Navigating AI laws: understanding legalities of AI usage in South Africa


To understand the legalities, challenges, and opportunities of AI in South Africa, CIO South Africa interviewed a law expert and three leading CIOs.

The African Centre for Economic Studies points to the fact that AI has quickly become embedded in people’s lives as it is used in sectors from commerce through to health and agriculture. Yet, unregulated AI can have devastating consequences, which researcher Velibor Božić says includes increased inequality and loss of privacy.

While the EU has put a comprehensive set of regulations in place, the US has yet to do so, and Africa is lagging far behind in the process of putting guardrails in place to regulate AI.

The African Centre for Economic Studies states that, in Africa, “most countries lack comprehensive policy frameworks to incentivise responsible AI, regulate AI-driven business models, or effectively promote the creation and capture of high-quality African data”.

The Government AI Readiness Index 2022 shows that the continent is ranked the lowest compared to all other regions while several African countries are in the lowest range of the rankings. There are just not many countries on the continent with holistic strategies for innovation and digital transformation, including AI, according to the African Centre for Economic Studies.

Tayyibah Suliman, director in Cliffe Dekker Hofmeyr’s Technology and Sourcing practice and also a member of the Data Protection and Privacy Group, says that there are some elements of the existing legal framework that will impact regulation of AI, including protecting intellectual property through copyright laws and preventing unlawful processing of personal information. Putting an AI-specific framework in place will take years, she says.

“When looking at AI, you would need to consider the many other laws that could potentially impact the use thereof. This can be done on a case-by-case basis – where you can review the purpose the AI tool has been created, what the sources of data are and who might be affected,” says Tayyibah.

Pros and cons

Tayyibah notes that the implications of using AI are a double-edged sword. She explains that the positive is that the technology can process large amounts of data in seconds, providing useful information that would have otherwise taken whole teams of people weeks to produce.

AI is also highly accurate and can make meaningful connections and links to the various data fed into it, Tayyibah says.

At Old Mutual iWYZE, AI is used by staff to increase productivity as well as enhance customer experience and create operational efficiencies through embedding AI into operations such as marketing, claims, sales, and customer services, says CTO Mbusiswa Nyuswa.

“AI offers us the ability to scale the business while being in control of our operational costs. The ability to automate cumbersome tasks enables our agents to focus on more complex tasks, ensuring that we continue to offer superior customer service.”

Among the benefits Mbusiswa cites are reduced times in handling calls. “We’re using AI as a decision enabler rather than a decision maker.”

At City Lodge Hotels, the company uses both AI and behavioural science to create predictive models that can save businesses from the burden of mundane tasks such as projecting occupancies and revenue for the next three months, says Nkosenhle Ngongoma, divisional director of IT in the Support Office.

Alula Technologies also uses AI to increase productivity, says CIO Yunus Scheepers. The company relies on AI across a variety of business operations, including software development, to reduce dependence on external marketing and copywriting agencies, allowing its go-to-market team to be more self-sufficient and agile, as well as improving CRM’s productivity, which allows them to spend more time with people in client companies and less time doing admin.

“The primary opportunity, besides the increased value of our product offerings, is productivity gains and less dependence on external specialist organisations,” he says.

Yet, because of the way AI systems operate, specifically when it comes to algorithms, the data’s integrity may come into question. As a result, Tayyibah says, “CIOs need to carefully consider the data they use to train AI models.”

The data ultimately determines the integrity and accuracy of the results.

Nkosenhle concurs with Tayyibah in that the biggest challenge with AI is the integrity of the data used to influence the outcome of the forecasting. There is, however, an opportunity to extend forecasting further into the future than is currently the case as well as applying “what if” analysis in real time, allowing for corrective measures to be implemented if needed”, he says.

Personal information

Another factor to consider is that the AI tool will have to be strictly aligned with the various privacy laws and any other relevant law.

“Since AI operates independently. with no human accompaniment, it cannot be held accountable for any errors or accept legal culpability,” Tayyibah says.

“Some challenges in the realm of AI we may face include the lack of accountability, accuracy, potential infringement of intellectual property rights, and violations of data protection laws,” she adds.

Nkosenhle says the key aspect in the decision-making process is ensuring that the AI tool will not share its proprietary data with any other third parties. “We also need to ensure that activities that are being carried out by the AI tool are ethical and environmentally friendly.”

Information, which is collected with consent and does not identify any particular guest, complies with both local and international data protection regulations, says Nkosenhle. As a further safeguard, IT engages with legal issues when it comes to implementing tools, he says.


Mbusiswa says that, when it comes to implementing AI, a central committee reviews all new AI solutions being rolled out in the organisation. Among the risks the insurance company must deal with are around transmitting and protecting data, as well as the credibility of AI model results.

“It’s important that we are abreast of emerging AI solutions so that we’re aware of any new risks that we need to solve for,” says Mbusiswa. As part of this, the insurance company makes sure of external vendors, so it can continually assess processes to ensure adherence with law and regulation.

Yunus says the company makes certain it does its homework and has sufficient dialogue on its various structures to try and ensure that any tools it uses or develops do not perform in a biased or discriminatory way. “We need to do rigorous testing, with as diverse an audience as we have access to, to avoid any unintended consequences.”

Alula also has an Architecture Forum (composed of both internal and external people) in which it discusses the merits of new technologies and their associated risks, before they are rolled out, says Yunus. “We then track it in future forums,” he explains.

AI doesn’t come without its challenges. At Old Mutual iWYZE, the company operates in a highly regulated environment and needs to constantly evolve policies and security measures to ensure that it does not introduce new risks as well as more frequent training for staff, says Mbusiswa.

Yunus adds that the challenges it has are seeing through the hype, identifying real benefits, and then rolling them out and tracking whether they really add value. Before implementing AI, Alula considers whether it adds business value, which is difficult to measure objectively and, often, can only be seen anecdotally, he says.

Alula relies heavily on its partner, Microsoft, when it comes to considerations such as security and ethical use of the data. “From an ethical perspective, we need to do as much research as we can and get as many diverse opinions as possible to ensure that there are no negative ethical implications,” says Yunus.

Human touch

Tayyibah states that, although AI is a powerful tool, it should always be seen as an aid to the decision-making process, not a full-factor replacement. “Abstract decisions requiring human emotion and empathy cannot be replicated by a machine,” she points out.

Nkosenhle says City Lodge Hotels reviews the AI predictions with actual data each month to recalibrate the tool and help it learn.

Yunus notes that implementing AI boils down to company principles and common sense. “We also need to accept that we will get things wrong and not be afraid to admit it and then implement changes as required.”

This exclusive feature on AI was originally published in the first edition of the 2024 CIO Magazine. Read it here

Related articles

The role of CISOs in shaping robust cybersecurity laws

Newly appointed chief information and security officer (CISO) at the University of the Witwatersrand Galeboe Mogotsi discusses the important role security officers must play in shaping the country’s cybersecurity laws.

Navigating the complex terrain of IT adoption

In the dynamic and ever-changing world of business, maintaining a competitive edge and maximising efficiency requires the integration of innovative IT projects that hold the promise of transformation. However, the path to successful adoption of these projects is complex and riddled with obstacles.