AI governance in South Africa: what applies in 2026

There is no AI Act, and the draft policy was withdrawn

The Department of Communications and Digital Technologies published a Draft National AI Policy for comment on 10 April 2026. On 26 April the Minister withdrew it, after checks confirmed its reference list contained fictitious sources, most plausibly AI-generated citations included without verification. There is therefore no national AI policy or AI-specific statute in force. That does not leave AI unregulated: existing law already reaches most of what AI systems do to people.

POPIA: the law that already applies

The Protection of Personal Information Act governs any processing of personal information, which covers most AI systems that touch customers or staff. Its conditions on lawful processing, security safeguards (section 19) and data subject rights all apply. Section 71 goes further for automated decisions: a decision with legal or substantial effect may not be based solely on automated profiling unless a contract or a law or code of conduct applies and safeguards are in place.

King V: what boards are expected to oversee

King V, published on 31 October 2025, applies to financial years beginning on or after 1 January 2026. Its principle on data, information and technology expects the governing body to oversee AI against values including accountability, transparency and explainability, to ensure clear accountability for AI outputs and outcomes, and to scale human oversight and override to the risk. It comes with a disclosure template. King V is voluntary, but JSE listing requirements and investor expectations make it the reference for listed and many large private companies.

Sector rules

• Financial services: the FSCA and the Prudential Authority expect firms to manage model, conduct and cyber risk, including through their 2024 joint standard on cybersecurity and cyber resilience. Credit and insurance decisions are where section 71 bites hardest.
• Health: clinical decision support sits under health professions rules and, where it is a medical device, device regulation.
• Employment: AI used in hiring, performance or dismissal is exposed to employment equity and labour law as well as POPIA.

The EU AI Act, for anyone whose AI reaches Europe

The EU AI Act applies to providers and deployers anywhere in the world when an AI system's output is used in the EU. Prohibited practices have applied since February 2025 and rules for general-purpose models since August 2025. Obligations for high-risk systems such as credit scoring and recruitment now apply from 2 December 2027, after the Digital Omnibus moved them.

What a South African organisation should do now

1. 1List your AIEvery system that makes or shapes a decision about a person, including tools bought in and AI inside software you already use.
2. 2Name who answers for eachA person, not a department, with the authority to override it.
3. 3Check the section 71 safeguardsDisclosure before the decision, a real reason, a route to contest it, and someone who answers.
4. 4Keep evidence as you goBoards under King V, insurers and the Information Regulator will ask for evidence, not intentions.