For small and medium-sized enterprises (SMEs), artificial intelligence is rapidly moving from a niche technology to an accessible tool for everyday business. Yet, as AI becomes more common, a critical challenge has emerged: the gap between having data governance rules and implementing them. South Africa offers a useful case study. It has one of the continent's most comprehensive data governance environments and was ranked the highest-performing African country in the 2024 Global Index for Responsible AI.
However, research from a new GSMA report, Scaling AI for SMEs, shows that strong policies do not automatically translate into strong practices.
The report's key insight is that for most AI-active SMEs, the primary barrier to robust governance isn't a lack of awareness, but a lack of capital and practical guidance.
This distinction between policy on paper and operational reality is the central lesson for businesses everywhere.
What is AI Data Governance?
AI data governance refers to the technical, policy, and regulatory frameworks used to manage data throughout its lifecycle, from creation to deletion, within AI systems. For an SME, this doesn't mean building a large compliance department. It means putting proportionate structures in place for how data is used, with responsibilities clearly understood and risks considered before and after an AI tool is deployed.
Why Does AI Data Governance Matter for Small Businesses?
Many SMEs adopt AI through third-party platforms rather than building systems themselves. The GSMA survey found that for most use cases, between 61% and 70% of AI-active organisations were still in the pre-deployment or early deployment stage. This creates an important opportunity. Governance decisions made now, before an AI system is fully scaled, are far easier and less costly to implement than trying to correct problems later.
Ten AI Governance Lessons from the Research
The GSMA report provides evidence-based lessons that SMEs can apply to their own AI strategies.
Governance should start before deployment. The research shows most surveyed SMEs are still in early stages of AI adoption, making it the perfect time to establish good governance before systems become deeply embedded in business processes.
AI governance is broader than compliance. It requires a holistic view of data quality, accountability, security and consent. The report notes that responsible AI requires considering how systems perform throughout their entire lifecycle.
Existing consent may not cover new AI uses. A consistent finding across the four case studies in the report was that data-sharing arrangements often predated the AI applications built on that data. SMEs must treat AI as a new use case requiring fresh consent.
Someone needs to own AI decisions. The research highlights an "accountability vacuum" in which responsibility for AI outcomes is spread across platforms and developers without being formally assigned to any single party, leaving businesses and their customers exposed.
Governance needs resources. The report clearly identifies capital constraints as the primary barrier. Survey data shows that SMEs with a financial commitment to compliance were significantly more likely to perform structured risk assessments.
Data quality is part of responsible AI. The report links fragmented and unreliable data to poor AI outputs and a failure to properly represent the very populations AI systems are meant to serve.
Cloud adoption creates governance questions. With two-thirds of surveyed SMEs using third-party or cloud-based storage, the report highlights unresolved questions regarding cross-border data processing for businesses that rely on international infrastructure.
AI needs monitoring after launch. Governance should not stop when a system goes live. The report identifies post-deployment monitoring as the least-built safeguard, which can lead to model drift and declining performance over time.
Local context matters. The research emphasizes that AI systems need data that represents the people and environments they serve, which is especially critical for reaching underserved populations and supporting local languages.
Proportionality matters. The report concludes that effective AI governance for SMEs must be proportionate, reflecting the size, maturity and risk profile of the organisation rather than applying a one-size-fits-all enterprise model.
Frequently Asked Questions (FAQs)
Where should a small business start with AI governance?
Start by assigning a named owner for AI decisions and focusing on the highest-risk use case in your business. Use a simple five-step checklist: define the use case, confirm consent, assign ownership, monitor after launch and document vendor terms.
What does "proportionate" governance look like in practice?
It means matching your governance efforts to the level of risk. An internal AI tool for process automation requires less oversight than a customer-facing AI that makes decisions with significant financial or personal impact. The goal is to be practical, not to create unnecessary bureaucracy.
Based on research by Tanvi Deshpande and Emma Leering, GSMA Mobile for Development, with contributions from Robin Miller and Alim Ladha, Axum, GSMA Intelligence and research conducted by Axum and the Global Center on AI Governance, published in Scaling AI for SMEs: Insights Into South Africa's AI Data Governance Environment (2026).
