AI regulation South Africa: where the law stands in 2026

AI regulation in South Africa is simpler than the headlines suggest. There is no AI Act, and the national AI policy is back on the drawing board after a false start in April 2026. What does apply is law you already live with, above all POPIA, plus guidance from a few sector regulators. If your AI output reaches Europe, the EU AI Act may apply too. This is where things stand on 28 September 2026, and what a business should do now.

AI regulation in South Africa at a glance

What happened to the national AI policy

The Department of Communications and Digital Technologies (DCDT) released a National AI Policy Framework in August 2024. Cabinet approved a draft policy built on it on 25 March 2026, and the minister published it in the Government Gazette on 10 April 2026, with comments due by 10 June. The draft described itself as a work in progress: a set of core principles to guide each sector, rather than a rulebook.

It did not last. On 26 April 2026, Minister Solly Malatsi withdrew the draft after News24 revealed that its reference list contained fictitious sources. Malatsi said AI-generated citations had most likely been included without proper checks, and reports counted at least six fabricated references among 67.

The rescue plan so far:

• May 2026: Malatsi appointed an independent panel chaired by Professor Benjamin Rosman, a Wits AI researcher, to help rebuild the policy.
• Late May 2026: officials told Parliament they aim to take a revised policy to Cabinet by November 2026 and publish it for comment in January 2027.
• June 2026: Cabinet approved the withdrawal, and ITWeb reported that the formal withdrawal notice was gazetted on 12 June.

A policy is not a law. Even once the revised policy is adopted, any binding AI rules would still need legislation or regulations, which take longer again.

POPIA already covers most business AI use

POPIA does not mention AI, but it does not need to. It applies whenever you process personal information, whether with a spreadsheet, a CRM or an AI model. The duties that matter most for AI:

• Accountability stays with you. Your business is the responsible party even when an AI vendor does the processing. Section 21 requires a written contract that makes any vendor processing personal information for you maintain proper security measures.
• Security. Section 19 requires appropriate, reasonable technical and organisational measures, and regular checks that they work.
• Cross-border transfers. Many AI tools process data outside South Africa. Section 72 allows that only in set cases, for example where the recipient is bound by adequate data protection rules or the person consents.
• Direct marketing. If AI writes marketing that goes out by WhatsApp, SMS or email, section 69 still requires consent or an existing customer relationship, plus an easy way to opt out.

The Information Regulator can impose administrative fines of up to R10 million under section 109. Our guides to AI and POPIA and POPIA-compliant AI tools go into the practical detail.

POPIA section 71: decisions made by AI

Section 71 is the part of POPIA written for automated decisions. In plain words, a person may not be subjected to a decision that has legal consequences for them, or affects them substantially, if it is based solely on automated processing of personal information that profiles them. The Act’s examples include work performance, creditworthiness, reliability, location, health, personal preferences and conduct.

There are two exceptions. The first covers decisions linked to concluding or carrying out a contract, where the person’s request has been met or appropriate measures protect their interests. The second covers decisions governed by a law or code of conduct that sets out such measures. Those measures must give the person a chance to make representations, and enough information about the logic behind the decision to do so.

In practice this touches AI credit scoring, automated CV screening, insurance pricing and fraud systems that block accounts. The safest design is a person who genuinely reviews the outcome and can change it, a plain explanation of how the system decides, and a way for people to respond.

What the Information Regulator has said about AI

As at 28 September 2026, the Information Regulator’s published guidance notes cover topics such as direct marketing, children’s information, special personal information and elections. None deals with AI or automated decisions, and we found no AI-specific enforcement action.

The Regulator is watching, though. In comments reported by ITWeb on 17 September 2026, its executives warned that AI models can keep personal information beyond the purpose it was collected for, which POPIA does not allow, and pointed to the absence of a national AI policy.

Sector rules: finance and health

Financial services. On 24 November 2025, the FSCA and the Prudential Authority published their first joint report on AI in the South African financial sector, based on an industry survey. It creates no new binding rules. It signals a principles-based approach aligned with existing conduct and prudential rules, flags risks such as bias and opaque decisions in credit and insurance, and says the regulators will coordinate with the Information Regulator.

Health. The HPCSA’s Booklet 20, Ethical guidelines on the use of artificial intelligence, dated September 2025, applies to every practitioner registered with it. Practitioners stay accountable for clinical decisions, AI may not be the final decision-maker on diagnosis or treatment, patients must be told when an AI tool is used and what its limits are, and AI built into medical devices must meet SAHPRA’s requirements.

We could not verify AI-specific rules from other South African regulators as at September 2026.

The EU AI Act and South African exporters

The EU AI Act entered into force on 1 August 2024 and applies in stages. Bans on prohibited practices and AI literacy duties started on 2 February 2025, and rules for general-purpose AI models on 2 August 2025. Transparency rules followed in August 2026. The EU’s Digital Omnibus, in force from 27 July 2026, moved the high-risk rules to 2 December 2027 for areas such as hiring and education, and to 2 August 2028 for AI built into regulated products.

Its reach matters for exporters. Article 2 applies the Act to providers that place AI on the EU market wherever they are based, and to providers and deployers outside the EU when their AI system’s output is used in the EU. A South African firm selling AI software to European clients, or running an AI system whose results European customers rely on, should map its obligations. Fines for prohibited practices can reach €35 million or 7% of worldwide annual turnover.

A practical AI compliance checklist for South African businesses

1. List every AI use, including staff using public chatbots on their own accounts.
2. Mark the uses that touch personal information, and keep that information out of consumer AI tools. Anonymise it where you can.
3. Sign operator agreements with AI vendors that process personal information for you, and find out where they process it.
4. Keep a person in charge of any decision that affects someone’s credit, job, cover or account, and be able to explain how it was reached.
5. Check marketing consent before AI-written messages go out.
6. Tell people when they are dealing with AI, especially customers chatting to an assistant.
7. Check your sector’s guidance, such as the FSCA and Prudential Authority report or HPCSA Booklet 20.
8. Map EU AI Act duties if you sell AI products or services into Europe.
9. Keep records of what each AI system does, what data it touches and who is responsible.
10. Watch for the revised national policy, due for comment in January 2027, and comment on it.

This is general information, not legal advice. For a decision with real consequences, speak to a data protection lawyer. If you want help working out where AI fits safely in your business, that is what Zaiq’s AI consulting covers.