Laws/Regulations directly regulating AI (the “AI Regulations”)

AI remains largely unregulated in South Africa.

Existing legislation regulates some activities conducted by organizations using AI, including the Protection of Personal Information Act (POPIA), the Copyright Act, the Patents Act, and the Competition Act.

South Africa has not yet formalized any policy documents or entered bills to parliament for the regulation of AI, however the following developments are relevant in considering any anticipated, future regulation:

• in April 2019, the President appointed members to the Presidential Commission on the Fourth Industrial Revolution (the "4IR Commission"). The task of the 4IR Commission is to identify relevant policies, strategies and action plans that will position South Africa as a competitive global player
• In May 2019, 42 OECD and partner countries, including South Africa, formally adopted the first set of nonbinding intergovernmental policy guidelines on artificial intelligence (OECD Council Recommendation of the Council on Artificial Intelligence OECD/LEGAL/0449 (2019)),¹ agreeing to uphold international standards that aim to ensure AI systems are designed to be robust, safe, fair, and trustworthy
• In November 2022, The Department of Communications and Digital Technologies launched the Artificial Intelligence Institute of South Africa and AI hubs (University of Johannesburg and Tshwane University of Technology)
• In April 2024, the Minister of the Department of Communications and Digital Technologies convened an AI Summit to share the contents of a draft National AI Plan discussion document,² intended to be a pre-policy process to obtain and collate inputs to be incorporated into a draft plan

Status of the AI Regulations

There are currently no specific laws or regulations in South Africa that directly, expressly regulate AI.

Other laws affecting AI

There are various laws that do not directly seek to regulate AI but may affect the development or use of AI in South Africa. A non-exhaustive list of key examples includes:

• Protection of Personal Information Act, which extends to any automatic processing of personal data
• Copyright Act and Patents Act, which apply to AI generated works, one of which has been granted a patent in South Africa
• Competition Act, which does not directly regulate the technology, but applies to digital mergers and digital platforms
• A Draft Cyber Security Bill was published in 2024 which includes AI in the definition of a regulated ICT System and ICT Infrastructure and includes provisions which may require AI products to be certified against minimum standards

Definition of “AI”

As noted above, there are currently no specific laws or policies in South Africa that directly regulate AI. As such, there is no single legally recognized definition of "AI" in South Africa. The draft National AI Plan discussion document references the European Commission definition.³

Territorial scope

As noted above, there are currently no specific laws or regulations in South Africa that directly regulate AI, so there is no specific territorial scope. Where the laws referred to above regulate matters, they do so in South Africa only.

Sectoral scope

As noted above, there are currently no specific laws or regulations in South Africa that directly regulate AI. Accordingly, there is no specific sectoral scope at this stage.

Compliance roles

As noted above, there are currently no specific laws or regulations in South Africa that directly regulate AI. Accordingly, there are currently no specific or unique obligations imposed on developers, users, operators and/or deployers of AI systems, save insofar as they might relate to the processing of personal information on an automated basis as provided for in the Protection of Personal Information Act. One key aspect is section 71(1) of POPIA,⁴ which governs automated decision-making. This section protects data subjects from being subjected to decisions based solely on automated decision-making, which results in legal consequences for the data subject and the data subject being profiled.

Core issues that the AI Regulations seek to address

As noted above, there are currently no specific laws or regulations in South Africa that directly regulate AI.

South Africa's AI Planning Discussion Document notes the following regulatory areas for consideration in due course:⁵

• Disinformation and fake news generated through Generative AI applications and software
• Bias and discrimination that could be exhibited by AI developers and users
• Copyright abuse in alignment with World Intellectual Property Organization (WIPO)
• Privacy to protect personal, private, and public data

Risk categorization

As noted above, there are currently no specific laws or regulations in South Africa that directly regulate AI or categorize risks.

South Africa's AI Planning Discussion Document does not delineate a risk-based approach but focuses on considering the optimal form of regulation in respect of:⁶

• Anti-competitive behavior should the provision of key AI models, or other enablers, be concentrated in a small number of players
• Risks in robotic or autonomous devices that use AI to decide on actions, such as AI-enabled autonomous cars
• Aggressive loss of employment leading to social risks
• Criminal behavior or other highly dangerous outcomes
• Existential risks should AI "get out of control" and pursue goals detrimental to humanity
• Risks that AI designed for military purposes "escapes" into the wider world and leads to enhanced criminal behavior or other highly dangerous outcomes

Key compliance requirements

As noted above, there are currently no specific laws or regulations in South Africa that directly regulate AI, save in respect of automated decision-making in terms of section 71(1) of POPIA, as set out above.

Regulators

Currently, there is no AI-specific regulator in South Africa. However, the Department of Communications and Digital Technologies has taken the initiative with the launch of the AI Planning Discussion Document, in which it will work with an AI Expert Advisory Council to define the AI strategy to be embodied in the national AI policy.

Enforcement powers and penalties

As noted above, there are currently no specific laws or regulations in South Africa that directly regulate AI. As such, enforcement and penalties relating to creation, dissemination and/or use of AI are governed by: (i) POPIA; and (ii) related violations in non-AI specific regulation.

1 The OECD Council Recommendation of the Council on Artificial Intelligence is available here
2 South Africa’s Artificial Intelligence Planning Discussion Document is available here
3 South Africa’s AI Planning Discussion Document is available here, page 7
4 The Protection of Personal Information Act 4 of 2013 is available here, section 71
5 South Africa’s AI Planning Discussion Document is available here, page 47
6 South Africa’s AI Planning Discussion Document is available here, page 44

Jeffrey Shin (Trainee Solicitor, White & Case, London) contributed to this publication.