and effective governance technology can cut regulatory compliance costs by roughly 20%. Governance, in other words, is not simply a defensive cost. Done properly, it is cheaper than not doing it.
What actually goes wrong without it
The risks are specific, not abstract. AI systems trained or run on fragmented, unmanaged data produce hallucinations and inaccurate outputs with no clear audit trail to catch them. Weak access controls around AI tools create permission leaks, unauthorised access to data an employee should never have been able to reach through a chat interface. And in South Africa specifically, any AI system touching personal information sits inside POPIA’s rules regardless of whether anyone thought to check, which means a business using AI on customer data without governance in place is carrying compliance exposure it may not know it has. Our guide to POPIA data breach response covers what happens when that exposure turns into an actual incident.
What this means for a business that has not done any of this yet
None of this argues for slowing AI adoption down. The PwC numbers show the productivity case is real and the workforce already believes in it. The argument is narrower: governance has to be built alongside adoption, not bolted on afterwards once something has already gone wrong. For a small or mid-sized business, that does not require an enterprise governance platform on day one. It starts with knowing which systems and data sources AI tools actually pull from, who has access to what through an AI interface, and having a written policy for what an employee should and should not paste into a chat tool. Our practical guide to AI tools for South African small businesses is a reasonable starting point for the adoption side of that; the governance side is simpler than it sounds, mostly a matter of writing down rules a business is probably already following informally.
The gap between how fast South African businesses are adopting AI and how slowly they are governing it will not close itself. Every business already inside that gap is one hallucinated output, one leaked permission, or one POPIA complaint away from finding out what it actually costs.
