First, the strange 2026 context
South Africa was weeks away from an AI policy. Cabinet approved the draft National AI Policy in March 2026, it was gazetted on 10 April, and on 27 April it was withdrawn after journalists found some of its academic citations simply did not exist: apparently unchecked AI-generated references, in the national AI policy. A revised draft is coming, eventually. The full timeline is on our State of AI page.
The practical upshot: for the foreseeable future, POPIA is the rulebook for AI in South Africa, alongside the Cybercrimes Act and your sector's regulations. If your AI touches personal information, the eight conditions for lawful processing apply to it exactly as they apply to your CRM.
The compliance checklist, interactive
Twelve checks the Information Regulator would care about. Tick what you have. Be honest, nobody is watching.
Automated decisions: section 71 in one paragraph
POPIA gives people protection against decisions with legal or similarly significant consequences that are based solely on automated processing intended to profile them: creditworthiness, work performance, reliability and the like. The practical fix is architectural, not legal: keep a human meaningfully in the loop for consequential decisions, log the basis of every automated decision, and give people a route to contest outcomes. If your AI declines a loan, a human must be able to explain why and overturn it.
Cross-border transfers: the LLM API question everyone asks
Most powerful AI models are hosted overseas. Send personal information to an API in the US and you have made a cross-border transfer under section 72. That is allowed when the recipient is bound by adequate protection (think binding contracts covering the eight conditions), or with consent, or where the transfer is necessary for a contract with the person.
How we handle it in practice when building platforms: sign the provider's data processing agreement and confirm no training on your data; choose regional hosting where available; minimise what leaves your perimeter, redacting or tokenising identifiers before the API call when the use case allows; and keep the authoritative data in South Africa with only the minimum context sent per request. Boring, effective, defensible.
Your AI vendor is an operator. Paper it.
Under POPIA, a vendor processing personal information on your behalf is an operator. You remain the responsible party. You need a written agreement obliging the operator to security safeguards and confidentiality, and they must notify you of any breach. This includes your chatbot provider, your transcription tool and your development studio. Any AI vendor who has not heard of operator agreements has just told you everything you need to know about them.
Five architecture patterns that keep you clean
- Minimise at the boundary. Send the model the minimum context needed per request. The best-protected data is data that never left.
- Redact before you transmit. Strip or tokenise names, ID numbers and contact details before external API calls where the use case allows.
- Log everything consequential. Every automated decision gets a logged basis, timestamp and model version. Your future self at an Information Regulator inquiry says thank you.
- Retention with a timer. POPIA requires you not to keep records longer than needed. Give AI conversation logs an expiry date on day one.
- Human override as a feature. Build the contest-and-correct flow into the product, not into a policy PDF nobody reads.
Questions people actually ask
Is it legal to use ChatGPT with customer data in South Africa?
Feeding customer personal information into a consumer AI tool is where trouble starts: you likely have no operator agreement, no control over training use, and an unmanaged cross-border transfer. Business-grade API and enterprise tiers with data processing agreements, no-training commitments and regional options can be used compliantly with the right contracts and minimisation. The tool is not the problem. The terms and the data flow are.
Does POPIA apply to AI?
Yes, fully. POPIA is technology-neutral: it regulates the processing of personal information regardless of whether a human, a spreadsheet or a large language model does the processing. If your AI touches personal information of South Africans, the eight conditions for lawful processing apply, and the Information Regulator can levy administrative fines up to R10 million for certain offences.
Can AI make automated decisions about customers under POPIA?
Not solely automated ones with legal or similarly significant effects based on profiling, subject to exceptions such as decisions made under a contract with safeguards. The safe pattern is human-in-the-loop for consequential calls, logged reasoning, and a route for the customer to contest the outcome. AI drafts, a human decides.
Do I need a POPIA impact assessment for an AI project?
A personal information impact assessment is required as part of POPIA compliance generally, and an AI project is exactly the kind of new, higher-risk processing where doing one properly protects you. It forces the right questions early: what data, what purpose, what lawful basis, what leaves the country, who can see what. An afternoon of work that de-risks a seven-figure build.
Will South Africa get an AI law soon?
A revised National AI Policy is expected after the April 2026 withdrawal, but policy is not law: even after adoption it would take years to become binding legislation. Sensible teams build to POPIA plus international good practice (the EU AI Act's risk-tier thinking travels well) rather than waiting. We track developments on our State of AI page.