AI regulation in South Africa
South Africa has no standalone AI law. POPIA Section 71 gives data subjects rights around solely automated decision-making with legal or similarly significant effect — the closest existing binding hook for AI accountability, and the anchor for AIC's own methodology.
POPIA Section 71 (automated decision-making)
Administered by Information Regulator (South Africa).
- A decision producing legal consequences, or affecting someone to a substantial degree, may not be based solely on automated processing — this expressly covers profiling of work performance, creditworthiness, reliability, location, health, personal preferences and conduct.
- The prohibition lifts where the decision is made in connection with a contract and either the data subject's request has been met or appropriate safeguards are in place, or where a law provides safeguards.
- Where an automated decision is permitted, the data subject must be given an opportunity to make representations about it.
- The responsible party must supply sufficient information about the underlying logic of the processing for that response to be meaningful — which is, in practice, an explainability duty.
The Information Regulator. Administrative fines reach R10 million; serious offences carry up to R10 million and/or 10 years' imprisonment. The Regulator has begun issuing administrative fines in practice rather than only enforcement notices.
This page is a general orientation guide built from public sources, not legal advice, and it does not establish that any organisation complies with South Africa's requirements. AIC certifies governance against its own published standard; that is a different question from legal compliance, and neither substitutes for the other. Back to the map.