Detailed overview
South Africa does not currently have a single enacted AI Act. Its AI framework is developing through policy work, public consultation, data-protection law, existing sectoral regulation and digital-economy strategy.
Policy in flux
South Africa's Department of Communications and Digital Technologies published a National Artificial Intelligence Policy Framework in 2024 and later released a draft National AI Policy for public engagement. The policy process is intended to guide South Africa's national position on AI governance, innovation, ethics, inclusion, skills, infrastructure and economic development.
In 2026, the Minister announced the withdrawal of the draft AI policy and stated that a credible policy would be reintroduced. South Africa should not be described as having a final binding AI policy or a comprehensive AI Act at this stage.
Current compliance
Current AI compliance in South Africa depends mainly on existing law. Where AI processes personal information, the Protection of Personal Information Act, or POPIA, may apply. AI systems may also be subject to consumer protection, employment, equality, financial-services, healthcare, cybersecurity, telecommunications, intellectual-property or criminal law.
Penalties
South Africa does not currently have one AI-specific penalty table. Penalties depend on the underlying legal framework that is breached, especially privacy, consumer, employment, equality, financial, healthcare, telecoms or criminal law.
Practical requirements & details
Sourced from POPIA (Act 4/2013), the Information Regulator's guidance, the Department of Communications and Digital Technologies' AI policy work, and sectoral rules (PA, FSCA, SAHPRA).
POPIA — 8 conditions for lawful processing
- Accountability; processing limitation; purpose specification; further processing limitation; information quality; openness; security safeguards; data subject participation.
- Special-category personal information (religion, health, biometric, sexual life) requires additional grounds.
Automated decision-making (s. 71)
- Data subjects may not be subject to a decision based solely on automated processing producing legal effects or substantially affecting them, except under specified conditions and with safeguards (right to express views, contestation, explanation).
Information Regulator powers
- Investigation, audit, enforcement notices, infringement notices.
- Administrative fines up to ZAR 10M per offence; criminal sanctions up to 10 years for serious offences.
AI policy status (2026)
- Department of Communications and Digital Technologies withdrew the draft AI policy in 2026 with promise of a credible replacement.
- AI compliance currently relies on existing law.
Sector overlays
- PA + FSCA AI guidance in banking and financial services.
- SAHPRA on AI as a medical device.
- Consumer Protection Act, Promotion of Equality and Prevention of Unfair Discrimination Act for AI-driven harm.
- Companies Act + King IV governance principles for board-level AI oversight.