As artificial intelligence adoption accelerates across South Africa’s property and real estate sector, industry voices are warning that enthusiasm for the technology is outpacing the governance needed to manage it safely.
The real estate sector handles some of the country’s most sensitive data and highest-value transactions: conveyancing and transfer instructions, tenant and applicant records containing personal and financial information protected under the Protection of Personal Information Act (POPIA), and lease documents carrying significant legal and financial weight.
A single manipulated payment instruction, or one exposed applicant file, can cost the equivalent of a year’s technology budget and expose it to regulatory action from the Information Regulator.
For this reason, property companies are being urged to establish formal AI governance boards rather than relying on ad hoc decision-making by individual departments.
Cross-functional representation is essential
An effective board needs more than IT and information security. Legal and compliance, product development, client support, sales and marketing, and finance should all be represented. The latter is increasingly important as vendors shift from per-user licensing to consumption-based pricing that can quietly blow through budgets.
HR also has an important role to play in AI governance. The new technology still requires human oversight for compliance, accuracy and ethical considerations and is expected to reshape roles across the property sector as adoption increases and output expectations rise.
“AI isn’t going to replace the people who run this industry; however, it is already changing what we expect of them,” says Omobolanle Adekola, Product Owner at MRI Software. “The organisations getting the most from AI right now are the ones treating governance as a growth enabler with guardrails, not brakes. In a market like ours, where a huge share of listed REITs and residential portfolios already run on shared platforms, the risk of one ungoverned AI tool touching the wrong dataset is not a hypothetical scenario. A properly constituted board turns that risk into a manageable, repeatable process instead of a potential crisis every time someone wants to trial a new tool.”
Boards should also draw on a range of seniority levels across the organisation. For example, junior staff and middle managers can see first-hand how AI tools are used every day, while senior leadership can keep adoption aligned with company strategy.
Companies operating across multiple African and international regions should be cautious about assuming a single governance board can serve the whole group. Data protection and compliance requirements differ between markets, and boards need to reflect those realities, even while sharing group-wide best practices.
What a governance board actually does
The board’s core job is managing intake: evaluating requests for new AI tools and subscriptions based on what the tool is meant to achieve and what data it will touch.
Not every request warrants the same scrutiny, which is why a tiered approach is recommended. A straightforward licence request might need sign-off from finance alone. Mid-tier requests, involving greater cost or operational impact, will bring IT into the approval chain. The highest tier – tools that touch third-party systems or personal data – requires sign-off from security, legal, and governance, risk and compliance functions together. This ensures the technology integrates safely and meets the organisation’s security standards.
Where governance boards go wrong
Two modes of failure stand out. The first is the rubber stamp: a board that approves every request without pushback has stopped governing. Never sending a request back for rework should be a warning sign, not a point of pride.
The second failure is slowness. A board that takes six weeks to answer a simple question teaches staff to stop asking – pushing them toward free consumer AI tools and putting company and client data at risk. Speed is itself a control: publish target turnaround times, hold the board to them, and keep the lightest-touch tier genuinely light.
A formal board isn’t essential but accountability is
Smaller firms may not need a standalone board, the function can sit within an existing risk or technology committee, but someone has to own intake, policy, training and threat-monitoring. Those responsibilities cannot rest with one person in IT.
Property companies without any form of AI governance in place should begin identifying representatives across departments and convene a first meeting to establish scope and responsibilities. The time investment is real, but so is the cost of getting this wrong in a sector built on high-value transactions and highly sensitive data.
- Omobolanle Adekola, Product Owner at MRI Software
