Does your business need an AI policy? What POPIA means for AI
Short answer: if your staff use AI and your business holds information about real people, yes. South Africa has no AI law yet, but POPIA already applies to what your staff type into an AI tool.
There’s no AI Act, and that doesn’t help you
South Africa has no dedicated AI legislation. The government published a draft national AI policy for comment in April 2026, then withdrew it later that month after fictitious, AI-generated references were found in it. It is a useful reminder of the problem most businesses have: AI output was relied on, and nobody checked it properly.
The absence of an AI law doesn’t leave a gap. The Protection of Personal Information Act (POPIA) applies whenever personal information is processed, and pasting a customer list or an employee’s details into an AI tool is processing.
Where POPIA applies to AI
| POPIA | What it means when staff use AI |
|---|---|
| Accountability (s8) | Your business remains responsible, even when the tool belongs to someone else or an employee used it without permission. |
| Minimality (s10) | Only use the personal information the task really needs. Whole customer lists rarely qualify. |
| Security (s19) | You need reasonable safeguards. Staff using personal AI accounts, invisible to the business, is hard to defend. |
| Operators (s20–21) | An AI provider handling personal information for you should be bound by a written contract with security obligations. |
| Special information (s26) | Health, biometric, religious and similar information carries stricter rules and shouldn’t be going into general AI tools. |
| Automated decisions (s71) | People generally can’t be subjected to decisions with legal or substantial effect based solely on automated processing. Keep a person in the decision. |
| Cross-border transfers (s72) | Most AI services process data outside South Africa, so you need a recognised basis for that, such as a binding agreement offering adequate protection. |
| Security compromises (s22) | If personal information reaches someone it shouldn’t, you may have to notify the Information Regulator and the people affected. |
The Information Regulator can impose administrative fines of up to R10 million, and the reputational cost is often worse.
What a practical AI policy should say
It doesn’t need to be long. If people won’t read it, it won’t protect you. It should answer seven questions:
- Which tools are approved? Company accounts only, and an easy way to ask for a new tool.
- What information may go in? Usually four classes: public, internal, confidential and restricted.
- What must never go in? Passwords, ID numbers, bank details, payroll and medical information.
- Who checks the output? A named person is accountable for anything that leaves the business.
- What may AI never do? Decide about people, or send, pay or change records on its own.
- Who owns this? One named person, working with your Information Officer.
- What if something goes wrong? Report it the same day, and reward honesty, or you’ll never hear about it.
Why banning AI doesn’t work
Staff who find AI useful will carry on using it, on their phones and personal accounts, where the business can’t see anything at all. A ban feels safe and usually makes the risk worse. A clear policy and an approved tool give people a legitimate route.
Four things to do this month
- Ask, without blame, who is already using AI and for what.
- Choose one approved tool on a business plan, and check its current terms.
- Write the one-page rules above and train people on them.
- Add AI to your POPIA records, with your Information Officer involved.
Want the full framework?
Our free working paper sets it out for South African owners and executives: what must never go into AI, who should approve what, how to connect AI to your systems safely, and a ten-point readiness check.
Get the working paperThis article is general information and not legal advice. Have your legal or compliance advisor confirm your position under POPIA. Published November 2026.