In short
- Start from a workflow that repeats, not from a tool.
- Map where the work happens, which systems hold the data and whether personal information is involved.
- Choose the simplest connection that does the job, keep your logic and data under your control, and build in a human check and an exception path.
Most useful AI in a business is not a new product. It is an existing process with AI built into one or two steps, connected to the systems the business already runs on. This guide walks through how to find that process, connect it and keep control of it.
1. Start with the workflow, not the AI
Choose one process that repeats, takes real time and has a clear start and end. Quote follow-up, supplier invoice capture, client onboarding and monthly reporting are typical. Write the steps down in order, as they happen today and not as they should happen. Mark where time goes and where information is copied from one place to another. Those copy points are usually where integration pays off.
2. Map the systems and the data
For each step, note which system holds the information: email, WhatsApp, a spreadsheet, your accounting package, a CRM, a shared drive. Then note three things about it.
| Question | Why it matters |
|---|---|
| What data is it? | Personal information needs more care than a price list. |
| Who can see and change it? | The integration will act with someone’s access. Decide whose. |
| Can the system connect to others? | Many accounting and CRM tools offer connections. Some do not, which limits your options. |
3. Decide what the AI is for
AI does four jobs well inside a workflow.
- Read: pull fields out of emails, PDFs and forms.
- Sort: label and route incoming items.
- Draft: write a first version of a reply, a summary or a report.
- Flag: point out what looks unusual, for a person to look at.
Keep it away from decisions about people that it makes alone (see section 71 of POPIA), from anything hard to undo such as payments, and from legal judgement. Use it to prepare work for a person, not to replace the person.
4. Choose how to connect
There are four common ways, from simplest to most involved. Take the simplest that does the job.
| Approach | Good for | Watch for |
|---|---|---|
| Manual hand-off (copy and paste) | A short trial of an idea | Never paste personal information into a public tool |
| Features inside tools you already pay for | Simple drafting and summaries | Limited control over where data goes |
| A connector or automation platform | Linking everyday apps without custom code | Another supplier holding your data and logic |
| A direct integration built for you | Core processes, sensitive data, anything you want to own | Needs an owner to maintain it |
5. Build in the human check and the exception path
Every automated step needs an answer to three questions. What happens when the AI is unsure? What happens when the input is unusual? What happens when a connection fails? The answer should be that the item goes to a named person, with enough information to deal with it. Keep a simple record of what the process did, so you can find out what went wrong.
6. Build POPIA in from the start
This is general information, not legal advice. For any workflow that touches personal information, write a one-page note that answers these questions.
- What personal information flows through the process, and why do we need it?
- Which suppliers process it for us, and is there a written contract with each?
- Where is it processed? If outside South Africa, what protection applies?
- Who has access, and how is it secured?
- How long do we keep it, and what deletes it?
- Have we told the people concerned that AI is involved?
7. Pilot small, then review
Run the workflow on a small share of real work for a few weeks. Record the hours a week the task took before, and after. Record errors and exceptions. About a month in, review what works, correct what does not and decide whether to widen it. A pilot sized to what you can afford to get wrong also suits a business watching its cash flow.
Common ways integrations go wrong
- Starting with a tool and looking for a use for it.
- Automating a process that two people do in two different ways.
- No named owner, so nobody notices when it stops working.
- No exception path, so odd cases disappear.
- Personal information pasted into accounts nobody controls.
- Logic and data held only inside one supplier’s product.
Before you go live
- One workflow chosen, with its steps written down as they happen today.
- Systems and data mapped, with personal information marked.
- The AI’s job named: read, sort, draft or flag.
- The simplest workable connection chosen.
- A named person owns the process and checks the output.
- Exceptions go to a person, with context.
- A one-page POPIA note written, and supplier contracts in place.
- Before-and-after measure of hours a week agreed.
- A review date set for about a month after launch.
This is general information, not legal advice. For a decision about specific people or a specific contract, speak to a qualified adviser.
Sources
- South Africa: AI in the workplace, 5 of 6 Practical guidance on what employers need to do, Bowmans, 16 September 2026
- Protection of Personal Information Act 4 of 2013, Republic of South Africa
