Authored By: Leon Mtshali
University of South Africa
Introduction
Artificial Intelligence (AI) presents South African start-ups with unprecedented opportunities to scale operations, optimize commercial efficiency, and compete in global markets. However, integrating autonomous algorithms into business workflows introduces substantial legal risk. In South Africa, all corporate activities and statutory interpretations must conform to the supreme law of the land: the Constitution of the Republic of South Africa, 1996. Consequently, any AI system designed, deployed, or commercialized by a start-up must respect constitutional imperatives, particularly the foundational rights to privacy, human dignity, and administrative fairness.
Navigating AI liability does not depend on a single, isolated statute. Instead, it requires a synthesized understanding of contract law, data protection, consumer safety, corporate governance, and the common law of delict. Because AI systems lack legal personality, civil and statutory accountability remains firmly attached to the natural and juristic persons who deploy them. This article outlines the legal framework governing AI start-ups in South Africa, analysing statutory obligations, judicial precedents, and common-law principles to provide a structured analysis for technology entrepreneurs.
Main Body
When a start-up utilizes AI algorithms to negotiate, execute agreements, or interact with consumers, South African law attributes those automated actions directly to the deploying entity. Under the Electronic Communications and Transactions Act 25 of 2002 (ECTA), autonomous software programs are categorized as electronic agents. Section 20(c) of ECTA provides that a party using an electronic agent to create an agreement is bound by the resulting terms, even if no human representative reviewed or approved the specific transaction. Start-ups cannot avoid contractual obligations by claiming algorithmic error or unexpected software execution. Section 25 reinforces this rule by establishing that a data message generated by an automated system programmed by or on behalf of an originator is legally deemed to be sent by that originator. Furthermore, Section 20(e) offers crucial consumer protection by stipulating that if an individual makes an input error while interacting with an automated agent and the system fails to provide an opportunity to correct that error, the resulting transaction may be invalidated. Consequently, start-ups must ensure their automated user interfaces incorporate robust validation checks and human-override options to prevent unintended contractual exposure.
Beyond contractual relations governed by ECTA, data handling forms the primary foundation of machine learning, making compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) central to AI operations. POPIA strictly regulates automated decision-making and establishes high liability standards for mishandled personal data. Section 71 of POPIA prohibits subjecting a data subject to a decision that produces legal consequences or significantly impacts them if that decision is based solely on automated processing intended to profile the individual. This restriction directly applies to AI applications used in credit scoring, employment recruitment, healthcare triage, and risk assessment. To lawfully execute automated decisions under Section 71, a start-up must demonstrate that the processing is connected to a contract requested by the data subject or authorized by a law or industry code that provides appropriate safeguards. The start-up must provide the data subject with an underlying explanation of the automated decision, ensuring procedural transparency and granting them a reasonable opportunity to make representations.
Section 99 of POPIA establishes a strict civil liability regime for data security breaches. Under this provision, a data subject or the Information Regulator may institute civil proceedings against a start-up acting as a responsible party for statutory breach, regardless of whether the failure was intentional or negligent. This no-fault standard highlights the heightened operational duty imposed on start-ups to secure data pipelines feeding into AI models and to prevent unauthorized access or data corruption.
Where AI systems transition from internal processing to consumer-facing products or services, the legal burden expands under the Consumer Protection Act 68 of 2008 (CPA). Section 61 of the CPA introduces a modified form of strict product liability, holding producers, importers, distributors, and retailers liable without proof of fault for harm caused by unsafe goods, product failures, defects, or inadequate instructions accompanying goods. Where an AI tool, such as an automated diagnostic system or autonomous hardware, malfunctions and causes personal injury, property damage, or consequential economic loss, the start-up faces statutory liability regardless of whether it exercised due care. Furthermore, Section 22 of the CPA mandates that all consumer-facing documentation, notices, and instructions be provided in plain and understandable language. Under Sections 49 and 58, if an AI product involves unusual operational risks or potential for serious injury, the start-up must explicitly and conspicuously highlight these risks before the consumer engages with the product.
While statutory product and data liability govern external commercial risks, internal corporate governance is strictly regulated by the Companies Act 71 of 2008. The integration of AI tools does not absolve corporate officers of their fundamental fiduciary duties. Section 76(3) mandates that a director must exercise their powers in good faith, for a proper purpose, in the best interests of the company, and with the degree of care, skill, and diligence reasonably expected of a person in that position. Approving high-risk AI deployments without adequate risk assessments may constitute a breach of this statutory duty. Section 22 prohibits carrying on a company’s business recklessly, with gross negligence, or with intent to defraud. Under Section 77(3)(b), directors can be held personally liable for any loss or damages sustained by the company as a result of knowingly carrying on business in contravention of Section 22. Hiding behind an unexplainable algorithm or failing to exercise oversight when an AI tool operates harmfully exposes directors to direct personal financial accountability.
Beyond statutory frameworks, South African common law governs civil recovery for non-contractual harm through the law of delict. To succeed in an aquilian action against an AI start-up, a plaintiff must prove conduct, wrongfulness, fault in the form of negligence, harm, and causation. The benchmark test for delictual negligence was established in Kruger v Coetzee 1966 (1) SA 428 (A), which asks whether a reasonable person in the position of the defendant would foresee the reasonable possibility of their conduct causing harm, would take reasonable steps to guard against that harm, and whether the defendant failed to take those steps. In the context of an AI start-up, the reasonable person standard is measured against a competent technology developer. Failing to implement rigorous testing, algorithmic bias audits, or safety monitoring constitutes a breach of the standard of care, establishing delictual negligence. This is reinforced by Minister of Safety and Security v Van Duivenboden 2002 (6) SA 431 (SCA), where the Supreme Court of Appeal held that accountability and constitutional values determine legal duties regarding omissions. Failing to act to prevent known algorithmic harms violates community legal convictions, establishing legal wrongfulness.
Finally, start-ups relying on generative AI platforms face severe legal exposure regarding algorithmic misrepresentation and structural hallucinations. In the prominent American decision Mata v. Avianca, Inc. 678 F. Supp. 3d 443 (S.D.N.Y. 2023), legal practitioners were sanctioned for submitting court pleadings containing fictitious, AI-generated case law citations. Under South African law, submitting false or misleading AI-generated content carries direct statutory and criminal penalties. Section 214 of the Companies Act creates an offence for knowingly providing false or misleading information in any record or document required under the Act. Similarly, Section 109 of the CPA and Section 103 of POPIA penalize providing false statements or misleading information to regulatory entities. Relying uncritically on unverified AI outputs exposes both the start-up and its directors to severe reputational damage, administrative fines, and criminal liability.
Conclusion
Artificial intelligence operates strictly within the bounds of existing South African law. Far from a legal vacuum, AI deployments are governed by a robust matrix of statutory rules and common-law principles. Contractually, start-ups are bound by automated agent activities under ECTA. In data processing, POPIA restricts sole automated profiling and imposes strict liability for data compromises. Operationally, the CPA enforces no fault product liability for defective technology, while the Companies Act maintains personal director accountability. To mitigate these legal exposures, South African start-ups must incorporate a Human in the Loop governance model. Human oversight, rigorous pre-deployment testing, transparent risk disclosure, and auditability ensure that AI supports rather than replace human judgment, aligning entrepreneurial innovation with constitutional accountability.
Reference(S):
Cases
Kruger v Coetzee 1966 (2) SA 428 (A)
Mata v. Avianca, Inc., No. 22-cv-1461 (S.D.N.Y. 2023)
Minister of Safety and Security v Van Duivenboden 2002 (6) SA 431 (SCA)
Legislation
Companies Act 71 of 2008
Constitution of the Republic of South Africa, 1996
Consumer Protection Act 68 of 2008
Electronic Communications and Transactions Act 25 of 2002
Protection of Personal Information Act 4 of 2013
