GenAI in SA: Balancing legal risks and operational rewards for businesses

Image source: DC Studio from Freepik

Some organisations have approached GenAI deliberately and are already seeing measurable value. Others are still experimenting and trying to understand where it fits. Both groups are encountering the same legal and operational questions.

Where businesses are using GenAI

Most businesses we advise are deploying GenAI in practical, low-friction ways. Common use cases include drafting internal communications, summarising large volumes of documents, supporting customer engagement workflows and improving reporting efficiency.

In professional services environments, teams are using tools such as Microsoft Copilot and ChatGPT Enterprise to assist with research, first-draft preparation and knowledge management. The value tends to come from time saved rather than cost eliminated. Teams complete routine tasks faster, allowing professionals to focus on higher-value work.

Where GenAI deployments work well, they are structured. Companies typically limit access initially, define acceptable use cases and require human oversight over outputs. Where deployments struggle, the common issue is a lack of internal governance rather than the technology itself.

Law Practice

The future of arbitration: Will AI replace people as judges?

Priyesh Daya, Brittany Leroni and Caitlin Leahy  9 Mar 2026

Models, oversight and internal leadership

Across sectors, most South African businesses are using established enterprise-grade platforms rather than building their own models. Microsoft Copilot is popular because it integrates easily into existing workflows, while enterprise versions of ChatGPT are often used where organisations want more flexibility.

Few mid-sized businesses currently have a dedicated AI lead. Instead, responsibility often sits between IT, legal and risk functions. In our experience, the most effective deployments involve collaboration between these areas from the outset. Without that alignment, businesses risk rolling out tools before understanding their compliance obligations.

From a legal perspective, concerns typically centre on confidentiality, data protection and accountability for outputs. Organisations must be clear about what information may be uploaded to AI systems and how outputs are reviewed before use.

Measuring value and return on investment

Most organisations are still working out how to measure GenAI’s return on investment. Unlike traditional technology investments, the benefits are often indirect. They show up in improved productivity, faster turnaround times and reduced operational friction.

Some businesses track the time saved on specific workflows or monitor improvements in response times and service delivery metrics. Others are taking a more cautious approach and focusing first on governance before trying to quantify financial returns.

The absence of a clear ROI framework has not slowed adoption. In many cases, companies see GenAI as an operational necessity rather than a discretionary investment.

Law Practice

5 questions every in-house counsel should ask before implementing AI

Melissa Steele  27 Aug 2025

Legal and cyber risk considerations

The legal risks associated with GenAI are often underestimated. Businesses need to consider how AI tools intersect with existing obligations under legislation such as the Protection of Personal Information Act and the Cybercrimes Act.

In practice, the most immediate risks relate to data exposure and misuse. Employees may unintentionally upload confidential information to external systems or rely too heavily on outputs that require verification.

From a cyber risk perspective, the growing use of AI also expands the attack surface for organisations. Phishing attacks, for example, are becoming more convincing as criminals use AI tools to refine language and impersonation techniques.

These risks reinforce the need for clear internal policies, staff training and ongoing oversight.

A practical way forward

For most South African businesses, the case for GenAI is not theoretical. The question is not whether to adopt it, but how to do so responsibly.

The organisations seeing the greatest value are those taking a measured approach. They start with defined use cases, involve legal and risk teams early, and implement clear guardrails before scaling adoption.

GenAI is unlikely to replace professional judgment - used correctly, it supports it. For businesses prepared to manage both the opportunity and the risk, the technology is already delivering tangible value.