Skip to main content

    AI by country · Africa

    AI in South Africa: the rules, the readiness and where to start

    Last checked: 26 October 2026

    What should a company in South Africa know before starting with AI?

    South Africa has no dedicated AI law. The Protection of Personal Information Act (POPIA) is the rule that matters most today, including its section 71 on decisions made only by automated processing. The national AI policy is not in place yet: a draft was withdrawn in April 2026 and a revised version is still being prepared as of 26 October 2026.

    At a glance

    South Africa at a glance

    Key facts about South Africa
    Data protection lawProtection of Personal Information Act 4 of 2013 (POPIA), main provisions in force since 1 July 2020
    RegulatorInformation Regulator
    AI policyNo dedicated AI law as of 26 October 2026. A draft National AI Policy (April 2026) was withdrawn; a revised draft is expected for public comment in January 2027, per the department
    Time zoneUTC+2 (SAST), 3.5 hours behind India
    CurrencyZAR (rand)
    Business languageEnglish (widely used in business); many other official languages

    Why now

    Why South Africa is worth watching

    Each point links to the document it comes from.

    • A joint survey by the financial regulators (FSCA and Prudential Authority) drew about 2,100 responses, and 220 of them (10.6%) said they use AI; among banks about 52% do, and among payment providers 50%.[5]

    • South Africa's business services sector (call centres and back-office work for other countries) reports 26,346 new jobs serving international markets in 2025, its highest annual total since 2018, according to the industry body BPESA.[6]

    • The government tried to publish a national AI policy in April 2026, withdrew it on 26 April 2026 after fictitious references were found, and says a revised policy should go to Cabinet by November 2026 with public comment from January 2027.[4]

    • The Information Regulator is actively issuing enforcement notices. On 2 June 2026 it found a public college had failed, among other things, to report a security compromise as section 22 of POPIA requires.[3]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Protection of Personal Information Act 4 of 2013 (POPIA)

    In force2013Section 71 says a person may not be subject to a decision with legal or substantial effects that is based solely on automated processing meant to profile them (for example work performance, credit worthiness or conduct). There are exceptions, such as decisions taken in connection with a contract where the person can make representations and is told the logic behind the processing. Section 22 requires you to tell the Regulator and the affected people about a security compromise as soon as reasonably possible. Section 72 limits sending personal information to a third party in another country unless one of the listed conditions is met, such as adequate legal protection in that country, binding agreement, or consent. The Regulator can set administrative fines of up to R10 million, and some offences carry prison terms of up to 10 years.[1]

    Draft National Artificial Intelligence Policy

    Withdrawn draft; revised draft not yet published2026A policy is not a law, so it adds no legal duties today. The April 2026 draft proposed sector-specific work rather than one new AI law, and it was withdrawn on 26 April 2026. The department has said a revised policy should go to Cabinet by November 2026 and open for public comment in January 2027. We did not find any official notice later than that, so treat the timing as a plan, not a promise.[2]

    FSCA and Prudential Authority report on AI in the financial sector

    Research report, not a rule2025Published on 24 November 2025, the report surveys how financial firms use AI. It says the two regulators will write a discussion paper and talk to stakeholders next. It does not create new binding duties, so financial firms still apply existing financial-sector rules and POPIA.[5]

    Where AI fits first

    Where AI fits first

    Banking and finance

    Customer service chatbots, document handling in the back office, fraud checks and anti-money-laundering reviews.

    Credit scoring and similar profiling falls under section 71 of POPIA if the decision is fully automated. The financial regulators' report names data privacy, bias and explainability as concerns and says a discussion paper is coming.[5]

    Business process services and contact centres

    Call summaries, quality checks and drafting replies, with a human agent still in charge, for customers served from South Africa.

    The sector skills strategy (December 2025) says workers need to be prepared for AI-augmented roles. If you handle personal information of people in other countries, their local law may apply too.[6]

    Mining

    Searching and sorting compliance reports, permits and safety records.

    In June 2026 the Information Regulator ordered a mining company to release records it had refused under the access-to-information law (PAIA), so records handling is under real scrutiny. This is an example of the Regulator's reach, not an AI rule.[3]

    Your first steps

    Your first steps

    1. Find out who your Information Officer is and check they are registered with the Information Regulator, as POPIA requires before they take up their duties.
    2. List every AI use that touches personal information, and note where a decision about a person is made without a human involved. Section 71 may apply to those.
    3. For any fully automated decision with real effect on a person, build a way for them to make representations and explain in plain words how the decision is reached.
    4. Check where your AI vendor stores and processes data. If it leaves South Africa, confirm which section 72 condition you rely on.
    5. Write a short breach plan so that you can tell the Regulator and affected people quickly, as section 22 requires.
    6. Start with one low-risk process, such as internal document search, and measure it before using AI on customer decisions.
    7. Watch for the revised national AI policy. Do not plan around the withdrawn April 2026 draft.

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. South Africa (UTC+2) is 3.5 hours behind India (UTC+5:30). With Indian hours of 09:30 to 18:30 and South African hours of 08:00 to 17:00, the overlap is 08:00 to 15:00 South African time, which is 7 hours.

    Questions

    Common questions about AI in South Africa

    Is there an AI law in South Africa?

    No. As of 26 October 2026 there is no dedicated AI law. POPIA and other existing laws apply when AI handles personal information. A national AI policy is still being redrafted.

    Can I use AI to make decisions about customers or staff?

    Section 71 of POPIA restricts decisions with legal or substantial effects that rest only on automated profiling. A contract-related decision can be allowed if the person can make representations and gets enough information about the logic. Keeping a human in the decision is the simplest way to stay clear.

    Can I send customer data to an AI service abroad?

    Section 72 allows transfers to a third party in another country only under listed conditions, such as adequate legal or contractual protection, or the person's consent. Check the vendor's terms and where the data is processed first.

    What happens if I get this wrong?

    The Regulator can issue enforcement notices and administrative fines of up to R10 million. Failing to comply with an enforcement notice is itself an offence. Some offences carry prison terms.

    Do I need to wait for the national AI policy before starting?

    No. The policy would not change your POPIA duties, and it is still being redrafted. Start with small, well-controlled projects and review them when the revised policy is published.

    Free tools

    Try these first

    Three free tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 26 October 2026. Numbers in square brackets above match this list.
    1. [1] Government of South Africa (Government Gazette No. 37067, via gov.za), 2013-11-26. Protection of Personal Information Act 4 of 2013 (full text)(gov.za)
      Full title and what we used it for

      Protection of Personal Information Act 4 of 2013 (full text). Read the text of sections 22, 71, 72, 107 and the R10 million administrative fine limit. Commencement dates (sections 2 to 38 and 55 to 109 from 1 July 2020) came from the gov.za summary page https://www.gov.za/documents/protection-personal-information-act.

    2. [2] Department of Communications and Digital Technologies (Government Gazette No. 54477, via gov.za), 2026-04-10. Draft South Africa National Artificial Intelligence (AI) Policy(gov.za)
      Full title and what we used it for

      Draft South Africa National Artificial Intelligence (AI) Policy. Read the notice: published for comment with a deadline of 10 June 2026 and a sector-specific approach. This is the draft that was later withdrawn.

    3. [3] Information Regulator (South Africa), 2026-06-02. Media statement: Information Regulator issues enforcement notices for c…(inforegulator.org.za)
      Full title and what we used it for

      Media statement: Information Regulator issues enforcement notices for contraventions of POPIA and PAIA. Used for the college and mining company enforcement notices. The Regulator's home page https://www.inforegulator.org.za was also read for its mandate and the information officer registration reminder; it had no AI guidance.

    4. [4] Moonstone Information Refinery (legal news summary), 2026-04-27. Draft AI policy scrapped after fake citation findings(moonstone.co.za)
      Full title and what we used it for

      Draft AI policy scrapped after fake citation findings. Secondary source for the 26 April 2026 withdrawal by Minister Malatsi. The revised timeline (Cabinet by November, public comment from January 2027) comes from iAfrica, 1 June 2026, https://iafrica.com/south-africa-sets-january-2027-public-comment-date-for-revised-national-ai-policy/, quoting a departmental official. I did not find an official government page for either; the Fasken and Bowmans pages were blocked (403) and not used.

    5. [5] Financial Sector Conduct Authority and Prudential Authority (South African Reserve Bank), 2025-11-24. Artificial Intelligence in the South African Financial Sector(resbank.co.za)
      Full title and what we used it for

      Artificial Intelligence in the South African Financial Sector. Opened the report PDF linked from this page. Used for the survey numbers (about 2,100 responses, 220 or 10.6% using AI, banks about 52%, payments 50%) and the planned discussion paper.

    6. [6] Business Process Enabling South Africa (BPESA), 2026-07-17. BPESA news page(bpesa.org.za)
      Full title and what we used it for

      BPESA news page. Used for 26,346 new international jobs in 2025 and the December 2025 skills strategy wording on AI-augmented roles. Industry body figures, not independently audited.

    This is general information, not legal advice. Laws and policies change, and South Africa's national AI policy is being redrafted. Check your plans with a qualified South African lawyer. Facts were checked on 26 October 2026.

    Other country guides

    Starting with AI in South Africa?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score