On 10 April 2026, the Draft South Africa National Artificial Intelligence (AI) Policy (“the AI Policy”) was published by the Department of Communications and Digital Technologies in the Government Gazette. This builds upon the South African National Artificial Intelligence Policy Framework of August 2024.
The AI Policy signals the Government’s clear intention to regulate the fast growing and everchanging field of AI, wherein they seek to balance innovation with ethical oversight, economic inclusion and risk mitigation. The AI Policy is still in draft form, but it provides an indication of the direction that the regulatory landscape is moving.
Firstly, it proposes the classification of AI systems according to risk levels. The AI Policy does not detail the system for classification, but it does indicate that high-risk applications, such as those effecting financial services or healthcare, may be subject to stricter oversight. Companies deploying AI in these sectors should anticipate a shift towards more formalised risk management frameworks.
Secondly, it indicates a shift towards stronger data governance in the context of AI, focusing on data protection and privacy. The AI policy envisions this being anchored in existing frameworks, such as the Protection of Personal Information Act (POPIA). Companies should take steps to ensure that they have robust data management practices, to ensure that they are in a position to comply with future data protection standards.
Thirdly, it outlines the intended roles of regulatory bodies. The AI Policy may introduce a coordinated institutional framework, likely involving existing regulators alongside new or specialised oversight entities. The expected result of such would be increased regulatory scrutiny, particularly in sectors already subject to supervision. Businesses employing AI systems in regulated fields should anticipate and prepare for increased regulatory oversight and should monitor whether their sector-specific regulator issues additional AI-related guidance.
Lastly, it emphasises accountability. This suggests that a regime will be developed whereby businesses will be expected to take responsibility for the outcomes of their AI systems. This
could influence contractual arrangements, insurance considerations, and internal governance structures.
The direction of travel is clear, the ‘Wild-West’ is nearing an end with full implementation of the AI Policy expected in 2027/2028. Accordingly, South African businesses should start preparing for a more regulated and structured AI compliance environment. Companies should take steps to understand how AI systems are being used, what company data is connected thereto and standardise procedures company-wide.
Should you have any queries or concerns regarding the use of AI systems within your company, please feel free to contact C&A Friedlander Attorneys Inc.
MICHAEL VOSLOO
Associate
073 073 4113 | michaelv@caf.co.za