Governance for AI that is already in use
Adoption has most likley already happened
In most organisations, AI tools arrived through individual staff rather than through a decision. Company information is being pasted into services nobody has assessed, outputs are being relied on without review, and no one can say which tools are in use or what has left the building.
Meanwhile, governance expectations are developing. ISO/IEC 42001 provides a management system standard for AI, while King V strengthens board-level expectations around technology and information governance. South Africa published its Draft National AI Policy for public comment in April 2026, building on the National AI Policy Framework of 2024. Although the draft policy does not yet create general binding AI obligations, it signals the direction in which governance expectations are moving. Boards are increasingly being asked to explain their position on AI, and many still do not have one.
What we deliver
AI acceptable use policy
A policy that permits productive use while defining what may not be entered into a public model — written to be followed rather than to prohibit everything.
AI use inventory and risk assessment
What is actually in use across the organisation, what data it touches, and where the exposure sits.
ISO/IEC42001 readiness
Gap assessment against the AI management system standard, and the roadmap to close it.
King-V alignment
Board-level oversight structures and reporting that satisfy governance code expectations for technology.
Regulatory gap assessment
Your position assessed against South African AI policy as it develops, and against the international standards your clients and regulators are already asking about.
Deepfake and impersonation awareness
Executive-focused training on AI-enabled impersonation, voice cloning and payment fraud.
How the engagement runs
Policy and inventory first, management system if you need one
Most organisations start with a policy and inventory engagement — typically three to four weeks — which establishes what is in use, produces an acceptable use policy, and gives the board something defensible to point at.
Where a formal management system is needed, that is followed by ISO 42001 readiness work: gap assessment against the standard, then implementation of the controls and documentation required before a certification body is engaged.
Assessments are delivered with RAG scoring against each requirement and, where an existing policy is under review, a full redlined revision rather than a list of comments.
SACYBER prepares organisations for certification. Certification itself is issued by an accredited certification body.
