Attendees at the 2026 IT Indaba, Africa’s largest IT conference and expo, learnt how to drive AI success as shadow IT becomes harder to control.
It’s undeniable that finding balance between enabling people to freely use AI for innovation, without a data security and intellectual property cost, is a challenge. So, how can CIOs govern organisational data when they can’t easily see what AI agents are doing?
This was the focus of the first panel discussion at the 2026 IT Indaba, held at the Sandton Convention Centre and attended by over 2,400 tech professionals.
Facilitated by leadership architect Colvin Breda, the informative session entitled Beware Shadow IT: Governing the Invisible in the Age of AI, got off to an engaging start with panellist Peter Robb, group CIO of the Omnia Group. He opened the discussion by saying that IT professionals have taken for granted that there’s a human in the loop – until now.
AI agents change the rules of governance
“An agent is a new class of identity. It uses a combination of user access levels, interoperable integration, and more. We must consider how to manage all of these attributes, plus the fact that few AI platforms natively cater for objects that support agents,” said Peter.
He added that his organisation is JSE listed, so they’re under intense data compliance scrutiny during audits. Due to this, his IT team has implemented a new framework when it comes to AI agents.
There are five gates of governance against all agents: ownership, which means there needs to be a human accountable to each agent; identity, which requires credentials for each agent for traceability; scope, based on risk aversion, with privileges at task versus role level; observability, to understand which agent is executing what and where; and implementing lifecycles to agents, because the last thing you need is a rogue agent running in the background and that wasn’t decommissioned.
For Thato Sopeng, Sasol’s vice president of digital and operations, there is tension between not blocking unapproved LLMs while allowing free employee experimentation.
“So, we decided to put in place the right guardrails to allow the organisation to play around. But, we must ensure IP isn’t being uploaded, which is why, as the exec IT team, we’re in control of the environment. We can’t stop people using LLMs, it’s like stopping oxygen because the organisation is so big. We have one standard [enterprise] AI tool, but people are encouraged to try out different applications; some come with embedded AIs and they don’t realise it. The onus is on us to ensure we have the right controls in place, otherwise we’re stifling innovation – it’s a tough balance.”
She added that organisational cross-functionally is equally important. “We have an AI governance committee that not only comprises IT; there are people from across the business including legal and operations. This helps us appreciate different nuances and contexts and the guardrails we need. It’s a journey; we’re getting there and learning as we go.”
Enabling experimentation without exposing IP
Panellist Tafadzwa Ramhewa, IT director at QCTOE, has found that employees naturally gravitate towards free AI tools even if an alternative has been approved by the organisation. This is why informing people about ‘the why’ behind AI usage is essential. “AI policy can look restrictive, but they need to know about what can happen. Human beings must take accountability, because most AI tools will convince you something isn’t true but is feasible. This is why we have monthly and quarterly training on AI and its interface with cybersecurity risks.”
A major AI risk also now comes from third parties. “Third-party consultants are putting your organisation’s IP into their own AI models and tools; everyone is under pressure to use AI and gather data to make it valuable,” highlighted Peter.
“Corporates use consultants for specialist skills, but they’re using your company’s data to produce better results. It’s easy for information like IP to become indirectly easily accessible to competitors. My organisation has implemented controls such as ‘Clean Rooms’, which are collaborative workspaces built on our environment, where we and third parties work, but we configure that environment and control who is accessing the data. It’s not a silver bullet but it allows us to ask the right questions. As CIOs, you must protect your organisations, but it’s a race for data to be ingested into proprietary LLMs.”
Keeping tokenomics in check
For Thato, understanding AI economics (or tokenomics) is another important aspect for CIOs to consider. “We can’t let usage-based AI become an open-ended bill, especially when the whole organisation is vibe coding; we have to be mindful of these frontier models and what’s free versus paid for – often they start out free then it becomes a massive bill.”
To address this, Thato’s organisation looked at people’s AI usage, with top users allocated a token cap. “Doing this taught us to be mindful of our usage as well. We want to enable the organisation [to innovate and experiment] but visibility of how much LLMs are costing is critical.”
Tafadzwa added that free AI notetaking tools can also turn into a minefield. “They may seem harmless, but you have to look at how a company’s information is used. People look for ease but that doesn’t always align with compliance. If a tool isn’t deemed safe, give them a viable alternative, otherwise there could be a lot of leaked data and reputational risks that will come back to IT.”
Wrapping up, Peter reiterated that IT leadership can’t be a bottleneck and stifle AI’s development and implementation. “Instead, our approach has been to rather slow down adoption. We have had a ‘curtain’ over IT to do this responsibly, while educating users at the same time. If the end user can't prompt effectively it gives the wrong results and becomes expensive. Train your board and your users; unlocking the value AI brings is a complete mindset shift.”
