Businesses in South Africa cannot avoid responsibility just because Artificial Intelligence (AI) made a mistake; the law holds the company, not the AI, responsible.
Although there is no comprehensive AI-specific legislation in South Africa, current frameworks already impose accountability.
If a company’s AI system causes injury, it may be held accountable under the law of delict if the claimant can demonstrate conduct, wrongfulness, blame, causation, and damage.
Crucially, an AI cannot be sued; instead, the people or organisations who created it are liable.
The reasonable person test is applicable. Due to the general awareness of AI hallucinations, neglecting to confirm results could easily be seen as careless.
The withdrawal of South Africa’s first Draft National AI Policy by Communications Minister Solly Malatsi in April 2026 served as a striking example of this idea.
The text featured fake academic citations produced by a Large Language Model (LLMs) without appropriate verification, according to an examination.
The Minister stated that such a failure is not a mere technical issue but compromised the integrity and credibility of the draft policy, and later promised consequences for the management responsible for drafting and quality assurance.
The government was held accountable for the AI’s hallucinations, which is a potent warning for any business.
Several legislative systems support this accountability.
Data messages produced by automated systems are attributed to the organisation that configured them under Section 25(c) of the Electronic Communications and Transactions Act 25of 2002.
Manufacturers and deployers are strictly liable for damages caused by dangerous products or dangers, including AI-powered technologies, under Section 61 of the Consumer Protection Act 68 of 2008.
Regardless of purpose, the company is liable if an autonomous logistics vehicle or medical diagnostic gadget malfunctions and results in harm, for example.
Additional requirements are imposed under the Protection of Personal Information Act 4 of 2013 (“POPIA”). Personal data is a major component of many AI products.
Section 71 of POPIA limits decisions based only on automated processing when they have legal ramifications for individuals, while Section 11 of POPIA mandates lawful processing.
The company, not the AI provider, is responsible to the Information Regulator if an AI system illegally gathers, maintains, or discloses consumer data.
Using AI technologies from other parties does not immediately absolve a business of accountability.
Another crucial topic is AI-related employment risks. Employers increasingly use AI for hiring, performance reviews, and employee tracking.
Businesses may be subject to lawsuits under the Employment Equity Act 55 of 1998 or constitutional equality principles if these systems result in discriminatory consequences.
AI bias is not an excuse if the business neglected to evaluate the technology’s dependability and fairness.
Similarly, the company may be subject to delictual claims or deceptive representations under the Consumer Protection Act if an AI-powered financial chatbot provides incorrect investment advice that harms customers.
Thus, the legal stance is unambiguous: corporate responsibility and human control cannot be compromised.
The withdrawal of the national AI policy itself serves as a warning that every private company is susceptible to unrestrained AI use if government institutions are.
Courts will have to look at whether AI systems were tested, monitored, and supervised with reasonable care before deployment.
For South African businesses, practical risk mitigation steps include:
- Maintaining robust human-in-the-loop (HITL) oversight for high-risk AI decisions.
- Implementing stringent output verification protocols (the policy withdrawal proves why).
- Updating vendor contracts to allocate AI risk and indemnities clearly.
- Documenting all quality assurance measures to demonstrate reasonableness in any future legal proceedings.
- Conducting regular AI audits for bias, accuracy, and POPIA compliance.
AI may assist decision-making, but in South African law, responsibility still rests with people and institutions.
*The author of this article is Alude Xuba, the founder and principal attorney of Xuba & Associates Attorneys Inc. The views expressed by Alude Xuba are not necessarily those of The Bulrushes
*Xuba is the principal attorney at Xuba & Associates, a boutique law firm specialising in business law. This is no legal advice, but general information to improve business law literacy in South Africa.
