AI laws and regulation in South Africa

Low to Medium.

At present, there is no standalone statutory framework regulating artificial intelligence in South Africa.

Currently, there is no codified Artificial Intelligence (AI) specific legislation in South Africa. However, the processing, monitoring, storage and other uses of data and data governance are generally regulated by existing legislation such as:

• the Protection of Personal Information Act 4 of 2013 (POPI) -  which applies to the data privacy and protection principles applicable to AI technologies that process personal information. It requires the processing of personal information to be in line with the provisions of the act such as observing a data subject's rights in relation to the processing of their personal information;
• the Consumer Protection Act 68 of 2008 (the CPA) -  the CPA in respect of the processing of personal information, is used in conjunction with POPI. It regulates how consumer personal data is to be handled by product suppliers and service providers (i.e., when coming to the use of AI systems) and ensures consumer privacy and protection is observed in respect of such AI systems;
• the Electronic Communications Act 36 of 2005 (ECA) and the Electronic Communications and Transactions Act 25 of 2002 (ECTA) -  although these statutes do not have specific provisions directly regulating AI, ECTA, for example, does recognise contracts that are concluded through the use of electronic agents such as AI integrated technologies.

In addition to the above, the Copyright Act 98 of 1978 and Patents Act 57 of 1978, indirectly regulates work generated by AI in South Africa.

The Cybercrimes Act 19 of 2020 which was intended to create offenses which have a bearing on cybercrime, sets out procedures and compliance requirements relating to the access, and seizure of digital assets like computers, databases, or networks. This broadly and indirectly affects the use of AI in South African telecommunications networks.

At this juncture, the Department of Communications and Digital Technologies (DCDT) is the responsible for overseeing, among other things, AI use in South Africa.  The DCDT, in November 2022, launched the AI Institute of South Africa (AIISA). The purpose of AIISA is to aid the South African government in addressing and prospecting the legislative and regulatory aspects of AI in South Africa. AIISA will further consider and provide recommendations with regards to institutional frameworks and the roles of various sectors of society in addition to considering and developing policies and legislation to empower the relevant stakeholders with the responsible use of AI.

The DCDT released the National AI Plan in April 2024, which broadly outlines a roadmap for harnessing the transformative power of AI to propel socio-economic development, foster innovation, and navigate the challenges and opportunities of digital transformation, and the National Artificial Intelligence Framework Policy (NAIFP) which sets out the roadmap to develop comprehensive AI legislation in South Africa. The NAIFP,  serves as the foundational basis for creating AI regulations and legislation in South Africa, and aims to address ethical concerns, privacy, safety, transparency and fairness, while aligning with global AI governance standards. The NAIFP will use twelve strategic pillars to support and drive the implementation of its goals and objectives.

The NAIFP will be the foundation for developing and implementing AI legislation and the associated regulations.

South Africa, as a member state of the African Union (AU), along with other member states have presented the Smart Africa Alliance Artificial Intelligence Blueprint (AU Blueprint). The AU Blueprint outlines the need for ethical considerations and policies for responsible AI adoption, and the introduction of regional Centres of Excellence for AI within the continent, specialising in different fields of AI, to optimise the economic development of individual member states.

The NAIFP aligns with additional global standards such as the OECD Guidelines and does not conflict with the existing overarching data governance laws currently in place.

Not at present.

N/A.