Why legal compliance is the kick-off and not the final whistle.
South African organizations are already putting AI onto the field: summarizing documents, supporting customer interactions, analyzing data, and assisting employees with everyday decisions.
The technology is sprinting. The AI-specific rulebook is still developing. But the rulebook is not blank.
Where an AI use falls within the Protection of Personal Information Act 4 of 2013 (POPIA), the Act already governs how personal information is handled. The practical challenge is therefore not simply to ask, “Do we have an AI law yet?” It is to understand how today’s rules apply to technology that keeps changing mid-match.
The Rulebook Is Not Blank.
It can be tempting to treat the absence of dedicated AI legislation as legal silence. In practice, AI does not operate outside the existing legal environment.
POPIA can be relevant to personal information in training data, prompts, retrieved documents, outputs, and logs. Its familiar requirements include lawful processing, a clear purpose, using information that is adequate, relevant, and not excessive, information quality, security safeguards, and respect for people’s rights. These remain important even when the technology is new.
The useful question is therefore not only:
“May we use AI?”
It is also:
“What information is involved, why are we using it, where does it go, who can access it and can we explain the outcome?”
POPIA on the AI Playing Field
AI can make existing privacy questions more difficult to see.
Information collected for one purpose should not simply be reused for model training, prompt grounding, or profiling. A sensible starting question is whether the use case needs all the information available or only a smaller, relevant set.
Security also extends beyond the original database. Prompts, outputs, retrieval indexes, logs, connectors, and third-party services can all form part of the processing environment.
People’s rights matter too. An organization should be able to respond appropriately to applicable requests to access or correct personal information, or to delete or destroy it where the law allows. That can be difficult if the information has passed through an AI-enabled workflow, which is why good information governance should form part of the design rather than become paperwork after the final whistle.
When AI Starts Making the Call
The stakes rise when AI moves from assisting a person to making decisions about one.
Section 71 of POPIA addresses certain decisions based solely on automated processing where the decision has legal consequences for a person or substantially affects them. It expressly refers to profiling matters such as work performance, creditworthiness, reliability, location, health, preferences, and conduct, subject to its scope, exceptions, and safeguards.
This does not mean every AI-generated recommendation is prohibited. It does mean organizations should understand whether AI is supporting a human decision or effectively making the final call, and whether the human review is real rather than a rubber stamp.
Data Residency Is Only One Line on the Field
Cloud and AI services add another layer of complexity because data may be stored in one location and processed in another.
POPIA does not require all personal information to remain in South Africa. It allows cross-border transfers on specified grounds. An offshore AI service is therefore not automatically unlawful, but knowing only the location of the data center does not complete the picture.
Organizations should be able to ask:
- Where are the data, logs, indexes, and backups stored?
- Where are prompts, retrieved information and outputs processed, and are onward transfers involved?
- Who can access the information and which laws or authorities may apply?
- Who controls the infrastructure, operations, and security measures?
Data residency tells you where information rests. Data sovereignty asks whose laws, control and authority follow it. In AI environments, those may be different questions with different answers.
Compliance and Ethics: Close Cousins, Different Jobs
POPIA establishes legal requirements. Ethics asks what an organization ought to do when the law leaves room for judgement.
A use of personal information may appear legally permitted but still surprise customers, disadvantage people, or create an outcome the organization would struggle to defend publicly.
That is where ethical risk walks into the room and clears its throat.
Useful questions include:
- Would people reasonably expect their information to be used in this way?
- Could the system reproduce bias or unfairness, and can an affected person question the outcome?
- Would the organization remain comfortable with the decision if the match were reviewed later?
Trust is built on perception and experience, not legality alone.
Responsible AI Is a Team Sport
Responsible AI does not require organizations to reinvent the game. It requires clear rules, trained players, and someone accountable for the final call.
Imagine using Microsoft Copilot, or a similar assistant, to summarize customer emails and suggest a response. The time saving may be real, but so are the questions: what information did the tool use, could sensitive information reach the wrong person, and who checks the response before it is sent? The tool may assist, but accountability does not leave the field.
In practice, this usually involves:
- setting clear acceptable-use boundaries;
- limiting access and applying appropriate security controls;
- reviewing higher-impact or customer-facing uses more closely;
- documenting important decisions and providing meaningful human oversight; and
- involving legal, privacy, security, IT, and business teams early.
AI risk is rarely “just legal” or “just technical.” The pressure points generally sit where those functions intersect. Legal is therefore not merely the safety net at the end; it forms part of the design process.
Final Whistle: Play the Long Game
Technology will keep sprinting and the AI-specific rulebook will keep developing. Where personal information is involved, POPIA may already be part of the playing field.
The organizations best prepared for what comes next will not necessarily be those that moved first. They will be those that understood their information, set clear ownership, applied sensible safeguards, and kept enough of a record to explain their choices when questions followed.
Compliance is the kick-off. Governance, ethics, and accountability carry an organization through the rest of the match. The real differentiator is not simply speed, but the ability to move in a way that remains responsible, explainable, and worthy of trust.
This blog is intended for general information only and does not constitute legal advice. How POPIA or other legislation applies will depend on the facts and circumstances of each use case. Readers should obtain advice appropriate to their circumstances.
Speak to Mint about developing an AI governance approach that supports responsible innovation and POPIA readiness across privacy, technology, and security.