Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
A manager presents to colleagues in a meeting room, a workflow on the screen behind her.

AI governance and responsible AI, ready for certification

AI governance is the set of policies, controls and records that keeps an organisation's use of AI lawful, explainable and accountable. Arke Technologies, in Johannesburg, builds AI governance frameworks for South African organisations, public bodies and schools, aligned with POPIA and King IV, with the records an AI governance certification audit expects.

Book an AI readiness sessionSee the AI compliance checklist

What AI governance is, and why boards now ask for it

AI governance is how an organisation decides which AI it may use, who answers for each system, and what evidence shows that each one is used lawfully and as intended. It covers public tools that staff adopt on their own, AI built into software you already license, such as Microsoft 365 Copilot, and systems you commission, such as agents and chatbots.

It is a board matter because accountability does not move to the software: King IV Principle 12 asks governing bodies to govern technology and information, and the PFMA and MFMA make accounting officers answerable for financial management and internal control in public bodies.

Our AI consulting and implementation practice builds the controls, and our IT governance, risk and compliance service fits AI into your board's existing framework.

A presenter at a flip chart addresses a board around a boardroom table.

Generative AI regulations, AI law and policy: what applies in South Africa

Last reviewed: September 2026.

  • POPIA applies now. Section 71 restricts decisions based solely on automated processing that substantially affect a person. Section 72 limits transfers of personal information abroad, including personal information in a prompt sent to a model hosted overseas. Sections 19 and 22 require security safeguards and notification of a compromise.
  • A national AI policy is being rewritten. South Africa has no AI-specific statute. The Department of Communications and Digital Technologies published a Draft National AI Policy for comment on 10 April 2026 and withdrew it on 26 April after fictitious references were found in it (SAnews, April 2026). A revised draft is being prepared; our guide to South Africa's national AI policy tracks its progress.
  • King IV, the PFMA and the MFMA. Public bodies need the audit trail the Auditor-General expects; directors can start with King IV and technology governance.
  • The EU AI Act, for organisations with European exposure. In force since August 2024, its bans on certain practices and its staff AI-literacy duty have applied since February 2025, and obligations for general-purpose AI models since August 2025. The Digital Omnibus, Regulation (EU) 2026/1744, moved most high-risk obligations to December 2027. It reaches South African organisations whose AI systems or outputs are used in the EU.
  • Global AI governance references. UNESCO's Recommendation on the Ethics of Artificial Intelligence (2021) and the African Union's Continental AI Strategy (2024).

Arke Technologies is a technology company, not a law firm, and nothing here is legal advice. We turn AI law and policy into controls, records and training, and work with your legal counsel where the law needs interpreting.

Directors review printed figures at a boardroom table beneath a chart on screen.

An AI governance framework in three layers

A layered model for AI governance, proposed in 2017 by researchers then at Harvard, separates the social and legal, ethical and technical layers. We use it because a policy means little unless it reaches the system itself.

LayerThe question it answersWhat we put in place
Social and legalWhich laws, contracts and sector norms apply?A register of applicable law, a personal information impact assessment for each AI use, provider contracts that bar training on your data and state where it is processed, board reporting
EthicalWhat should AI do here, and what must stay human?An AI compliance policy, acceptable-use rules, decision rights and red lines
TechnicalDoes the system actually behave that way?Access controls, data minimisation, logging of prompts and actions, guardrails, evaluation tests and spending limits

A generative AI governance framework adds controls for invented facts, prompt injection and confidential data leaking into prompts. The NIST AI Risk Management Framework, with its generative AI profile, and ISO/IEC 42001, the international standard for AI management systems, give that structure a form auditors recognise.

The AI governance principles we build on

Our design framework, Emergent Intelligence, holds that AI should strengthen human judgement rather than replace it. Its five AI governance principles go into every policy and system we build:

  • Agency preservation

    AI recommends; people decide.

  • Transparency

    Every output can be explained: what data informed it, and why.

  • Governance and auditability

    Every AI action is logged and reviewable.

  • Progressive enhancement

    Start with low-risk uses and expand as confidence builds.

  • Ethical boundaries

    Clear limits on what AI may do, what data it may see and which decisions stay human.

We apply them to ourselves. The customer assistant we built for Server Hub, our hardware division, runs in off, draft or automatic mode, with staff approving drafts: an AI governance example we can show running. Our AI use disclosure sets out how we use AI.

AI compliance risks we look for

  • Shadow AI. Client, learner or staff data pasted into free public tools and processed offshore.
  • Automated decisions about people. Shortlisting, credit scoring or bursary allocation without meaningful human review.
  • Oversharing. An assistant surfaces files a user should never have seen, because permissions were wrong long before AI arrived.
  • Confident errors. Invented figures or citations in a customer letter, council report or board pack.
  • Prompt injection. Hidden instructions in an email or web page steer a connected agent or chatbot.
  • Unfair discrimination on grounds the Constitution and employment law protect.
  • Unmetered cost and lock-in. No spending limit, and no way to export prompts, logs or configuration.

An AI compliance agent, software that screens contracts or transactions against rules, is itself an AI system to govern, like any AI agent we build.

An AI compliance checklist for your board or council

  1. AI use register

    every AI system, its owner, purpose, data, provider and where processing happens.

  2. AI compliance policy

    approved tools, banned uses and decision rights, approved by the board, council or governing body.

  3. Personal information impact assessment (required by POPIA's regulations) for each use that touches personal information, covering sections 71 and 72.

  4. Risk rating for each use, naming the decisions that must stay human.

  5. Provider contracts that bar training on your data and state where it is processed.

  6. Access and logging

    least-privilege access and a record of prompts, outputs and agent actions.

  7. Testing before go-live and after every model change, for accuracy, bias and prompt injection.

  8. AI compliance training by role.

  9. Incident response, including how a security compromise is reported under section 22.

  10. Reporting to the audit and risk committee, with the register kept current.

For the privacy side in depth, see our POPIA compliance service.

AI governance tools, software and platforms

AI governance software ranges from controls inside platforms you already license to dedicated AI governance platforms, which analyst firms such as Gartner group under AI trust, risk and security management (AI TRiSM). Whatever the label, AI governance tools discover which AI is in use, keep the register, enforce data policy, log activity and test how models behave.

Much of that is already in your estate. In Microsoft 365, permissions, sensitivity labels and data-loss prevention limit what Copilot can surface. On Google Cloud, Vertex AI keeps models and their versions in a registry and audit logs record access. We configure these first and recommend dedicated AI governance solutions only where volume or regulation justifies them. Where sensitive data must stay in South Africa, private AI keeps processing on infrastructure you control.

Committee members read papers at a long table with desk microphones.

AI governance certification and AI compliance training

"AI governance certification" means different things: some certificates cover an organisation, some an individual, and some only record attendance.

RouteWhat it showsWho it suits
ISO/IEC 42001 certificationThe organisation runs an AI management system that an accredited certification body has auditedOrganisations that provide AI-enabled services, or whose clients and regulators want assurance
Individual credentials, such as the IAPP Artificial Intelligence Governance Professional (AIGP)A person understands AI risk, law and governancePrivacy, risk, compliance and IT leads
University short courses, such as the LSE online course in AI law, policy and governanceDeeper grounding in regulation and policyLegal, policy and board-level staff
Free online coursesGeneral awarenessEveryone, as a first step
Role-based AI compliance trainingStaff use the approved tools within your policyEvery employee who uses AI at work

For an organisation, AI governance certification is not free: ISO/IEC 42001 certification needs an external audit by an accredited body, at your cost. When a supplier offers an "AI compliance certification", ask which standard it audits against and who accredited the auditor. Nor do you need a PhD in AI governance to run a sound programme: you need an owner, a register, a policy and evidence.

We prepare organisations for ISO/IEC 42001 with a gap analysis, the management-system documents and the evidence an auditor samples, much as our ISO 27001 readiness work does for information security. We are not a certification body; the certificate comes from an accredited one.

How our AI governance consulting works

  1. AI readiness session

    where AI is already used, formally and informally.

  2. Register and risk rating against POPIA, your contracts and your risk appetite.

  3. Framework and policy, drafted for approval.

  4. Controls

    access, data-loss prevention, logging, guardrails and spending limits in the systems we build or manage.

  5. Training by role.

  6. Review

    a regular risk-committee report and a current register.

Our AI governance consulting and AI compliance consulting stand alone or run inside a build: every chatbot or agent we deliver ships with its register entry, tests and logs.

Governance, reporting, procurement and continuity

  • Reporting. A named lead, an escalation path, a report for each audit and risk committee cycle, and register changes under change control.
  • Compliance. POPIA throughout, King IV Principle 12 for boards, PFMA and MFMA disciplines for public bodies, and audit-ready documentation.
  • Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request), which gives buyers 135% procurement recognition. Company documents, our CSD supplier number and SARS tax compliance status are available on request. We work from a fixed-scope proposal against your purchase order, and complete standard bidding documents when you go to tender. See our company facts.
  • Continuity. You own the register, policies, risk assessments, logs and training material, in editable formats, and they stay with you if our engagement ends.

What AI governance costs

Last reviewed: September 2026.

We quote AI governance as a fixed-scope project after an AI readiness session, with ongoing review available under a service agreement. What drives the cost:

  • how many AI systems and tools are in use, including informal ones;
  • whether you already have an AI policy and a data classification scheme;
  • how much personal or special personal information the AI touches;
  • whether you are aiming for ISO/IEC 42001 certification or EU AI Act conformity; and
  • how many people need training, and at which levels.

For context, published rates for IT project work in South Africa run from about R550 to R750 an hour ex VAT (matnet.co.za, September 2026).

A manager presents to colleagues in a meeting room, a workflow on the screen behind her.

Frequently asked questions

What is AI governance? Show answer

AI governance is the set of policies, roles, controls and records that make sure an organisation uses AI lawfully, safely and as intended. In practice it means a register of every AI system, a named owner for each, an approved policy, technical controls such as access limits and logging, and regular reporting to the board or council, so accountability for AI decisions stays with people.

Is there a recognised AI governance certification? Show answer

Yes. ISO/IEC 42001 is the international standard for AI management systems, and an organisation can be certified against it by an accredited certification body. Individuals can hold credentials such as the IAPP's AIGP. We prepare organisations for ISO/IEC 42001 audits; we do not issue certificates ourselves, and certification fees are paid to the certifying body.

What is AI compliance? Show answer

AI compliance means each use of AI meets the law, your contracts and your own policy; governance is the system that keeps it so as tools and laws change. In South Africa that starts with POPIA: lawful processing of personal information, limits on decisions made solely by automated means, conditions on sending data abroad and security safeguards. For organisations with European exposure, the EU AI Act adds obligations of its own.

What should an AI compliance policy include? Show answer

An AI compliance policy should list approved tools and banned uses, the data that may and may not be entered, the decisions that must stay human, the owner of each AI system, how outputs are checked before use, and how incidents are reported. Keep it short enough for staff to read, have it approved by the board or governing body, and review it at least annually.

Do we need dedicated AI governance software? Show answer

Usually not at first. Most organisations can start with controls they already license, such as Microsoft 365 sensitivity labels, data-loss prevention and audit logs, plus a well-kept AI use register. Dedicated AI governance platforms earn their cost when you run many AI systems, build your own models or face sector regulation that demands continuous monitoring and evidence.

Who should own AI governance in our organisation? Show answer

The board or governing body is accountable, and one executive should own AI governance day to day, often the CIO, the chief risk officer or the information officer. Each AI system also needs a business owner. In municipalities and departments the accounting officer remains answerable under the MFMA or PFMA, so AI reporting belongs on the audit and risk committee's agenda.

Start with an AI readiness session

In one session we map where AI is already used across your organisation, where the compliance risks sit and what a proportionate AI governance programme would involve. Contact our team to arrange it.

Book an AI readiness session