AI in South African Law: A Practical Guide for Businesses

Artificial intelligence is reshaping how South African businesses operate — from drafting contracts and analysing data to automating customer interactions and generating marketing content. But as AI adoption accelerates, a critical question emerges: what does the law say, and how do you protect yourself?

South Africa currently has no dedicated AI legislation. That does not mean AI is a legal free-for-all. Existing laws — the Copyright Act, POPIA, the Consumer Protection Act, and common-law principles of liability — already apply to AI-related activities. Businesses that assume “the law hasn’t caught up yet” and act accordingly are taking a significant legal risk.

Who Owns AI-Generated Content?

This is one of the most urgent questions facing South African businesses today. When you use an AI tool to write a report, create marketing copy, or generate images, who owns the result?

Under the Copyright Act 98 of 1978, copyright vests in the author of a work — defined as the person who first creates it. South African law does not recognise AI as a legal person. An autonomous AI system cannot be an author. This means AI-generated works may fall into a legal grey zone where copyright protection is uncertain or absent entirely.

The practical consequence: if your business relies heavily on AI-generated content and your competitors copy it, you may have no copyright claim to enforce.

There is an additional risk on the other side. AI models are trained on vast datasets that often include copyrighted material. If an AI tool generates content that closely resembles a protected work, your business could face an infringement claim even if you had no knowledge of the similarity. Ignorance is not a defence.

What to do: Review your AI-generated outputs for originality. Ensure your contracts with AI vendors address IP ownership explicitly. Where possible, have human authors meaningfully contribute to AI-assisted work to establish a basis for copyright protection.

AI and Your Contracts: Gaps That Could Cost You

Most standard commercial contracts were drafted before AI became a practical business tool. They are silent on critical questions:

• Can a party use AI to perform obligations under the contract?
• Who is liable if an AI tool produces an error that causes loss?
• Does AI-generated work satisfy a contractual requirement for “original” or “bespoke” deliverables?
• What happens to confidential information submitted to an AI platform?

These gaps are not theoretical. South African courts will interpret contracts according to their plain meaning. If your contract does not address AI use, a dispute about it will be expensive and unpredictable.

What to do: Review key commercial contracts and add AI-specific clauses — covering permitted use, liability allocation, confidentiality obligations for AI platforms, and ownership of AI outputs. New contracts should be drafted with these issues in mind from the outset.

POPIA and AI: A Compliance Minefield

The Protection of Personal Information Act 4 of 2013 (POPIA) applies fully to AI systems that process personal information. When you feed customer data, employee records, or client information into an AI tool, you are processing personal information — and POPIA’s requirements apply.

Key obligations include:

• Lawful purpose: You must have a lawful basis for processing personal information through an AI system.
• Operator agreements: If you use a third-party AI platform that processes personal information on your behalf, you need a written operator agreement compliant with POPIA section 20.
• Data minimisation: Only process the personal information actually necessary for your purpose — do not submit entire databases to an AI tool for convenience.
• Transborder flows: Many AI platforms are hosted outside South Africa. Cross-border transfers of personal information are regulated under POPIA section 72 and require appropriate safeguards.

The Information Regulator has enforcement powers and can impose significant penalties for POPIA non-compliance. This is not a risk to defer.

What to do: Before using any AI tool that processes personal information, conduct a basic data protection impact assessment. Check where the platform stores and processes data. Ensure you have a compliant operator agreement in place.

Liability When AI Gets It Wrong

AI systems make mistakes. When an AI-driven decision causes harm — a flawed credit assessment, an incorrect medical recommendation, a defective product designed by AI — who is liable?

South African law currently has no specific AI liability framework. Courts will apply existing principles: delict (negligence and wrongfulness), contract, and the Consumer Protection Act. The likely result is that liability falls on the business that deployed the AI, not the AI itself or its developer (unless a product defect claim lies against the developer).

South Africa’s Draft National AI Policy, published for comment in April 2026, proposes a risk-based regulatory framework and an AI Insurance Superfund modelled on the Road Accident Fund to address cases where accountability cannot be clearly assigned. However, this policy has not yet been enacted, and businesses cannot rely on it to shield them from liability today.

What to do: Treat AI tools as you would any other business system. Implement human oversight for high-stakes decisions. Document your AI governance processes. Review your professional indemnity and liability insurance to check whether AI-related claims are covered.

What Is Coming: South Africa’s AI Regulatory Framework

South Africa is moving — methodically — toward dedicated AI regulation. The Draft National AI Policy, released for a 60-day public comment period closing in June 2026, signals the direction:

• A risk-based approach — higher-risk AI applications will face stricter requirements
• An AI Regulatory Authority and AI Ombudsperson to handle complaints and oversight
• Algorithmic audits for high-risk use cases
• An AI Insurance Superfund for cases of unattributable harm

Businesses that begin building sound AI governance practices now will be better placed when regulation arrives — and will avoid the scramble that typically follows new legislation.

Five Practical Steps for South African Businesses

1. Audit your AI use. Map every AI tool your business uses and what data flows through it.
2. Review your contracts. Identify gaps in existing agreements and update key contracts to address AI use, liability, and IP ownership.
3. Check your POPIA compliance. Ensure operator agreements are in place for any AI platform processing personal information.
4. Implement human oversight. Do not allow AI to make final decisions on high-stakes matters without human review.
5. Get legal advice before problems arise. The cost of proactive legal review is a fraction of the cost of litigation or regulatory enforcement.

How HvS Attorneys Can Help

Our Digital Technology Law practice assists businesses in navigating the legal challenges of AI adoption — from drafting and reviewing AI-related contracts and POPIA compliance frameworks, to advising on IP ownership and liability risk. If your business is using AI tools and you are unsure of your legal position, contact us for a consultation.