Ten modules, a hundred days, one page at a time. Each day gives you the
idea, a worked case file, the trap that catches people out, and the one
line to remember. Work it in order, or jump straight to what you need.
Day 01 / 100 · AI foundations · What AI is (and isn't)
A pattern-matcher. Not a mind.
Strip away the hype and AI is software that learns patterns from data and uses them to predict. That's powerful. It's also the whole trick.
What AI is
The Useful Part
Software that learns patterns from examples
A prediction engine: next word, fraud score, likely churn
Fast at drafting, sorting, summarising, classifying
Only as good as its data and your instructions
What AI isn't
The Hype Part
A database of verified facts
Conscious, curious or on your side
Accountable for its output: you are
A substitute for judgement on things that matter
Great assistant. Terrible authority.
Day 02 / 100 · AI foundations · LLMs in plain English
Autocomplete, supercharged.
A large language model (LLM) predicts the next piece of text, over and over, very well. Here's how it got that good.
1 · Trained
Read A Huge Library
Learned from vast amounts of text how words, facts and ideas tend to relate. No understanding required, just patterns at enormous scale.
2 · Tuned
Taught To Behave
Further trained with human feedback to follow instructions, stay on task and decline harmful requests.
3 · Prompted
Your Turn
Your prompt plus any context goes in. It predicts the most likely useful reply, one token at a time.
It predicts. It doesn't look up.
Day 03 / 100 · AI foundations · Tokens and context windows
AI reads in tokens. And its desk is finite.
Two ideas explain most AI costs, limits and “it forgot what I said” moments.
Tokens
The Unit Of Everything
Chunks of text: a word, part of a word, or punctuation
In English, roughly 750 words ≈ 1,000 tokens
Usage limits and API pricing are counted in tokens
Other languages often need more tokens per word
Context window
What It Can See At Once
Instructions, chat history, documents and its reply all share it
When it fills up, older material gets dropped or summarised
Detail buried mid-document is easier to miss
Bigger windows help, but cost more per message
Short, focused context beats long and messy.
Day 04 / 100 · AI foundations · Why AI hallucinates
Fluent isn't the same as true.
A hallucination is a confident answer that's made up. It isn't a glitch. It's what a prediction engine does when it has nothing solid to predict from.
No source
The Gap
Asked for a fact it never had, it produces the most plausible-sounding one instead.
Built to answer
The Pressure
Trained to be helpful, “I don't know” comes less naturally than a confident guess.
Vague input
The Fog
Ambiguous prompts, missing context and niche topics all widen the room for invention.
Verify before it leaves the building.
Day 05 / 100 · AI foundations · Types of AI models
Not all AI is a chatbot.
“AI” covers several families of tools. Knowing which is which stops you forcing the wrong one onto a problem.
Language models
Text In, Text Out
Drafting, summarising, Q&A, rewriting. The ChatGPT, Claude, Gemini and Copilot family.
Predictive models
Scores From Your Data
Churn, fraud, demand forecasts. Often already inside your CRM, billing or accounting tools.
Speech & vision
Hear And See
Transcribe calls, read invoices and IDs, spot objects in images.
Generative media
Make Images, Audio, Video
Marketing visuals and voice-overs. Also the engine behind deepfakes.
Match the model to the job.
Day 06 / 100 · AI foundations · Chatbots vs agents
Chatbots talk. Agents act.
The difference isn't how clever the AI is. It's how much it's allowed to do without asking you first.
Chatbot
It Answers
Replies in a conversation. You read the answer and do the work yourself.
Assistant + tools
It Helps
Searches, reads your files, drafts inside your apps. You approve each step.
Agent
It Acts
Plans a multi-step task, uses tools and takes actions with some autonomy.
More autonomy needs more guardrails.
Day 07 / 100 · AI foundations · AI's jagged frontier
Brilliant here. Baffling there.
AI's abilities don't rise in a smooth line. It can ace a hard task and fumble an easy one next to it. Researchers call this the jagged frontier.
Often inside the frontier
Where It Shines
Drafting, rewriting and changing tone
Summarising long documents and calls
Brainstorming options and first drafts
Explaining concepts and first-pass code
Often outside the frontier
Where It Stumbles
Exact counts and sums without a tool
Recent events, unless search is on
Your internal facts, unless you provide them
Judgement calls on messy, conflicting evidence
Test it on your work. Don't assume.
Day 08 / 100 · AI foundations · Common AI myths
Four myths worth retiring.
Most bad AI decisions in small businesses start with one of these. Each has a more useful truth behind it.
“It's always right”
Myth 1
Reality: it's always confident. Right is something you check.
“It'll take every job”
Myth 2
Reality: tasks change first. People who use it well change with them.
“It's for big companies”
Myth 3
Reality: many SMEs can start with tools they already pay for.
“It learns from everything I type”
Myth 4
Reality: it depends on the plan and settings. Read the data-use terms.
Not magic. Not hype. A tool.
Day 09 / 100 · AI foundations · The SME opportunity
Small team. Big leverage.
Large companies have the budgets. Small ones have the speed. AI rewards the second more than you'd think.
Time back
Less Admin
Meeting notes, first drafts, email replies and reports take minutes instead of hours.
Punch above weight
Enterprise Polish
Proposals, marketing and support that look like a much bigger team produced them.
Move faster
Weeks, Not Years
Fewer approvals and legacy systems. A good idea can be in use by next month.
Small teams move faster. Use it.
Day 10 / 100 · AI foundations · AI readiness self-check
Ready? Check before you scale.
Eight yes-or-no questions. Count your yeses honestly, then read your score in the case file below.
People & process
Foundations
Someone owns AI in the business, by name
Staff know what they may and may not paste in
You've picked one process worth improving
You know how long that process takes today
Data & guardrails
Safety Net
You know where your customer data lives
Acceptable use is written down
There's an approved tool list
AI accounts are business-owned, with MFA on
Know your gaps. Start anyway.
Module 2Finding use casesDays 11–20
Day 11 / 100 · Finding use cases · The task audit
Audit the tasks, not the jobs.
AI doesn't replace roles. It takes over pieces of them. Find the pieces by listing what people actually do in a week.
1 · List
What Gets Done
Everything a role does in a normal week, from the big work to the boring admin.
2 · Time
Where Hours Go
Rough hours per task. Estimates are fine; a week of tallies is better.
3 · Tag
What Kind Of Work
Repetitive? Text-heavy? Rules-based? Or does it need judgement and relationships?
4 · Rank
Where To Look First
Most hours on repetitive, text-heavy work rises to the top of your list.
Start with a week of real tasks.
Day 12 / 100 · Finding use cases · Automate, augment, or leave alone
Automate. Augment. Or leave alone.
Every task on your audit lands in one of three buckets. Where it lands decides how much the human stays involved.
Automate
Ai Does It
High volume, low risk, clear rules. Tagging, routing, formatting. Still spot-check it.
Augment
Ai Drafts, You Decide
Replies, proposals, reports, code. AI does the first 70%; a person owns the result.
Leave alone
People Only
High stakes, relationships, judgement. Disciplinary calls, crisis conversations, big pricing decisions.
Most of the wins live in augment.
Day 13 / 100 · Finding use cases · Scoring value vs risk
Score it before you start it.
Rate each use case on value and risk: Low, Medium or High. The same risk scale runs through the whole playbook, so learn it once.
Quick wins
High Value · Low Risk
Do these now. They build confidence and free up time for the harder ones.
Big bets
High Value · High Risk
Pilot with guardrails, human review and a clear owner. Never skip straight to scale.
Nice-to-haves
Low Value · Low Risk
Let staff experiment within policy. Some will surprise you.
Avoid
Low Value · High Risk
All downside. Park these, however exciting the demo looked.
High value, low risk: start there.
Day 14 / 100 · Finding use cases · Quick wins
Win small. Win soon.
Early wins buy trust, budget and patience for the bigger projects. Pick ones you can show off within a month.
Proven quick wins
Try These First
Meeting notes and action lists
First drafts of emails and replies
Summaries of long documents
Rewriting for tone and clarity
Job ads, SOPs and templates
What makes it quick
The Checklist
Uses a tool you already pay for
Needs no customer personal data
A person checks the output
Saves time every single week
Easy to show before and after
Weeks, not quarters.
Day 15 / 100 · Finding use cases · Pilots that prove value
A pilot is an experiment.
Not a soft launch, not a trial licence nobody opens. An experiment has a scope, a baseline and a pass mark set before it starts.
Scope
Small And Bounded
One process, one team, a fixed run of four to six weeks.
Baseline
Measure Before
Time, quality and error rates today. Without it, “better” is just a feeling.
Pass mark
Decide Up Front
Agree what “worked” means before day one, and who makes the call.
Define “worked” before you start.
Day 16 / 100 · Finding use cases · Build, buy or configure
Configure. Buy. Then, maybe, build.
Three ways to get AI into a process. For most small businesses, the cheapest and safest option is also the first one to try.
Configure
Switch It On
Turn on AI features in tools you already use. Fastest and cheapest, with less control.
Buy
Specialist Product
A dedicated AI tool for one job. Quick to start; you take on vendor and data risk.
Build
Custom, On An Api
Most control and fit. Needs developers, testing and someone to maintain it for years.
Configure first. Build last.
Day 17 / 100 · Finding use cases · Grounding AI in your own documents
Give it your facts to work from.
An AI that answers from your own policies, price lists and FAQs is far more useful, and far less likely to invent things. The technique is often called RAG.
1 · Store
Your Sources
Policies, FAQs, price lists and manuals are loaded into a searchable library.
2 · Retrieve
Find The Right Bits
Each question pulls out the few passages most likely to hold the answer.
3 · Answer
From Those Passages
The AI answers using only what it found, ideally pointing to the source.
Grounded answers beat clever guesses.
Day 18 / 100 · Finding use cases · Writing the business case
One page. Conservative numbers.
Decision-makers don't need an essay. They need the problem, the cost, a benefit they believe, and what you're asking for.
The one-pager
Six Sections
Problem, in hours or rands
What you propose, in one line
Full cost: licences, setup, training
Benefit, estimated low
Risks and the controls on them
The decision you need
What sinks it
Common Mistakes
Vendor “up to” figures quoted as fact
Training and review time left out
No baseline to measure against
Benefits nobody can verify later
Believable beats impressive.
Day 19 / 100 · Finding use cases · Measuring time saved honestly
Net time. Not gross.
“AI saves hours” is easy to claim and easy to disbelieve. Honest numbers survive scrutiny and get you the next budget.
How numbers get inflated
The Traps
Self-reported estimates, made on a good day
Checking and fixing time left out
Only the easiest tasks counted
Measured in week one, while it's new
How to measure honestly
The Fix
Baseline before the tool arrives
Include review and correction time
Sample real, everyday tasks
Measure over weeks, not days
Count the checking time too.
Day 20 / 100 · Finding use cases · Killing a pilot
Know when to stop.
Stopping a pilot that isn't working is a good result, not a bad one. It frees money and attention for the one that will.
Kill signals
Time To Stop
Missed the pass mark after a fair run
Fixing its output eats the time saved
People quietly work around it
A risk appeared you can't control
Stopping well
Do It Right
Decide against the agreed pass mark
Write down what you learned
Thank the team who tried it
Keep the data for the next idea
A stopped pilot is data, not failure.
Module 3AI governanceDays 21–30
Day 21 / 100 · AI governance · Why SMEs need AI governance
Governance isn't red tape.
It's the set of simple rules that lets people use AI with confidence, and stops one careless paste from becoming a POPIA problem.
Protects customers
Their Data
Keeps personal information out of tools that shouldn't have it.
Protects the business
Your Risk
Fewer data leaks, fewer embarrassing errors, less regulatory exposure.
Enables use
Your Upside
Clear rules mean staff stop guessing and start using AI properly.
Rules make safe use possible.
Day 22 / 100 · AI governance · An AI policy on one page
If it isn't read, it isn't a policy.
A policy only protects you if people can remember it. Fit the essentials on one page and push the detail into an appendix.
What goes on the page
Seven Lines
Why we use AI, in one sentence
Which tools are approved
What must never go in
A person checks before anything goes out
When we tell customers AI was used
Who to ask, and how to report a slip
When this page gets reviewed
What makes it stick
Adoption
Plain language, no legalese
Real examples from your business
Everyone acknowledges it
Walked through in a team meeting
Owned by a named person
One page. Plain words.
Day 23 / 100 · AI governance · Acceptable use
Green. Amber. Red.
Staff shouldn't need a lawyer to decide whether they can paste something in. Give them traffic lights and real examples.
Green
Go Ahead
Drafting, brainstorming, rewriting and summarising non-sensitive internal or public material.
Amber
Check First
Anything customer-facing, confidential business info, or code. Approved tools only, with a person reviewing.
Red
Never
Customer personal info in unapproved tools, passwords, and final decisions about people.
Traffic lights, with examples.
Day 24 / 100 · AI governance · Risk tiers
Tier the use, not the tool.
The same Low / Medium / High scale from Day 13, now tied to how much checking each tier needs before it goes live.
Low
Self-Serve
Internal, low stakes, easy to check. Allowed within policy on approved tools.
Medium
Owner Sign-Off
Customer-facing or business-sensitive. Needs an owner's approval and human review.
High
Formal Approval
Decisions about people, personal info at scale, or AI taking actions. Needs an impact assessment and monitoring.
Tier the use, not the tool.
Day 25 / 100 · AI governance · Your AI inventory
You can't govern what you can't see.
A simple register of every AI tool and use in the business. A spreadsheet is fine. Not having one isn't.
What to record
One Row Per Use
Tool and plan (free or business)
Named owner
What it's used for
What data it touches
Risk tier: Low, Medium or High
Where the data is processed
Next review date
Where to find it
The Hunt
A no-blame staff survey
Expense claims and card statements
Installed browser extensions
AI features switched on inside your existing software
List it, own it, review it.
Day 26 / 100 · AI governance · Approval workflows
A fast lane for low risk.
Approval should take days, not months. Match the effort to the risk tier, or people will simply sign up on their own.
1 · Request
A Short Form
What tool, what for, what data, who owns it. Five minutes to fill in.
2 · Tier
Low / Medium / High
The AI lead assigns a tier using the same scale as your policy.
3 · Review
Effort Matches Risk
Low: on the list, approved. Medium: manager and IT. High: add the Information Officer.
4 · Record
Into The Inventory
Logged with its owner, tier and a review date. Then it's live.
Fast for low risk. Careful for high.
Day 27 / 100 · AI governance · Roles and ownership
Every tool has a name next to it.
Governance fails when everyone assumes someone else is watching. In a small business, these roles can be part-time, but they must be named.
Executive sponsor
Sets Direction
Decides how much AI risk the business will accept, and backs the rules.
AI lead
Runs It
Owns the policy, inventory and approvals. A few hours a week, not a new hire.
Information Officer
Popia
A required POPIA role. By default the head of the business, unless formally delegated.
Named owners, not shared worry.
Day 28 / 100 · AI governance · Vendor due diligence and operator agreements
No contract, no customer data.
Before an AI vendor touches personal information, you need answers to a few questions, and, under POPIA, a written agreement.
Ask every vendor
Due Diligence
Where is our data processed and stored?
Is it used to train your models?
How long is it kept, and can we delete it?
Which security certifications do you hold?
What changes between free and business plans?
POPIA operators
Sections 20–21
A vendor processing personal info for you is an “operator”
It may only process with your authorisation
You need a written contract requiring security measures
It must tell you if the data is compromised
Check the vendor. Sign the contract.
Day 29 / 100 · AI governance · AI incident response
Make it safe to own up.
Something will go wrong: the wrong data pasted, a bad answer sent to a customer. Speed matters more than blame.
Contain
First Hour
Stop the use, revoke access, pull anything already sent or published.
Assess
First Day
What data, whose, how many people, and how much harm is possible.
Notify & learn
After
If personal info was compromised, POPIA s22 means telling the Regulator and those affected, promptly.
Report fast. Fix fast. Learn.
Day 30 / 100 · AI governance · Reviewing the policy
Review it like software: often.
AI tools change every few months. A policy written once and filed away drifts out of date without anyone noticing.
When to review
Triggers
Every six months, on the calendar
A new tool or major AI feature arrives
After any incident or near miss
New laws or regulator guidance
A new High-tier use is proposed
What to check
The Review
Is the inventory still accurate?
Are approvals quick enough?
What went wrong, or nearly did?
What do staff keep asking about?
Small updates, often.
Module 4Data protection & POPIADays 31–40
Day 31 / 100 · Data protection & POPIA · POPIA basics for AI
POPIA applies to your prompts too.
Sending personal information to an AI tool is “processing” under POPIA. The same eight conditions for lawful processing apply.
The eight conditions
Part 1
Accountability
Processing limitation
Purpose specification
Further processing limitation
The eight conditions
Part 2
Information quality
Openness
Security safeguards
Data subject participation
Personal data in? POPIA applies.
Day 32 / 100 · Data protection & POPIA · PII in prompts
Need it? Strip it. Or don’t paste it.
Most AI tasks work just as well without the personal details. Know what counts as personal information, then leave it out by default.
What counts
Personal Information
Names with contact details or addresses
ID, account and phone numbers
Call records, location and online identifiers
Special personal info: health, biometrics, religion, race, criminal behaviour and more
Before you paste
Four Questions
Does the task actually need it?
Can you swap it for a reference number?
Is this an approved business tool?
Would the customer be surprised?
Leave personal details out by default.
Day 33 / 100 · Data protection & POPIA · Data classification and de-identification
Label it. Then strip what you don't need.
Four simple labels tell staff what can go where. De-identifying data lets you use more of it safely, if you do it properly.
Four labels
Classification
Public: already published, fine anywhere
Internal: approved tools only
Confidential: approved tools, with care
Restricted: special personal info, ID and account numbers, RICA data. Kept out.
Two ways to de-identify
Know The Difference
Anonymised: can't be re-identified, so it falls outside POPIA
Pseudonymised: names swapped for codes, but a key exists, so it's still personal info
Treat pseudonymised data as personal data
Label first. Share less.
Day 34 / 100 · Data protection & POPIA · Consent and purpose
Collected for X? Don't quietly use it for Y.
Consent is only one lawful basis under POPIA. What trips up most AI projects is purpose: using data for something new that customers didn't expect.
Lawful grounds
Section 11
Consent
Needed for a contract with the person
Required by law
Protects the person's legitimate interest
Your or a third party's legitimate interest
Purpose checks
Sections 13 &Amp; 15
What was it collected for?
Is the new AI use compatible with that?
Would the person reasonably expect it?
Do you need to tell them, or ask?
Same data, new purpose? Check.
Day 35 / 100 · Data protection & POPIA · Cross-border data transfers
The cloud has a country.
Most major AI services process data outside South Africa. POPIA section 72 only allows that on specific grounds.
Section 72 grounds
One Must Apply
The recipient is bound by law, binding rules or an agreement giving adequate protection
The person consents
It's needed for a contract with the person
It benefits them, and consent isn't practical
Ask the vendor
Before You Sign
Which countries process our data?
Can we choose the region?
Who are your sub-processors?
Does the agreement cover transfers?
Know where it goes. Have a basis.
Day 36 / 100 · Data protection & POPIA · Automated decisions (POPIA s71)
A person decides. AI assists.
POPIA section 71 limits decisions with legal or substantial effects on people that are based solely on automated profiling.
What's covered
Section 71(1)
Decisions based solely on automated processing that profile someone: work performance, creditworthiness, reliability, conduct and more.
The exceptions
Section 71(2)
Allowed in some contract situations or where a law or code permits, with safeguards in place.
The safeguards
Section 71(3)
The person can make representations, and gets enough information about the logic used.
Keep a real human in the decision.
Day 37 / 100 · Data protection & POPIA · Retention
Keep it only as long as you need it.
POPIA section 14 says records must not be kept longer than their purpose requires, unless a law says otherwise. AI creates new places for data to linger.
The rule
Section 14
Keep records only as long as the purpose needs
Longer only where law, contract or consent allows
Then delete, destroy or de-identify
Do it so it can't be reconstructed
Where AI data lingers
Check These
Chat histories and shared threads
Uploaded files and attachments
Transcripts and call recordings
Knowledge bases built from your documents
Vendor logs and backups
Set a clock on every copy.
Day 38 / 100 · Data protection & POPIA · The Information Officer's role
Involve them before launch.
Every business under POPIA has an Information Officer, registered with the Information Regulator. AI makes the role more important, not less.
The standing duties
Popia &Amp; Regulations
Encourage and monitor compliance
Handle requests from data subjects
Work with the Regulator on investigations
Maintain a compliance framework and impact assessments
Run staff awareness
The AI duties
Add These
Sign off Medium and High tier uses
Impact-assess AI that touches personal info
Decide on notifiable incidents (s22)
Keep the AI inventory honest
Involve them before launch, not after.
Day 39 / 100 · Data protection & POPIA · RICA and telecom data
Telecom data comes with extra rules.
If you record calls or handle subscriber data, RICA sits alongside POPIA. AI call analytics touches both.
What RICA covers
The Basics
Interception is prohibited unless the Act allows it
Providers must keep communication-related information
Subscribers must be identified and verified
Access to that data is tightly restricted
Questions for AI projects
Before You Build
Is call recording covered by a RICA exception?
Are callers told calls are recorded?
Does the POPIA purpose cover analytics?
Is RICA-retained data kept out of AI tools?
Two laws, one call. Check both.
Day 40 / 100 · Data protection & POPIA · Privacy by design
Design it in. Don't patch it on.
Privacy is cheapest when it's a design decision and most expensive when it's a post-breach fix.
Design principles
Build With These
Collect the minimum the task needs
Private by default
De-identify as early as possible
Limit who and what can access it
Build deletion in from day one
Before you build
Checkpoints
Impact assessment for personal info
Information Officer consulted
Vendor agreement in place
Logging switched on
Retention period decided
Private by default. Always.
Module 5Shadow AI & securityDays 41–50
Day 41 / 100 · Shadow AI & security · Shadow AI
It's already inside.
Shadow AI is any AI use the business hasn't approved or can't see. It's rarely malicious. It's usually people trying to get work done.
Why it happens
The Cause
The tools are free and useful, the approved option is slow or missing, and nobody said no.
Where it hides
The Places
Personal accounts, browser extensions, phone apps, and AI features inside existing software.
What it risks
The Cost
Data leaving the business, no audit trail, and unclear ownership of what's produced.
Offer a safe road, or people build their own.
Day 42 / 100 · Shadow AI & security · Securing AI connectors and integrations
Every connector is a door.
Connectors let AI read your email, files, calendar and CRM, and sometimes act in them. That's the value, and the risk.
What they do
The Value
Let an AI tool search, read and act inside your business systems on a user's behalf.
The risks
The Exposure
Over-broad permissions, AI seeing everything the user can, and access that never expires.
The controls
The Fix
Least-privilege scopes, admin approval, read-only first, and quarterly review of what's connected.
Least access. Reviewed often.
Day 43 / 100 · Shadow AI & security · Prompt injection, explained
Hidden instructions. Real actions.
AI can't reliably tell the difference between content it reads and instructions it should follow. Attackers use that gap.
Direct
Typed In
A user types something like “ignore your rules and…” to push the AI off-script.
Indirect
Hidden In Content
Instructions buried in a webpage, email or document the AI is asked to read.
Defences
Limit The Damage
Fewer tools and permissions, human approval for actions, and outside content treated as untrusted.
Untrusted input plus tools: approve every action.
Day 44 / 100 · Shadow AI & security · Accounts and access
Company accounts. MFA. Clean exits.
The simplest security wins in AI are the same as everywhere else: who owns the account, how it's protected, and what happens when someone leaves.
Set it up right
On Day One
Business accounts owned by the company
Single sign-on where the tool supports it
Multi-factor authentication switched on
Access by role, not by request
Close it down right
On The Last Day
AI accounts on the offboarding checklist
Shared chats and links revoked
API keys and connectors removed
Chat history kept or deleted by policy
Own the account, own the data.
Day 45 / 100 · Shadow AI & security · Browser extensions and plug-ins
Don't trust the logo.
AI browser extensions often ask to read everything on every page you visit. Some are excellent. Some are built to steal.
The risks
What Can Go Wrong
Reading every page, including internal systems
Sending page content to unknown servers
Fake copies of popular AI tools
Updates that quietly change behaviour
The controls
What To Do
A managed allowlist in company browsers
Check the publisher, not just the name
Question broad permissions
Remove what nobody uses
Allowlist first. Install second.
Day 46 / 100 · Shadow AI & security · Guardrails in practice
Catch it before it's sent.
Policy tells people what not to paste. Guardrails catch the moment someone forgets, right at the point of use.
Detect
Spot The Pattern
Scan prompts for ID numbers, card numbers, emails and other sensitive patterns.
Warn or block
Stop The Slip
Warn for amber data, block for red. Tell the user why, so they learn.
Log
Learn From It
Record what was caught, not the data itself, to spot patterns and training gaps.
Guardrails catch slips. Policy prevents them.
Day 47 / 100 · Shadow AI & security · Secure AI configuration
Defaults aren't the safe settings.
Most AI tools ship set up for ease of use, not for your data. Ten minutes in the admin settings closes the biggest gaps.
Check these settings
Admin Console
Training on your data: off
Chat history and retention: set
Public sharing links: restricted
Single sign-on and MFA: enforced
Data region: chosen where offered
Match features to tier
Switch Off What'S Unused
Web browsing
Connectors to company systems
Code execution and file tools
Agent actions
Third-party plug-ins
Configure once. Recheck often.
Day 48 / 100 · Shadow AI & security · Phishing and deepfakes
Verify through a second channel.
AI has made scams fluent, personal and convincing. A familiar voice or face is no longer proof of anything.
AI phishing
No More Typos
Polished, personalised emails that reference real projects and people.
Voice clones
A Few Seconds Of Audio
A short clip from a video or voicemail can be enough to copy a voice.
Defences
Process Beats Instinct
Call back on a known number, dual approval for payments, and a code word for urgent requests.
Urgent plus unusual? Call back.
Day 49 / 100 · Shadow AI & security · Audit logs
If it acts, it's logged.
When something goes wrong, the first question is “what happened?” Without logs, nobody can answer it.
What to log
The Record
Who used which tool, and when
Connectors and permissions granted
Admin and setting changes
Every action an agent takes
Incidents and how they were closed
Why it matters
The Payoff
Investigating incidents quickly
Evidence for POPIA compliance
Spotting misuse early
Measuring real adoption
Log the actions. Review the logs.
Day 50 / 100 · Shadow AI & security · Security awareness for AI
Little, often, and real.
Tools and policies only work if people recognise the risk in the moment. Awareness is a habit, not an annual event.
Five habits
For Everyone
Check before you paste
Verify before you trust
Approve before it acts
Report slips fast
Slow down when it's urgent
Training that works
Format
Short and frequent
Real examples from your business
Near misses shared without blame
New scams as they appear
Habits beat annual videos.
Module 6Responsible AIDays 51–60
Day 51 / 100 · Responsible AI · Bias
Biased data in. Biased decisions out.
AI learns from the past, including its unfairness. Unless you check, it will repeat those patterns quietly and at scale.
Where it comes from
The Source
Historical decisions, who is missing from the data, and proxies like postcode or school.
How it shows up
The Symptoms
Different outcomes for different groups, stereotypes in text and images, weaker accuracy for some accents.
Why it matters here
The Stakes
South African law prohibits unfair discrimination, and customers notice fast.
Assume bias. Then test for it.
Day 52 / 100 · Responsible AI · Fairness checks
Test the edges, not the average.
Fairness isn't a feeling. It's a set of simple checks you run before launch and again whenever something changes.
Practical checks
Before Launch
Compare outcomes across groups
Swap one detail, like a name, and compare
Check accuracy per language and accent
Have people review borderline cases
Keep checking
After Launch
After every model or prompt change
When complaints cluster in one group
On a regular sample, quarterly
When you enter a new market
Check who it works worst for.
Day 53 / 100 · Responsible AI · Transparency
No surprises.
People accept AI far more readily when they hear about it first from you, with a clear explanation of what it does and doesn't do.
Tell
Where It'S Used
Keep a visible list of where AI is used in the business, and share it with staff.
Explain
What It Does
What it decides, what it only suggests, and where people stay in charge.
Record
How It Was Decided
Why it was approved, its risk tier, its owner, and its known limits.
Tell them before they find out.
Day 54 / 100 · Responsible AI · Human oversight
Oversight that can actually say no.
“A human is involved” means little unless that person has the time, information and authority to change the outcome.
In the loop
Approves Each One
A person approves every output before it takes effect. For high-stakes decisions.
On the loop
Watches And Steps In
AI acts; a person monitors and can intervene. For medium-risk, high-volume work.
In command
Sets The Limits
Someone owns the rules, the thresholds and the off switch.
Give reviewers time and authority.
Day 55 / 100 · Responsible AI · Explainability
If you can't explain it, don't decide with it.
Customers, staff and regulators will ask why. POPIA section 71 even gives people a right to information about the logic behind automated decisions.
For the user
Why This Answer
Which sources it used, and what it was and wasn't able to consider.
For the person affected
Why This Outcome
The main factors behind a decision, in plain words, and how to challenge it.
For the auditor
How It Ran
Inputs, model version, instructions and logs, kept for each decision.
Explainable, or not used.
Day 56 / 100 · Responsible AI · Copyright and IP
Check the terms. Check for lookalikes.
Who owns AI-generated work, and what you're allowed to feed in, are still unsettled questions. A few habits keep you out of trouble.
What goes in
Inputs
Don't upload material you don't have the rights to, including clients' confidential documents.
What comes out
Outputs
Ownership of AI-generated work is unsettled. South African law hasn't been tested on modern AI.
The vendor terms
Contracts
Who owns outputs, can you use them commercially, and does the vendor offer IP protection?
Concepts from AI. Finals from people.
Day 57 / 100 · Responsible AI · The duty of accuracy
Your AI's words are your words.
Day 4 covered why AI makes things up. This is about who pays when it does: the business that published it.
The business
Accountable
Customers, courts and regulators hold you responsible for what your AI tells people.
POPIA
Information Quality
Take reasonable steps to keep personal information complete, accurate and not misleading.
Consumer protection
No Misleading Claims
The Consumer Protection Act prohibits false or misleading representations to consumers.
If it says it, you said it.
Day 58 / 100 · Responsible AI · Disclosing AI to customers
Say it's AI. Offer a human.
Customers rarely mind AI. They mind finding out later that they were talking to it, or being unable to reach a person.
When to disclose
The Moments
Chatbots and voice assistants
AI involved in decisions about them
Calls recorded and analysed by AI
AI content that could mislead if unlabelled
How to disclose
The Way
Up front, not in the terms and conditions
Plain words: “I'm an AI assistant”
A clear route to a person
Consistent across every channel
Honest up front. Human on request.
Day 59 / 100 · Responsible AI · Accessibility
Always leave a human door open.
AI can make services far more accessible, or quietly lock people out. Which one depends on how you design it.
Where AI helps
Opening Doors
Live captions and transcripts
Read-aloud and plain-language rewrites
Translation across South African languages
Help available at any hour
Where AI shuts people out
Closing Doors
Voice bots that struggle with some accents
Chatbots that don't work with screen readers
Digital-only channels with no alternative
Loops with no way to reach a person
Design for everyone. Keep a person reachable.
Day 60 / 100 · Responsible AI · An ethics checklist
Eight questions before launch.
Ethics doesn't need a committee. It needs the right questions, asked by the right people, before something goes live.
Questions 1–4
Impact
Who benefits, and who could be harmed?
Would we be comfortable if customers saw how it works?
Is personal information minimised?
Can a person overrule it?
Questions 5–8
Accountability
Have we tested it for bias?
Can we explain its outputs?
Do people know AI is involved?
Who owns it when it goes wrong?
Ask the questions. Write down the answers.
Module 7Rollout & adoptionDays 61–70
Day 61 / 100 · Rollout & adoption · The adoption curve
Win the middle.
Your enthusiasts will adopt AI anyway. Success depends on the practical majority, who need proof, help and a reason.
Early adopters
Already Experimenting
Curious and self-starting. Give them approved tools and make them your champions.
The majority
Waiting For Proof
Pragmatic and busy. They need examples from their own work and easy training.
Late adopters
Need It Built In
Sceptical or overloaded. They adopt when it's part of the workflow and their peers use it.
Enthusiasts start it. The majority sustain it.
Day 62 / 100 · Rollout & adoption · A champions network
Peers teach peers best.
A champion in each team does more for adoption than any central training programme. They're close to the work and trusted by colleagues.
Who to pick
The Profile
One per team, or per 10–15 people
Curious and generous with help
Respected by their colleagues
Not necessarily the most technical
What they do
The Role
Share tips and team examples
First point of help for questions
Bring feedback and risks back
Try new tools and features first
One trusted helper in every team.
Day 63 / 100 · Rollout & adoption · Training that sticks
Their tasks. Their tools. Hands on.
People learn AI by using it on work they recognise. For prompting skills in depth, pair this with the JTC Tech Prompting Playbook.