AI Watch: Global Regulatory Tracker – South Africa

Laws/regulations directly regulating artificial intelligence (hereinafter “Artificial Intelligence Regulations”)

In South Africa, AI remains largely unregulated.

Existing laws govern certain activities conducted by organisations using AI, including the Protection of Personal Information Act (POPIA), the Copyright Act, the Patent Act and the Competition Act.

South Africa has not yet adopted any formal policy documents or tabled bills in Parliament to regulate AI. However, the following developments are important in considering any anticipated future regulation:

In April 2019, the President appointed the members of the Presidential Commission on the Fourth Industrial Revolution (hereinafter referred to as the “4IR Commission”). The mandate of the 4IR Commission is to identify appropriate policies, strategies and action plans that will make South Africa a competitive global player
In May 2019, 42 OECD and partner countries, including South Africa, formally adopted the first set of non-binding intergovernmental AI policy guidelines (OECD Council Recommendation on Artificial Intelligence OECD/LEGAL/0449 (2019)),¹ agreeing to adhere to international standards that aim to ensure that AI systems are designed to be robust, safe, fair and trustworthy
In November 2022, the Department of Communications and Digital Technologies launched the South African Artificial Intelligence Institute and AI centres (University of Johannesburg and University of Technology Tshwane)
In April 2024, the Minister of the Department of Communications and Digital Technologies convened the AI Summit to share the content of the draft discussion paper on the National AI Plan,² intended to be a pre-policy process for obtaining and collating input data to be fed into the draft plan

Status of AI regulations

There are currently no specific laws or regulations in South Africa that directly and explicitly address AI.

Other laws relating to artificial intelligence

There are various laws that are not intended to directly regulate AI but may have an impact on the development or use of AI in South Africa. A non-exhaustive list of key examples includes:

The Personal Data Protection Act, which covers all automatic processing of personal data
The Copyright Act and the Patents Act, which apply to works generated by artificial intelligence, one of which has been covered by a patent in South Africa
The Competition Act, which does not directly regulate technology but does apply to digital mergers and digital platforms
In 2024, a draft law on cybersecurity was published, which includes artificial intelligence in the definition of regulated ICT system and ICT infrastructure and includes provisions that may require certification of AI products in accordance with minimum standards

Definition of “AI”

As noted above, there are currently no specific laws or policies in South Africa that directly regulate AI. As such, there is no single legally recognised definition of “AI” in South Africa. The draft National AI Plan discussion paper refers to the European Commission’s definition.³

Territorial scope

As mentioned above, there are currently no specific laws or regulations in South Africa that directly regulate AI, so there is no specific territorial scope. Where the laws mentioned above regulate matters, they do so only in South Africa.

Sector scope

As mentioned above, there are currently no specific laws or regulations in South Africa that directly regulate AI. As such, there is no specific sectoral scope at this stage.

Compliance Roles

As mentioned above, there are currently no specific laws or regulations in South Africa that directly regulate AI. As such, there are currently no specific or unique obligations imposed on developers, users, operators and/or implementers of AI systems, except in so far as they may relate to the processing of personal data by automated means, as set out in the Personal Data Protection Act. One key aspect of this is Section 71(1) of POPIA,⁴ which regulates automated decision-making. This section protects data subjects from being subjected to decisions based solely on automated decision-making, which results in legal consequences for the data subject and the data subject being profiled.

Key Issues to be Addressed by AI Regulations

As mentioned above, there are currently no specific laws or regulations in South Africa that directly regulate AI.

The South Africa AI Planning Discussion Paper identifies the following regulatory areas for consideration in due course:⁵

Disinformation and fake news generated by generative AI-based applications and software
Prejudices and discrimination that may be exhibited by AI creators and users
Copyright Abuse in Accordance with the World Intellectual Property Organization (WIPO)
Privacy to protect personal, private and public data

Risk categorization

As mentioned above, there are currently no specific laws or regulations in South Africa that directly regulate AI or classify threats.

The South African AI Planning Paper does not take a risk-based approach but focuses on considering the optimal form of regulation in relation to:⁶

Anti-competitive conduct if the supply of key AI models or other enabling factors is concentrated in the hands of a small number of players
Risks associated with robotic or autonomous devices that use AI to make decisions about actions, such as AI-enabled self-driving cars
Aggressive job losses leading to social threats
Criminal behavior or other highly dangerous consequences
Existential risk if artificial intelligence were to “get out of control” and start pursuing goals that are harmful to humanity
The risk that AI designed for military purposes will “escape” into the wider world and lead to increased criminal behavior or other highly dangerous outcomes

Key Compliance Requirements

As noted above, there are currently no specific laws or regulations in force in South Africa that directly regulate AI, with the exception of automated decision-making within the meaning of section 71(1) of POPIA, as set out above.

Regulators

Currently, South Africa does not have a regulatory body specialising in AI. However, the Department of Communications and Digital Technologies has taken the initiative by launching an AI Planning Discussion Paper, which will work with the AI Expert Advisory Board to define an AI strategy to be included in the national AI policy.

Executive powers and penalties

As noted above, there are currently no specific laws or regulations in South Africa that directly regulate AI. As such, enforcement and penalties related to the creation, distribution and/or use of AI are governed by: (i) POPIA; and (ii) related breaches in non-AI laws.

_{1 The OECD Council Recommendation on Artificial Intelligence is available}_Here
_{2 The South Africa AI Planning Discussion Paper is available}_Here
_{3 The South Africa AI Planning Discussion Paper is available}_Here_{page 7}
_{4 The Personal Data Protection Act 4 of 2013 is available}_Here_{section 71}
_{5 The South Africa AI Planning Discussion Paper is available}_Here_{page 47}
_{6 The South African AI Planning Discussion Paper is available}_Here_{page 44}

Jeffrey Shin (trainee solicitor at White & Case, London) assisted in the preparation of this publication.

_{White & Case means the international law firm which includes White & Case LLP, a New York limited liability partnership, White & Case LLP, a English limited liability partnership, and any other related companies, firms and entities.}

_{This article has been prepared for the purpose of general information for interested persons. It is not, and does not attempt to be, exhaustive in nature. Due to the general nature of its content, it should not be considered legal advice.}