Healthcare makes the consequences of AI data governance particularly tangible. When an AI system assists with medical advice or diagnostics, the rules for how data is used are not just a matter of compliance; they are a matter of trust and safety.
Two large-scale South African health initiatives, MomConnect and Audere, illustrate the governance challenges that can arise when AI is introduced into an existing service. They highlight how new uses of personal data can raise questions that the original service's consent and data-handling arrangements may not have anticipated, offering important lessons for businesses seeking to integrate AI responsibly while maintaining user trust.
What does MomConnect's Ask-A-Question feature do?
MomConnect is a flagship maternal health program from South Africa's National Department of Health, operated by Reach Digital Health. It provides vital health information to nearly 5 million pregnant women and new mothers via SMS in all 11 of the country's official languages, as well as through an English-language WhatsApp service.
Its AI-powered "Ask-A-Question" (AAQ) feature uses natural language processing to handle up to 60,000 user queries a month. It achieves 83% accuracy in matching frequently asked questions and 85% accuracy in detecting urgent situations, having escalated approximately 100,000 urgent cases to human operators for follow-up.
What changes when AI is added to an established service?
Even in this mature and well-governed program, a structural consent gap exists. The GSMA report identifies a structural consent challenge in MomConnect, despite the programme's established governance practices. Because many users were registered by clinic staff using shared devices, individually confirmed consent under South Africa's Protection of Personal Information Act (POPIA) was not established.
The report distinguishes this from a second issue: consent for receiving health information did not extend to the secondary use of conversational data to train or improve AI models. The challenge, therefore, is not simply whether consent was obtained, but whether existing consent arrangements adequately addressed the new uses of data introduced by AI.
MomConnect illustrates the difficulty of adapting consent and data-handling practices when AI is added to an established service. Audere's Be Wise Health platform offers a complementary perspective, demonstrating the value of building governance safeguards into a service from the outset. However, its own consent arrangements do not explicitly cover all secondary uses of conversational data, highlighting that governance-by-design does not eliminate the need to address consent and accountability as AI applications evolve.
How does Audere's Be Wise Health build governance from the start?
Audere, a nonprofit AI health technology organisation, offers a complementary perspective through its bwisehealth platform, a WhatsApp-based AI companion operating in South Africa. The platform supports users with sexual health, mental health and chronic disease management.
Audere demonstrates a governance-by-design approach, investing in safeguards and contextual testing before scaling its services. Its approach includes:
Contextual pilot testing: Investing three years in testing across different user groups and clinical settings to understand how the technology performs in practice.
Proactive harm monitoring: Building systems to flag high-risk conversations, including references to suicide, gender-based violence and mental health crises, for escalation to human operators.
Developing governance standards: Drawing on established international frameworks, including those associated with the FDA, HIPAA and GDPR, to inform its approach to responsible AI deployment.
However, proactive safeguards do not resolve every governance challenge. The GSMA report also identifies outstanding questions around the secondary use of conversational data, individual redress when users experience harm, and independent verification of safeguards. These issues highlight the importance of not only designing governance into an AI service from the outset, but also ensuring that data use remains transparent, users have meaningful avenues for redress, and safeguards can be independently assessed.
Taken together, MomConnect and Audere illustrate two sides of the same challenge: established services may need to revisit consent and data practices as AI is introduced, while services designed with governance in mind must continue to address emerging risks and accountability gaps as they evolve.
The experiences of MomConnect and Audere point to a broader principle: AI governance is not a one-off compliance exercise, but an ongoing responsibility that must evolve as a service's technology, data use and potential impact change.
For businesses, this means that introducing AI into an existing service should prompt a fresh assessment of whether current consent arrangements remain appropriate, whether new uses of personal data are adequately explained and governed, and whether safeguards and accountability mechanisms are sufficient for the risks involved. Building governance into a service from the outset is valuable, but it does not remove the need to revisit these questions as the service evolves.
Although these lessons emerge from healthcare, they apply to any organisation integrating AI into products or services that already collect personal information. The key is to treat each significant change in how data is used or how a service operates as an opportunity to reassess whether existing governance arrangements remain fit for purpose.
Based on research by Tanvi Deshpande and Emma Leering, GSMA Mobile for Development, with contributions from Robin Miller and Alim Ladha, Axum, GSMA Intelligence and research conducted by Axum and the Global Center on AI Governance, published in Scaling AI for SMEs: Insights Into South Africa's AI Data Governance Environment (2026).
