AI & Machine Learning Company in Johannesburg

A scoped AI proof of concept at Johannesburg rates runs ZAR 350,000 to ZAR 850,000 (roughly USD 19,000 to USD 47,000 at mid-2025 ZAR rates) over six to ten weeks, covering data audit, a baseline model, and a hosted demo. A production ML system — fraud detection, credit decisioning, churn prediction, document extraction, or claims triage — typically lands at ZAR 1.2M to ZAR 3.8M (USD 65,000 to USD 210,000) including MLOps, monitoring, and a POPIA-aligned model card. A full production AI platform with multiple models, RAG, fine-tuning, and enterprise integration ranges from ZAR 3M to ZAR 14M (USD 165,000 to USD 770,000). Johannesburg rates sit above Cape Town for banking and insurance work because the JSE-listed and SARB-regulated concentration is higher in Sandton. We give fixed-fee proposals in either ZAR or USD with documented B-BBEE compliance status where the client's scorecard requires it. Discovery, Capitec, and Standard Bank benchmarks anchor the upper end of rigour expectations.

Every Johannesburg engagement opens with a POPIA mapping. The Protection of Personal Information Act 2013 has been fully effective since 1 July 2021 and is actively enforced by the Information Regulator under the late Pansy Tlakula's and now Mosalanyane Mosala's leadership. We deliver a Section 14 data inventory, a Section 19-22 information security risk assessment, controller-operator agreements under Section 21, special-personal-information handling for race, health, biometric, and financial data under Sections 26-33, and a cross-border transfer assessment under Section 72 — most AI workloads that hit Bedrock or Azure OpenAI outside af-south-1 or South Africa North constitute transfers and need the corresponding lawful basis (data subject consent, adequacy, or contractual safeguards). For high-risk processing we conduct a Section 79 prior authorisation analysis with the Information Regulator path mapped explicitly. The Regulator's published enforcement notices and the 2023-2024 annual reports inform our risk calibration.

Yes. SARB Joint Standard 1 of 2024 on Model Risk Management, issued jointly by the South African Reserve Bank Prudential Authority and the Financial Sector Conduct Authority, sets out the regulatory expectations for governance, development, validation, and ongoing monitoring of models used by banks, insurers, and other regulated financial institutions. We map every model in scope against the standard's risk-tiering framework (high, medium, low impact), deliver an independent validation pack (typically by a separate team within our practice acting as second line on the engineering team's models), and produce documentation suitable for the client's internal model risk committee and SARB Prudential Authority on-site review. The deliverable set includes a Model Development Document, Independent Model Validation Report, Ongoing Performance Monitoring Plan, and a Model Change Management Process. Standard Bank, FirstRand, Absa, and Nedbank have all communicated internal model risk maturity programmes consistent with Joint Standard 1 expectations.

B-BBEE (Broad-Based Black Economic Empowerment) scorecards determine vendor eligibility at all South African state-owned enterprises (Eskom, Transnet, SAA, the Department of Trade Industry and Competition supplier rosters) and at most JSE-listed enterprises whose procurement teams chase their own scorecard targets. Codazz delivers Johannesburg engagements through a structure that supports the client's preferential procurement scorecard — depending on the contract value, we either route delivery through a B-BBEE-rated South African delivery partner with the relevant Level certification, or structure the engagement so the client can claim Enhanced Recognition under the Sector Codes that apply. We document the structure transparently up front so the client's B-BBEE verification agency (SANAS-accredited) has clean evidence at audit. For pure offshore-delivery engagements where the client does not require local procurement credit, the engagement is structured for cost efficiency without the scorecard overhead.

Yes. We ship RAG systems, internal copilots, document extraction pipelines, claims-triage agents, and policy-Q&A assistants for South African banks (Standard Bank, FirstRand, Absa, Nedbank, Investec, Capitec) and insurers (Discovery, Sanlam, Old Mutual, Santam, Hollard, OUTsurance). For SARB-regulated and POPIA-sensitive workloads we stay inside af-south-1 with Anthropic Claude on Bedrock or self-hosted Llama 3 on Teraco-colocated GPU instances, apply SARB Joint Standard 1 model risk controls, produce challenger-model documentation, and ship strict PII redaction, prompt-injection defences, human-in-the-loop review gates, and evaluation harnesses that run before every production push. Discovery-pattern behavioural-analytics overlays (where appropriate) and Capitec-pattern thin-file scoring (where the use case allows) are referenced architectures rather than reimplementations. Output logs feed existing SIEM (typically Microsoft Sentinel, Splunk, or QRadar) and model risk platforms.

Yes. Capitec pioneered alternative-data credit scoring at scale in South Africa, and the National Credit Regulator's data shows the thin-file and emerging-credit market remains structurally large, particularly across townships and informal-sector workers. The data sources are mobile money and EFT transaction patterns, airtime and electricity prepaid behaviour, cellphone metadata, payslip and SARS tax-clearance data where available, retail credit (Edcon, TFG, Truworths) repayment history through the major bureaus (TransUnion, Experian, XDS, Compuscan), and behavioural biometrics during application. Model stacks are typically XGBoost or LightGBM for the headline score plus deep tabular networks (TabNet, FT-Transformer) where feature volume justifies them. The compliance constraints are the National Credit Act on affordability assessment and adverse action notification, FAIS Act on automated financial advice (where the score drives an offer), and POPIA on consent and special-personal-information handling. We deliver SHAP-based per-decision explainers and FSCA-aligned conduct documentation as standard.

South African deep-level mining is the world's most demanding applied-ML environment because Mponeng, South Deep, and Driefontein-pattern operations work 3-4 kilometres below surface where ore-grade variability, seismic risk, and ventilation cost dominate economics. The applied ML problems are ore-grade prediction from geological survey and blast-hole assay data (typically gradient-boosted regression or geostatistical kriging hybrids), geometallurgical recovery modelling, predictive maintenance on hoists, shaft conveyances, and underground equipment (Komatsu, Caterpillar, Sandvik fleets), rockfall and seismicity analytics from in-mine seismic networks (the Mine Health and Safety Council and CSIR mining cluster have funded foundational research here), and tailings-dam stability monitoring post-Brumadinho. Anglo American's FutureSmart Mining, Sibanye-Stillwater's safety-focused analytics, and Anglo American Platinum's smelter optimisation are each public-facing reference points. We build the engineering layer that integrates with the client's existing SAP, MineRP, Cyest, and Maptek stacks.

Three reasons rooted in delivery economics. First, Johannesburg's regulatory regime is distinct — POPIA (and its 2021 effective date), SARB Joint Standard 1, FSCA conduct standards under FAIS, JSE Listings Requirements paragraph 3.4 on material AI disclosure, B-BBEE scorecards, and the Cybercrimes Act 2020 form a stack that Cape Town AI shops handle but London or Bangalore agencies routinely miss, and POPIA cross-border transfer obligations make a London-led engagement structurally more expensive once compliant. Second, our Edmonton and Chandigarh engineers cover SAST (UTC+2) night cycles for follow-the-sun build, which compresses build time 30-40 percent versus single-region teams, and the cost structure keeps fixed fees 30-50 percent below comparable Cape Town or London agencies for the same model-risk rigour. Third, our Dubai office runs synchronous Johannesburg daytime client meetings with senior account leads, so Information Regulator, SARB Prudential Authority, and FSCA coordination happens in-meeting rather than over async email. B-BBEE scorecard structuring is delivered transparently up front.