South African executives are rapidly bypassing the experimental phase of AI pilots, moving quickly through the fundamentals and favouring more aggressive deployments of generative AI and machine learning tools across financial services, telecommunications and retail.
The appetite shows up in the rankings, too. According to the Ataraxis Global Outsourcing AI Readiness Index, South Africa ranks eighth out of 25 leading outsourcing destinations globally and first in Africa, with an overall score of 66.5 out of 100.
Executive demand for agentic AI – software that goes beyond answering questions to autonomously executing complex workflows, accessing databases and initiating transactions – is persistent. Leaders no longer want a chatbot that answers questions, but software that executes: it opens the workflow, reads the data, makes the call, books the next step. For a chatbot demo, nobody notices. But for an agent that reads your debtors book, your customer records and your transaction history, and then acts on them, that data movement is the product.
The capabilities are arriving fast, but where that computing power physically lives – and what it costs to reach it from home shores – is not yet the primary consideration it should be.
Beneath the surface of what appears to be a digitally sophisticated corporate world, a sobering reality persists. South Africa is attempting to run world-class, high-performance AI on deeply fragmented and siloed internal data.
We know that the data centre race is being fiercely run, but what’s often glossed over is that this is taking place almost entirely outside South Africa’s borders. The frontier models that make agentic AI viable anywhere in the world run in a handful of massive data centres that are overwhelmingly concentrated in North America and Europe. Africa as a whole holds less than 1% of global data centre capacity, so when a South African business wires an agentic workflow to a frontier model, it is virtually guaranteed that nothing is running locally.
Infrastructure chasm
Rather, we are continuously shipping corporate and customer data across borders to infrastructure we do not own and cannot access, in jurisdictions we do not control.
Our fragmented data ecosystems are a clear example of the infrastructure chasm crippling enterprise architecture in this country. Legacy operational systems do not communicate with one another, creating disparate data pools across departments like compliance, sales and customer service. And this state of unreadiness extends to the localised nature of the data itself.
Unesco’s readiness assessment for South Africa flags significant gaps in linguistic diversity in AI systems and the underrepresentation of local contexts in how these are built. Because local corporate databases lack structured, representative data that mirrors South Africa’s complex consumer base, imported models often remain blind to the informal market dynamics and linguistic nuances unique to the country.
Consequently, when these fragmented local databases are exposed to autonomous, offshore agents, businesses quickly collide with a complex legal and compliance roadblock. The Protection of Personal Information Act (Popia) restricts the transfer of personal information outside South Africa. You may do it, but only on specific grounds – among them that the destination offers comparable protection, the data subject consents after being told the risks or a binding contract carries Popia-equivalent obligations across the border.
The catch most businesses miss is that South Africa has no formal adequacy list. This means there is no government register telling you which countries are safe. The burden of proving a foreign destination is adequate sits with you, the responsible party, on every transfer, and you must be able to document it.
When we layer agentic AI on top, the complexities deepen. A traditional cross-border transfer is a discrete event you can point to and govern. But an autonomous agent calling a model dozens or hundreds of times a day, pulling whatever data each task requires, is a continuous, dynamic flow of personal information across the border that nobody fully maps. You cannot easily consent your way out of it, because the data subject never sees the individual call. And you cannot easily contract your way out of it, because you do not control the model provider’s downstream processing.
The more capable and autonomous the system, the harder it becomes to keep within the bounds of South African law.
Beyond legal exposure, this infrastructure dependency introduces a strategic cost: shadow sovereignty. Most reputable providers will not train on your data, but that is not the worry. The worry is dependency. When the model, the compute and the product road map all sit offshore, the workflows that run your business – pricing, churn, credit risk – increasingly depend on infrastructure you do not govern, on commercial terms you did not set and cannot easily renegotiate. You have outsourced not just computing but a measure of control, and you tend not to learn what that costs until you try to switch, or until the terms change underneath you.
South African businesses and boards must become deliberate about their data architecture. There are three places to begin:
- Classify before connecting: Not all data carries the same risk. A lot of agentic value sits in workflows that never touch personal information, so it’s critical to know which is which before wiring an AI agent into the workflow.
- Keep regulated data resident: Smaller, open-source models now run exceptionally well on local or regional infrastructure. A hybrid approach that uses global models for general reasoning and localised, resident models for sensitive data is a sensible place to start for regulated businesses.
- Treat sovereignty as architecture. Start with the end in mind and design data residency and auditability into your systems from day one or as soon as practically possible. That way, you can start to ensure that every cross-border engagement is classified, logged and defensible.
The leapfrog story we like to tell about emerging markets does not apply here; you cannot skip infrastructure you do not have. But South African business leaders can choose what leaves the country and why. Done well, data sovereignty stops being a tax on local innovation and becomes the very thing that makes local capability worth building.
- The author, Herman Haasbroek, is a partner and data & analytics lead at technology consultancy iqbusiness
- Subscribe to TechCentral’s daily newsletter
- Get breaking news alerts on WhatsApp
