From CompliNEWS | Financial Services Intelligence Watch

Shadow AI emerges as a growing POPIA risk for South African businesses

ITWeb reports that corporate efforts to control artificial intelligence adoption may be driving the very risks they are trying to prevent, with employees increasingly turning to unsanctioned tools. Speaking at the ITWeb AI Summit, Standard Bank executive Sibusiso Ngubeni warned that a growing disconnect between business demand for AI and slower-moving governance frameworks is creating ‘new forms of unmanaged risk’. This so-called ‘shadow AI’ sees staff using public or unapproved platforms to process information, often without oversight or control. The implications are significant. Sensitive corporate and client data may be exposed, processing occurs outside formal governance structures, and organisations lose visibility over how information is used. From a PoPIA perspective, this creates a clear compliance risk, particularly where personal information is processed without appropriate safeguards, accountability, or audit trails.

The message for firms is clear. AI adoption is no longer optional, but neither is governance. The real risk lies not in moving too fast, but in allowing AI to enter the organisation without control. In a PoPIA environment, shadow AI is not just an IT issue — it is a data protection and accountability failure waiting to surface.

Read the Full ITWeb report here