Authored By: TSHEGOFATSO KGOSHIADIRA
University of South Africa
INTRODUCTION
Artificial intelligence (AI) has emerged as one of the most transformative technologies of the modern era, reshaping industries, governance systems and daily human interactions. Its ability to process vast quantities of data, identify patterns, and generate predictive outputs has enabled rapid advances in sectors such as healthcare, finance, education, transport, security and public administration. ¹Unlike earlier waves of digital transformation, AI systems do not merely automate predefined tasks; they are increasingly capable of learning from data, adapting to new inputs and making decisions with limited human intervention. This shift from rule-based computing to adaptive machine learning systems has created new efficiencies but also introduced complex legal and constitutional challenges.
In South Africa, AI is already embedded in both public and private decision-making systems. In the financial sector, banks and fintech companies use AI to detect fraud, assess creditworthiness and evaluate risk profiles. In healthcare, machine-learning tools assist with early diagnosis, radiology interpretation and patient risk prediction. Employers increasingly rely on algorithmic systems for recruitment screening, CV filtering and performance evaluation. Government departments are exploring AI to improve tax compliance, service delivery and resource allocation. While these applications offer significant benefits in efficiency and scale, they also raise important constitutional concerns relating to equality, dignity, privacy and administrative justice.
Unlike jurisdictions such as the European Union, which has adopted a comprehensive Artificial Intelligence Act establishing a structured regulatory framework based on risk classification, South Africa does not yet have dedicated AI legislation. Instead, AI is regulated indirectly through a combination of constitutional principles and general statutes, including the Constitution of the Republic of South Africa, 1996, the Protection of Personal Information Act 4 of 2013 (POPIA), the Consumer Protection Act 68 of 2008, the Labour Relations Act 66 of 1995, the Employment Equity Act 55 of 1998 and the Cybercrimes Act 19 of 2020.² While these legal instruments provide important safeguards, they were enacted long before the emergence of modern machine-learning systems and therefore do not specifically address the unique risks posed by autonomous and adaptive technologies.
This article critically evaluates whether South Africa’s existing legal framework is sufficient to regulate artificial intelligence. It argues that while the Constitution provides a strong normative and rights-based foundation, the current framework is fragmented, reactive and insufficient to address key governance challenges such as algorithmic bias, transparency, explainability, accountability and liability.
UNDERSTANDING ARTIFICIAL INTELLIGENCE
Artificial intelligence refers to computer systems capable of performing tasks that typically require human intelligence, including learning, reasoning, perception, language processing and decision-making.³ Unlike traditional software systems, which operate on fixed rules written by programmers, AI systems rely on machine learning algorithms that identify patterns in data and improve performance over time without explicit reprogramming.
A key distinction in modern AI is between narrow AI and general AI. Narrow AI refers to systems designed to perform specific tasks, such as facial recognition, fraud detection or language translation. These systems dominate current real-world applications. General AI, which remains theoretical, refers to systems capable of performing any intellectual task that a human can do. Although general AI does not yet exist, rapid advancements in generative AI systems such as large language models have increased legal and regulatory urgency.
The Organisation for Economic Co-operation and Development (OECD) defines AI as a system that, for explicit or implicit objectives, generates outputs such as predictions, recommendations or decisions that influence real or virtual environments. ⁴ This definition highlights the adaptive and outcome-driven nature of AI systems, which distinguishes them from conventional automated software.
In practice, AI systems function through large-scale data processing. They are trained on datasets that may include personal, behavioural, financial or biometric information. The system identifies statistical relationships within this data and uses them to make predictions or classifications. This process is often opaque, particularly in deep learning systems where decision pathways are not easily interpretable even by developers.
AI APPLICATIONS IN SOUTH AFRICA
AI is already widely used in South Africa across both public and private sectors. In financial services, AI-driven systems are used for fraud detection, transaction monitoring, algorithmic trading and credit scoring. These systems can process millions of transactions in real time, identifying anomalies far more efficiently than human analysts.
In healthcare, AI supports radiology interpretation, disease prediction and patient monitoring systems. These technologies are particularly valuable in a country facing resource constraints and unequal access to healthcare services. AI systems can assist in identifying early warning signs of diseases and improving diagnostic accuracy.
In employment contexts, AI is increasingly used to automate recruitment processes. CV screening tools rank candidates based on predefined criteria, while behavioural analytics tools assess employee performance and productivity. While these systems improve efficiency, they also introduce risks of hidden bias and lack of transparency.
Government use of AI is also expanding, particularly in areas such as tax compliance, border control, social service distribution and law enforcement analytics. Predictive systems may assist in identifying fraud or allocating resources, but they also raise concerns about surveillance, profiling and accountability.
BENEFITS AND RISKS OF AI
The benefits of AI are significant. AI systems can process large datasets at high speed, improve accuracy in decision-making, reduce administrative burdens and increase efficiency across sectors. In developing countries such as South Africa, AI also has the potential to improve governance capacity, reduce service delivery backlogs and support economic development. These benefits are accompanied by substantial legal risks.
One of the most important risks is privacy infringement. AI systems depend on large-scale data collection and processing, often involving sensitive personal information. This raises concerns about consent, data minimisation and lawful processing.
A second major risk is algorithmic bias. AI systems trained on historical datasets may reproduce existing social inequalities. For example, if historical hiring data reflects discriminatory practices, an AI recruitment system trained on that data may replicate those patterns.
A third concern is transparency. Many AI systems operate as “black boxes,” meaning their internal decision-making logic is not easily understandable. This creates difficulties for accountability and legal review.
Finally, accountability is a structural challenge. AI systems involve multiple actors, including developers, deployers, data providers and end users. When harm occurs, it may be difficult to determine who bears legal responsibility.
LEGAL FRAMEWORK IN SOUTH AFRICA
THE CONSTITUTION AS THE FOUNDATION OF AI REGULATION
The Constitution of the Republic of South Africa, 1996 is the supreme law and provides the foundational framework for regulating artificial intelligence. All legislation, conduct and policy must comply with constitutional principles, particularly those contained in the Bill of Rights. In the context of AI, the most relevant rights include equality, human dignity, privacy and just administrative action.
Section 9: Equality and non-discrimination.
Section 9 of the Constitution guarantees the right to equality and prohibits unfair discrimination. This provision is particularly significant in relation to artificial intelligence systems because algorithmic decision-making often relies on historical data that may reflect structural inequality.
In Harksen v Lane NO, the Constitutional Court developed the test for unfair discrimination, emphasising that discrimination must be assessed based on its impact rather than the intention behind it.⁵ This principle is directly relevant to AI systems, which may produce discriminatory outcomes even in the absence of human intent. For example, an AI recruitment tool trained on historical hiring data may unintentionally favour certain demographic groups if past hiring patterns were biased.
The implication is that AI systems can produce indirect discrimination, which is often harder to detect and regulate than direct human discrimination. This raises important constitutional questions about whether existing equality law is sufficiently equipped to regulate automated decision-making systems.
Section 10: Human Dignity
Section 10 protects the right to human dignity, which is a foundational value of South Africa’s constitutional order. In S v Makwanyane, the Constitutional Court emphasised that dignity is central to the Constitution and underpins all other rights.⁶
AI systems may threaten dignity where individuals are reduced to algorithmic profiles or data points without meaningful human consideration. For instance, automated welfare allocation systems or predictive policing tools may make determinations about individuals without explaining the reasoning or allowing for human contextual judgment. This risks treating individuals as objects of computation rather than autonomous rights-bearers.
The dignity concern is particularly important in South Africa, where constitutionalism is grounded in the recognition of human worth and substantive equality.
Section 14: Privacy
Section 14 protects the right to privacy. In Investigating Directorate: Serious Economic Offences v Hyundai Motor Distributors (Pty) Ltd, the Constitutional Court confirmed that privacy includes protection against unjustified intrusion into personal information and private life.⁷
AI systems typically depend on large-scale data collection, including behavioural, biometric, financial and location data. This creates a direct intersection with privacy rights. The more data an AI system processes, the greater the risk of intrusion, surveillance and unauthorised profiling.
In modern AI systems, privacy risks are not limited to data collection but extend to data inference, where systems can predict sensitive personal attributes without explicit disclosure by the individual. This expands the scope of privacy concerns beyond traditional data protection models.
Section 33: Just Administrative Action
Section 33 guarantees the right to lawful, reasonable and procedurally fair administrative action. This is particularly relevant where AI systems are used in public administration.
The Promotion of Administrative Justice Act 3 of 2000 (PAJA) gives effect to section 33 by requiring that individuals be given reasons for administrative decisions and the opportunity to challenge them.
AI systems complicate this framework because algorithmic decision-making may not produce easily explainable reasons. If a government system uses machine learning to allocate social benefits, deny permits or flag individuals for investigation, it becomes difficult to satisfy the requirement of procedural fairness unless the system is transparent and explainable.
This creates a tension between technological efficiency and constitutional accountability.
POPIA AND DATA-DRIVEN AI GOVERNANCE
The Protection of Personal Information Act 4 of 2013 (POPIA) is the most directly relevant legislation for regulating AI systems in South Africa. POPIA gives effect to the constitutional right to privacy by regulating the lawful processing of personal information.
POPIA establishes key principles such as:
- accountability (responsibility of data controllers)
- processing limitation (lawful and minimal processing)
- purpose specification (clear use of data)
- further processing limitation
- information quality
- openness and transparency
- security safeguards
These principles are highly relevant to AI systems because machine learning models depend on large datasets.
Section 71: Automated Decision-Making
Section 71 of POPIA is particularly significant for AI governance. It restricts decisions that are based solely on automated processing if they significantly affect a data subject, unless certain safeguards are in place.
This provision recognises the risk of fully automated decision-making systems and its scope is limited. It does not:
- define artificial intelligence
- regulate algorithm design
- require explainability of models
- require fairness or bias testing
As a result, POPIA is useful for data protection but insufficient as a comprehensive AI governance framework.
CONSUMER PROTECTION ACT AND AI SYSTEMS
The Consumer Protection Act 68 of 2008 (CPA) provides protection against unfair, unreasonable or deceptive commercial practices.
AI systems increasingly fall within the scope of consumer markets, particularly in: • online platforms
- digital services
- automated customer systems
- recommendation engines
CPA was not designed for autonomous systems that evolve after deployment. Traditional product liability assumes static goods, whereas AI systems change over time through learning processes.
This raises legal uncertainty regarding:
- who is liable for AI-caused harm
- whether algorithmic outputs constitute “defects”
- whether AI decisions amount to misleading conduct
LABOUR LAW AND AI-DRIVEN EMPLOYMENT SYSTEMS
The Labour Relations Act 66 of 1995 and the Employment Equity Act 55 of 1998 regulate fairness in employment practices.
The Employment Equity Act prohibits unfair discrimination in employment policies and practices. This is highly relevant to AI systems used in recruitment, promotion and performance evaluation.
If an AI system produces discriminatory outcomes, the employer may still be held liable, even if the decision was automated. This is because South African labour law focuses on outcomes and fairness rather than intention neither statute directly regulates algorithmic transparency or requires employers to disclose how AI systems reach employment-related decisions.
This creates a regulatory gap in the context of automated hiring systems and workforce analytics.
CYBERCRIMES ACT AND AI-ENABLED HARM
The Cybercrimes Act 19 of 2020 criminalises offences such as cyber fraud, unlawful access to data and malicious communications.
AI increases the sophistication of cybercrime through:
- deepfake technology
- automated phishing attacks
- synthetic identity fraud
- large-scale misinformation campaigns
While the Act addresses criminal conduct in digital environments, it does not regulate the design or governance of AI systems themselves. It is therefore reactive rather than preventive.
CHALLENGES AND GAPS IN THE CURRENT LEGAL FRAMEWORK
South Africa’s constitutional and statutory framework provides important protections, significant gaps remain when applied to artificial intelligence. These gaps arise primarily because existing laws were designed for human decision-making and traditional information systems, rather than autonomous, adaptive technologies capable of learning and evolving over time.
Absence of Dedicated AI Legislation
One of the most fundamental weaknesses in South Africa’s regulatory landscape is the absence of dedicated artificial intelligence legislation. Unlike other emerging technology sectors such as telecommunications or banking, AI is not governed by a unified legal framework. Instead, regulation is dispersed across multiple statutes dealing with privacy, consumer protection, labour relations and cybercrime.
This fragmented approach creates uncertainty because there is no clear legal definition of AI in South African law, nor is there a classification system distinguishing between low-risk and high-risk AI applications. As a result, developers and users of AI systems lack clear guidance on compliance obligations, accountability standards and liability allocation.
Algorithmic Bias and Structural Inequality
Algorithmic bias is one of the most pressing legal and ethical concerns in AI governance. AI systems are trained on historical data, which may reflect existing social, economic and racial inequalities. When such data is used without correction, AI systems may reproduce or even amplify discriminatory patterns.
In the South African context, this issue is particularly sensitive given the constitutional commitment to substantive equality under section 9. While Harksen v Lane NO establishes that discrimination must be assessed based on impact rather than intention, current legislation does not explicitly require algorithmic auditing or bias mitigation.
This creates a gap between constitutional principles and technological practice. Even if discrimination is constitutionally prohibited, there is limited proactive regulation ensuring that AI systems are designed in a non-discriminatory manner.
Transparency and Explainability Challenges
A further challenge lies in the opacity of AI systems. Many modern machine-learning models operate as “black boxes,” meaning their internal decision-making processes are not easily interpretable, even by their developers.
This raises significant constitutional concerns, particularly in relation to section 33 of the Constitution and PAJA, which require administrative decisions to be lawful, reasonable and procedurally fair. Without transparency, individuals affected by AI decisions may not understand why a decision was made or how to challenge it.
Explainability is therefore not merely a technical issue but a legal requirement for accountability and fairness in administrative and quasi-administrative decision-making.
Liability for AI related harm
Another major gap concerns legal liability for harm caused by AI systems. Traditional South African delict law is based on the principles of conduct, wrongfulness, fault and causation. These principles assume human agency and decision-making.
AI systems complicate this structure because harm may arise from:
- autonomous system behaviour
- flawed training data
- developer design choices
- user deployment decisions
This makes it difficult to determine who should bear legal responsibility: the developer, the deployer, the user, or potentially multiple parties simultaneously. Current law does not provide a clear framework for allocating liability in such scenarios.
Risks of Generative AI
Generative AI introduces additional risks that existing legislation does not adequately address.
These include:
- deepfake creation and manipulation of media
- synthetic identity fraud
- automated misinformation campaigns
- intellectual property infringement
While the Cybercrimes Act addresses certain harmful digital behaviours, it does not specifically regulate the generation or distribution of AI-created synthetic content. This leaves a regulatory gap in relation to modern AI capabilities.
COMPARATIVE ANALYSIS: THE EUROPEAN UNION AI ACT
The European Union Artificial Intelligence Act represents the most comprehensive attempt globally to regulate AI systems. It introduces a risk-based regulatory framework, which categorises AI systems into four levels:
- unacceptable risk (prohibited systems)
- high-risk systems (strictly regulated)
- limited-risk systems (transparency obligations)
- minimal-risk systems (light regulation)
This approach is significant because it recognises that not all AI systems pose the same level of risk. Regulation is therefore proportionate to potential harm.
High-Risk AI Systems
High-risk systems include AI used in:
- employment decisions
- credit scoring
- education admissions
- law enforcement
- critical infrastructure
These systems are subject to strict obligations, including:
- data governance requirements
- risk management systems
- transparency obligations
- human oversight mechanisms
- conformity assessments before deployment
Legal Certainty and Accountability
A key advantage of the EU framework is legal certainty. Developers and deployers of AI systems know in advance what their obligations are. The framework also establishes clear accountability structures, ensuring that responsibility is not diffused across multiple actors.
Relevance to South Africa
South Africa currently lacks a similar structured framework. While constitutional rights provide general protections, they do not translate into detailed operational obligations for AI systems. As a result, the EU model provides an important comparative benchmark for potential reform.
POLICY AND LEGISLATIVE RECOMMENDATIONS
Considering the identified gaps, South Africa should consider developing a dedicated artificial intelligence regulatory framework.
- Enact Comprehensive AI Legislation
South Africa should introduce legislation that specifically defines artificial intelligence and sets out clear regulatory principles. This would reduce uncertainty and ensure consistent governance across sectors.
- Adopt a Risk-Based Regulatory Model
A risk-based approach like the EU AI Act would allow regulation to be proportionate. High risk systems affecting fundamental rights should be subject to stricter controls, while low-risk systems may be lightly regulated to encourage innovation.
- Strengthen Transparency and Explainability Requirements
AI systems used in decision-making processes should be required to provide meaningful explanations. This is particularly important in administrative, employment and financial contexts.
- Mandatory Human Oversight
High-risk AI systems should not operate without meaningful human oversight. Human involvement ensures accountability and prevents fully automated rights-impacting decisions.
- Algorithmic Auditing and Bias Mitigation
Legislation should require regular auditing of AI systems for bias and discriminatory outcomes. This would operationalise constitutional equality protections in a technological context.
- Establish a Regulatory Authority
A dedicated regulatory body or expanded mandate for an existing institution such as the Information Regulator, should oversee compliance, auditing and enforcement of AI systems.
CONCLUSION
Artificial intelligence presents both significant opportunities and serious legal challenges for South Africa. While AI has the potential to improve efficiency, innovation and service delivery across sectors, it also raises complex concerns relating to privacy, equality, transparency, accountability and liability.
This article has demonstrated that South Africa’s current legal framework, while grounded in strong constitutional principles, is not sufficient to regulate artificial intelligence comprehensively. Existing laws are fragmented, indirect and not designed for autonomous or adaptive systems.
Comparative analysis with the European Union highlights the advantages of a structured, risk-based regulatory framework that provides legal certainty and ensures proportional regulation.
South Africa should therefore develop dedicated artificial intelligence legislation that aligns technological innovation with constitutional values such as dignity, equality, privacy and accountability. Such a framework would ensure that AI development occurs in a manner that is both innovative and constitutionally compliant.
OSCOLA REFERENCE LIST / BIBLIOGRAPHY
Constitution
Constitution of the Republic of South Africa, 1996.
Legislation
Consumer oceOECDProtection Act 68 of 2008.
Cybercrimes Act 19 of 2020.
Employment Equity Act 55 of 1998.
Labour Relations Act 66 of 1995.
Promotion of Administrative Justice Act 3 of 2000.
Protection of Personal Information Act 4 of 2013.
Cases
Harksen v Lane NO and Others 1998 (1) SA 300 (CC).
Investigating Directorate: Serious Economic Offences and Others v Hyundai Motor Distributors (Pty) Ltd and Others; In re Hyundai Motor Distributors (Pty) Ltd and Others v Smit NO and Others 2001 (1) SA 545 (CC).
S v Makwanyane and Another 1995 (3) SA 391 (CC).
International Instrument
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act).
Organisation for Economic Co-operation and Development (OECD), Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449, adopted 22 May 2019).
