This series is for people who are being asked to make decisions about AI and are not technologists. If you have ever sat in a meeting where someone said "but is it POPIA compliant?" and nobody could actually answer, this is written for you.
We are going to start further back than most articles do, because the whole POPIA question turns on one thing that is almost never explained: what physically happens when someone types a question into an AI.
There is no cloud, there is someone else's computer
When you type a question into an AI assistant, it feels like the answer is produced by the app on your screen. It is not.
Your words are packaged up, sent over the internet, and delivered to a computer in a building. That computer reads your words, works out a reply, and sends the reply back. The building has an address. It is in a country. It is owned by someone, staffed by someone, and subject to the laws of wherever it stands.
That is the entire mechanism. There is nothing more mystical going on, and once you can picture the four boxes, you can ask sensible questions about every one of them.
The third box — the building where the thinking happens — is the one nobody pictures, and it is the one this entire series is about.
An analogy that actually holds
Imagine you run a busy office and you send documents out to a transcription bureau.
You would want to know where the bureau is. You would want to know who works there and what they are allowed to read. You would want to know whether they keep a copy after the job is done, and for how long. If the documents contained medical records, you would want all of that in writing before you sent the first envelope.
None of those questions require you to understand transcription. They are questions about a business relationship and about where things physically go.
AI is the same. You are sending material to someone else's computer to have work done on it. The questions are identical: where is it, who can see it, what is kept, and is any of that written down.
The one place the analogy breaks down is worth noting. With the bureau, you posted the envelope deliberately. With AI, the sending happens invisibly, thousands of times a day, whenever a member of staff pastes something into a chat box. Nobody experiences that as "sending confidential material to a third party in another country", but that is what it is.
"Local" means three different things
Here is where most of the confusion in South African organisations comes from. The word "local" gets used for three completely different claims, and only one of them is the one people usually care about.
"It's available locally." A South African organisation is allowed to sign up and pay for it. That is a commercial fact. It tells you nothing whatsoever about where your words are processed.
"It's stored locally." The files, records and history sit on machines in this country. This is real and it is worth having. But storage is not thinking — a document can be stored in Johannesburg and still be read by a computer in Ireland every time someone asks a question about it.
"It's processed locally." The actual reading and writing happens on machines here. This is the claim people mean when they ask the question, and it is the one that is least often true and least often checked.
When a supplier tells you their AI is "available in South Africa", they are almost certainly telling you the truth about the first meaning. They are not lying to you. The word is just doing three jobs at once.
The fix is a single, polite question: "When you say local, do you mean we can buy it here, that it's stored here, or that it's processed here?" In my experience that question changes the tone of a meeting immediately, because it is obviously reasonable and it cannot be answered with an adjective.
Why any of this matters
You might reasonably ask why the location of a building should matter so much.
It matters because South African law places obligations on you when personal information about people — your customers, your patients, your citizens, your staff — goes to another country. Not a prohibition, as we will see in the next article. But obligations, which you have to have actually met.
It also matters for reasons that have nothing to do with law. If the building is far away, answers come back more slowly. If the relationship with that country changes, your service is exposed. If something goes wrong and you need to reconstruct what happened, you need to know whose records to ask for.
But the legal question is the one that stops projects, so that is where we go next.
What to take from this article
Three things, and none of them are technical.
AI is a computer in a building. Your words go there and come back. Everything else in this series is a detail hanging off that fact.
"Local" has three meanings. Available, stored, processed. Always ask which one is being claimed.
Sending happens invisibly. The most common way personal information reaches an overseas AI service is not a considered decision by an architect. It is a member of staff pasting something into a chat window because it made their afternoon easier.
In the next article we deal with the thing everybody believes and almost nobody has checked: whether POPIA actually says your data has to stay in South Africa.
This series explains how the rules work in plain language. It is not legal advice, and I am not a lawyer. Your legal and privacy people make the actual determination for your organisation — what this series does is help you ask them a well-formed question.
For readers who want the technical version of the same subject — deployment types, inference profiles, regional endpoints and how to verify a provider's claim — see AI models available in South Africa: what "available" really means.
How CloudNala can help
The most useful hour we spend with a leadership team is usually this one: drawing the four boxes on a whiteboard for a service they already run, and filling in which country each one is in. It is not a technical exercise and it does not need a project. It just needs someone to ask the question out loud.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book an AI Readiness Workshop or write to us at consult@cloudnala.co.za