South Africa’s draft national Artificial Intelligence (AI) policy gives small businesses a timely reason to formalise how they use AI in marketing, sales and customer follow-up. Cabinet approved the draft policy for public comment in March 2026, while the published Government Gazette sets out proposed principles covering ethical development, data governance, transparency and human control. The Presidency said the policy is intended to support responsible innovation while widening access to AI skills and economic opportunity. The Gazette version remains a draft, not a final law.

For an SME, the immediate lesson is not to wait for a finished regulatory framework before creating basic safeguards. AI-generated content, automated lead scoring, summarised enquiries and suggested customer replies can all affect how personal information is handled and how prospects are treated.

What the draft policy puts on the agenda

The draft policy proposes a risk-based approach, with stronger controls for higher-risk systems. It also refers to fairness, explainability, accountability, privacy and human oversight. The document proposes that organisations should be able to identify who is responsible for an AI system and should maintain traceable decision-making processes in appropriate contexts.

That does not mean every small business needs a large compliance department. It does mean that an owner or marketing manager should be able to answer a few straightforward questions: What information is being used? Why is it being used? Which tool processes it? Who checks the output? What happens if a customer challenges a decision or asks for their information to be removed?

Three controls to introduce now

  • Define permitted uses. Write down where AI may assist, such as drafting first versions of articles, classifying incoming enquiries or suggesting follow-up timing. Separate these lower-risk uses from decisions that could materially affect a customer.
  • Keep a human review step. AI can prepare a reply or summarise a conversation, but a responsible team member should check accuracy, tone, personal information and promised next steps before communication is sent.
  • Keep an evidence trail. Record the source of a lead, consent status, assignment history, follow-up activity and any significant changes made to an AI-assisted message. This makes it easier to investigate errors and honour customer requests.

Why connected lead operations matter

AI controls work better when customer information is not scattered across inboxes, spreadsheets and private notes. A shared CRM can keep leads and contacts together, record consent, assign selected contacts to opt-in invitations and show which follow-ups have taken place. Branded email templates, timed nurture sequences and open or link tracking can then support a consistent process without removing human judgement.

Content Studio can also help teams keep AI-assisted articles and social posts editable before approval. The value is not automation for its own sake; it is fewer manual handovers and a clearer record of what was prepared, reviewed and sent.

A practical next step for owners

Start with one customer journey, such as a website enquiry followed by a permission-based email sequence. Map the data collected, the people responsible, the points where AI may assist and the points requiring approval. Review the process against POPIA obligations and your own customer expectations. The draft policy may change before it is finalised, so treat this as operational preparation rather than a claim that new rules are already in force.

Businesses that want to connect consent records, lead assignment and reviewable email sequences can talk through an email-sequence setup that fits their current process.