White paper
Generative AI, POPIA and the FAIS Act: a white paper for South African advice firms
Your advisers are already using ChatGPT, Copilot, Claude, or Gemini. The rules they work under were not written with these tools in mind.
Generative AI in South African Financial Advice is a free, vendor-neutral white paper by Francois du Toit CFP® that compares Microsoft 365 Copilot, ChatGPT, Claude, and Gemini against POPIA, the FAIS Act, and the expectations of the FSCA and Prudential Authority. It is written for owners, key individuals, compliance officers, and advisers at South African financial advice firms.
Vendor-neutral. Every reference verified by a human. Free to read.
What questions does the white paper answer?
These are the questions firm owners and compliance officers ask us most often. The paper works through each one.
- Can my team keep using the free version of ChatGPT or Gemini for client work?
- What do I need to have signed before client information goes into an AI tool?
- If the FSCA asks how we use AI, what do we show them?
- Does it matter where the tool processes our data, and does storing it in South Africa settle the question?
- Is paying for a business licence the same as being compliant?
- Who is responsible when an adviser pastes a client file into a chatbot?
- Are "does it learn from my data", "how does it handle my data", and "where does it store my data" the same question?
Which risks are you managing right now?
Most firms we speak to are worried about the same five things. The paper gives you a resource for each one.
Personal information leaving your control
Every prompt that contains a client's name, ID number, or financial position is personal information leaving your firm. POPIA has clear expectations about who may process it, under what contract, and in which country.
What the paper gives you: a plain-language walk-through of the POPIA sections that apply, including operator contracts and cross-border transfers, plus a guide to what a Data Processing Addendum is and how to put one in place.
Advice records that cannot show human review
If an AI tool helped draft a record of advice or a suitability note, you need to be able to show what the adviser checked and decided. The FAIS Act and the General Code of Conduct set the standard for those records.
What the paper gives you: use case guidance for drafting suitability and advice records, and for summarising client documents, with the questions to ask before the output goes on file.
A breach with more than one reporting clock running
When something goes wrong with client data in an AI tool, more than one law may require you to report it, each with its own timeline and its own regulator.
What the paper gives you: an overview of the breach notification duties under POPIA and the Cybercrimes Act, side by side, so you know which clocks exist before you need them.
Tools spreading through the firm without anyone signing off
Advisers sign up for AI tools on personal accounts because they are useful. Nobody decided this, so nobody owns it, and the compliance officer often finds out last.
What the paper gives you: a thirteen-point governance checklist for adopting AI in a South African advice firm, written so you can work through it with your team.
A regulator that has said it is watching
The FSCA and the Prudential Authority have published their view on AI, cloud, and offshoring in financial services, and they have said they will look at how firms manage these risks.
What the paper gives you: a summary of the FSCA and Prudential Authority AI report, Joint Communication 2 of 2025, and Joint Standards 1 and 2, together with a watch list of developments for 2026 and 2027.
What is inside the white paper?
The paper runs to 39 pages and takes about an hour to read in full. The comparison table and the checklist are built so you can use them on their own.
39 PAGES · ABOUT ONE HOUR TO READ
- The South African regulatory frame: ten instruments explained in plain language, including POPIA, the FAIS Act and General Code of Conduct, Board Notice 194 of 2017, Joint Communication 2 of 2025, Joint Standards 1 and 2, the Cybercrimes Act, FICA, the FSCA and Prudential Authority AI report, the COFI Bill, King V, and the National AI Policy
- What a Data Processing Addendum is and how to put one in place
- A profile of each of the four tools: Microsoft 365 Copilot, OpenAI ChatGPT, Anthropic Claude, and Google Gemini, covering data residency, the POPIA operator contract, certification, copyright indemnity, and points of caution
- A side-by-side comparison on twelve compliance dimensions
- Use case guidance for five everyday tasks: drafting client communications, summarising client documents, drafting suitability and advice records, internal knowledge work, and meeting transcription
- A thirteen-point governance checklist for adopting AI in an advice firm
- Open questions and developments to watch in 2026 and 2027
- Full references, every one verified by humans
Who should read this white paper?
Principals and key individuals
You carry the responsibility for how your firm uses these tools. The paper shows you what to put in place and what to ask your providers.
Compliance and information officers
You need to answer for AI use under POPIA and the FAIS Act. The paper gives you the regulatory map, the comparison, and the checklist in one place.
Advisers and paraplanners
You use these tools every day. The paper explains what is at stake when client information goes into one, and how to work in a way you can defend.
About the author
Francois du Toit CFP® is the founder of PROpulsion and has worked in the South African financial planning profession for nearly thirty years. Through PROpulsion he supports advisers, planners, and their teams with training, community, events, and consulting. PROpulsion has no commercial relationship with Microsoft, OpenAI, Anthropic, or Google, and received no payment or sponsorship from any of them in connection with this paper.
How was the white paper produced?
We are open about how our work is made. Generative AI was used to research this paper, and the research was then drawn together and written with the help of AI tools. A human verified every reference against primary sources, including the official texts of the Acts, regulator publications, and provider documentation. Humans edited and reviewed the whole paper. The research is current as at June 2026, and if you spot a mistake or a more recent development, we would like to hear from you at info@propulsion.co.za.
Frequently asked questions
Yes. The white paper is free to read and download. There is no paid version and no upsell inside it.
We ask for your first name and email address so we can send you the PDF. You choose whether we may also send you occasional updates, and you can unsubscribe from any email.
No. The paper is for general information and professional development. It does not replace advice from your compliance officer or a qualified legal adviser about your firm’s own position.
The research is current as at June 2026 and every reference was checked against primary sources at that time. AI provider terms and South African regulation change often, so treat the paper as a starting point and check for updates.
We plan to review the paper as the regulatory and provider positions change, and we will note corrections we receive. If you spot something that has moved on, write to info@propulsion.co.za.
Owners, principals, key individuals, compliance officers, and information officers at South African financial advice firms, plus the advisers, planners, and paraplanners who use generative AI tools in their daily work.
Yes. Please share the PDF with your colleagues and your compliance officer. The governance checklist works best when the whole team works through it together.
Read the white paper before the next
client file is uploaded into a chatbot
Your team is using these tools this week. Get the paper, work through the checklist, and know where your firm stands.
This white paper is for general information and professional development. It is not legal, regulatory, or compliance advice. Speak to your compliance officer or a suitably qualified adviser about your firm’s own position.
More from PROpulsion: AI training for advice firms · Join the PROpulsion Community · Watch PROpulsion LIVE