In April 2026, the government published South Africa’s draft National Artificial Intelligence Policy for public comment. Within weeks it was withdrawn: a number of the academic references in it were found to be fictitious, apparently generated by AI and never checked.
If it can happen to a government policy, it can happen in your business. Your staff are almost certainly already using AI tools to draft emails, summarise contracts, write marketing copy and analyse customer data. Many are doing it without permission, guidance or oversight.
South Africa does not yet have AI-specific legislation. A revised draft policy is expected, and regulation will follow, but that does not mean AI use is unregulated. The existing law already applies, and it is where most of the risk lies today.
1. Confidential and personal information
When an employee pastes a client contract, a spreadsheet of customer details or an employee’s disciplinary record into a public AI tool, that information may be stored by the provider, used to train its models or transferred outside South Africa.
That can:
- breach POPIA, including the conditions for lawful processing, security safeguards and the restrictions on cross-border transfers in section 72;
- breach confidentiality obligations in client contracts and non-disclosure agreements; and
- in professional services, breach professional duties of confidentiality.
POPIA also restricts decisions based solely on automated processing that have legal consequences for, or substantially affect, a person, such as automated credit, hiring or insurance decisions (section 71). Businesses using AI to screen job applicants or assess customers need to understand where a human is involved.
2. Getting it wrong: hallucinations and liability
AI tools generate plausible text, not verified facts. South African courts have already criticised legal practitioners for submitting court papers containing non-existent case citations generated by AI, and referred them to the Legal Practice Council.
The same risk applies in any business. If an AI-drafted product description, financial projection, tender response or advice to a client is wrong, your business is responsible, not the AI provider. Most AI providers’ terms exclude liability for outputs almost entirely. Under the Consumer Protection Act, misleading representations to consumers can also attract liability, regardless of who or what drafted them.
3. Who owns the output?
The Copyright Act 98 of 1978 was not written for AI. Whether AI-generated content attracts copyright, and who owns it, is uncertain. Content generated by AI may also reproduce material protected by third-party copyright.
For businesses, the practical risks are:
- you may not be able to stop competitors copying AI-generated content you rely on;
- client contracts often require you to warrant that deliverables are original and do not infringe third-party rights; and
- your own valuable know-how, if uploaded into an AI tool, may lose protection.
4. Employment issues
AI raises a range of employment law questions:
- Recruitment. AI screening tools trained on historical data can reproduce bias, exposing the employer to unfair discrimination claims under the Employment Equity Act.
- Monitoring. Using AI to monitor employee productivity raises privacy and POPIA issues.
- Misconduct. Employers can only discipline employees for misusing AI if there are clear rules. Without a policy, that is difficult.
- Restructuring. Where AI replaces roles, retrenchments must still follow section 189 of the Labour Relations Act.
5. Contracts with AI providers and suppliers
Before adopting an AI tool for business use, review the terms. Key questions include:
- Will your data be used to train the provider’s models?
- Where is the data stored and processed?
- What security commitments and breach notification obligations does the provider give?
- Who owns the outputs?
- What liability does the provider accept?
Similarly, if your suppliers or service providers are using AI on your work or your data, your contracts with them should address it.
Every business needs an AI policy
An AI use policy is the simplest and most effective way to manage these risks. It should:
- set out which AI tools are approved and for what purposes;
- prohibit uploading confidential, client or personal information into unapproved tools;
- require human review of AI outputs before they are relied on or sent to clients;
- address disclosure to clients where appropriate;
- allocate responsibility for AI governance; and
- be backed by training and incorporated into disciplinary codes.
For larger companies, King V now expects boards to oversee the governance of information and technology, including AI.
How O’Reilly Law can help
We help businesses adopt AI responsibly, including drafting AI use policies, reviewing AI provider contracts, POPIA compliance, intellectual property and employment issues. Contact us to discuss an AI policy for your business.
Related reading: Your business has been hacked: a POPIA survival guide · Directors’ personal liability
This article is general information and not legal advice. Correct as at October 2026.