AI in South African Law: A Practical Guide for Businesses

Artificial intelligence is reshaping how South African businesses operate — from drafting contracts and analysing data to automating customer interactions and generating marketing content. But as AI adoption accelerates, a critical question emerges: what does the law say, and how do you protect yourself?

South Africa currently has no dedicated AI legislation. That does not mean AI is a legal free-for-all. Existing laws — the Copyright Act, POPIA, the Consumer Protection Act, and common-law principles of liability — already apply to AI-related activities. Businesses that assume “the law hasn’t caught up yet” and act accordingly are taking a significant legal risk.

Who Owns AI-Generated Content?

This is one of the most urgent questions facing South African businesses today. When you use an AI tool to write a report, create marketing copy, or generate images, who owns the result?

South African law is more favourable here than many businesses assume, and more favourable than the position in the United States. The Copyright Act 98 of 1978 contains an express provision for computer-generated works. In section 1, the author of a literary, dramatic, musical or artistic work which is computer-generated is defined as “the person by whom the arrangements necessary for the creation of the work were undertaken.”

South Africa is one of a small group of jurisdictions — with the United Kingdom, Ireland, New Zealand, India and Hong Kong — that legislated for this. The practical effect is that AI-generated output is not automatically ownerless. Copyright can vest in the person or business who made the arrangements for its creation, which will usually be the user or the organisation directing the tool.

Two qualifications matter. First, the provision was drafted in an era of computer programs rather than generative AI, and it has not yet been tested in a South African court against a modern AI tool. How much human direction amounts to “the arrangements necessary” is an open question — a detailed, iterated creative process is a stronger case than a single short prompt. Second, the work must still be original and reduced to material form to qualify at all.

The practical takeaway: keep records of the human input behind commercially important AI-assisted work — the prompts, the iterations, the editorial decisions. That evidence is what would support an ownership claim if it were ever challenged.

There is an additional risk on the other side. AI models are trained on vast datasets that often include copyrighted material. If an AI tool generates content that closely resembles a protected work, your business could face an infringement claim even if you had no knowledge of the similarity. Ignorance is not a defence.

What to do: Review your AI-generated outputs for originality. Ensure your contracts with AI vendors address IP ownership explicitly. Where possible, have human authors meaningfully contribute to AI-assisted work to establish a basis for copyright protection.

AI and Your Contracts: Gaps That Could Cost You

Most standard commercial contracts were drafted before AI became a practical business tool. They are silent on critical questions:

• Can a party use AI to perform obligations under the contract?
• Who is liable if an AI tool produces an error that causes loss?
• Does AI-generated work satisfy a contractual requirement for “original” or “bespoke” deliverables?
• What happens to confidential information submitted to an AI platform?

These gaps are not theoretical. South African courts will interpret contracts according to their plain meaning. If your contract does not address AI use, a dispute about it will be expensive and unpredictable.

What to do: Review key commercial contracts and add AI-specific clauses — covering permitted use, liability allocation, confidentiality obligations for AI platforms, and ownership of AI outputs. New contracts should be drafted with these issues in mind from the outset.

POPIA and AI: A Compliance Minefield

The Protection of Personal Information Act 4 of 2013 (POPIA) applies fully to AI systems that process personal information. When you feed customer data, employee records, or client information into an AI tool, you are processing personal information — and POPIA’s requirements apply.

Key obligations include:

• Lawful purpose: You must have a lawful basis for processing personal information through an AI system.
• Operator agreements: If you use a third-party AI platform that processes personal information on your behalf, you need a written operator agreement compliant with POPIA section 20.
• Data minimisation: Only process the personal information actually necessary for your purpose — do not submit entire databases to an AI tool for convenience.
• Transborder flows: Many AI platforms are hosted outside South Africa. Cross-border transfers of personal information are regulated under POPIA section 72 and require appropriate safeguards.

The Information Regulator has enforcement powers and can impose significant penalties for POPIA non-compliance. This is not a risk to defer.

What to do: Before using any AI tool that processes personal information, conduct a basic data protection impact assessment. Check where the platform stores and processes data. Ensure you have a compliant operator agreement in place.

Liability When AI Gets It Wrong

AI systems make mistakes. When an AI-driven decision causes harm — a flawed credit assessment, an incorrect medical recommendation, a defective product designed by AI — who is liable?

South African law currently has no specific AI liability framework. Courts will apply existing principles: delict (negligence and wrongfulness), contract, and the Consumer Protection Act. The likely result is that liability falls on the business that deployed the AI, not the AI itself or its developer (unless a product defect claim lies against the developer).

South Africa’s Draft National AI Policy was gazetted for public comment on 10 April 2026. It proposed a risk-based regulatory framework, several new oversight bodies, and an AI Insurance Superfund modelled on the Road Accident Fund, intended to compensate people harmed by AI systems where accountability cannot be clearly assigned.

The draft was withdrawn on 27 April 2026. News24 established that at least six of the document’s 67 academic citations referred to articles that did not exist — real journals, fabricated papers, and named authors who had never written them. The Minister described it as an unacceptable lapse that compromised the integrity of the draft. The most likely explanation is that a generative AI tool was used in drafting and its output was published without the citations being verified.

Two things follow for businesses. First, there is currently no draft AI policy on the table in South Africa; a revised version is expected but its content and timing are unknown, so nothing in the withdrawn draft can be planned around. Second, the episode is itself the clearest available illustration of the risk this article is about: AI output used in a professional context without verification, in a document that carried a government minister’s name.

What to do: Treat AI tools as you would any other business system. Implement human oversight for high-stakes decisions. Document your AI governance processes. Review your professional indemnity and liability insurance to check whether AI-related claims are covered.

What Is Coming: South Africa’s AI Regulatory Framework

South Africa is moving toward dedicated AI regulation, though the path has not been smooth. The withdrawn April 2026 draft is the clearest indication so far of the direction of travel, and a revised version is expected. The themes it contained are unlikely to disappear entirely:

• A risk-based approach — higher-risk AI applications will face stricter requirements
• An AI Regulatory Authority and AI Ombudsperson to handle complaints and oversight
• Algorithmic audits for high-risk use cases
• An AI Insurance Superfund for cases of unattributable harm

These proposals carry no legal force at present and the revised draft may differ materially. But the direction is clear enough to plan against, and businesses that build sound AI governance practices now will be better placed when regulation does arrive.

Five Practical Steps for South African Businesses

1. Audit your AI use. Map every AI tool your business uses and what data flows through it.
2. Review your contracts. Identify gaps in existing agreements and update key contracts to address AI use, liability, and IP ownership.
3. Check your POPIA compliance. Ensure operator agreements are in place for any AI platform processing personal information.
4. Implement human oversight. Do not allow AI to make final decisions on high-stakes matters without human review.
5. Get legal advice before problems arise. The cost of proactive legal review is a fraction of the cost of litigation or regulatory enforcement.

How HvS Attorneys Can Help

Legal Authority

• Copyright Act 98 of 1978 — s 1, definition of “author”: in relation to a computer-generated work, “the person by whom the arrangements necessary for the creation of the work were undertaken”; s 2(1) (eligibility and originality)
• Protection of Personal Information Act 4 of 2013 — including s 71 (automated decision-making)
• Consumer Protection Act 68 of 2008 — product liability and supplier obligations
• Draft National Artificial Intelligence Policy, gazetted 10 April 2026; withdrawn 27 April 2026

Related reading:
AI tools that process personal data must comply with POPIA. Read: POPIA compliance for small businesses in South Africa.
If you are building an AI-driven business, ensure your company structure is sound: registering a company does not make you its owner.

Our Digital Technology Law practice assists businesses in navigating the legal challenges of AI adoption — from drafting and reviewing AI-related contracts and POPIA compliance frameworks, to advising on IP ownership and liability risk. If your business is using AI tools and you are unsure of your legal position, contact us for a consultation.