South Africa: POPIA AI Governance Challenges Persist Amidst Enforcement Progress

• South Africa's Information Regulator is actively enforcing the Protection of Personal Information Act (POPIA), exemplified by a R1 million fine against FNB for data breaches.
• While POPIA compliance has improved, challenges remain regarding its alignment with international standards and its protection for juristic persons.
• AI governance is identified as a critical emerging regulatory challenge, with a suggestion for a dedicated AI governance institute to complement the Information Regulator's role.
• Experts warn that AI without proper governance poses a significant cybersecurity risk, emphasizing the need for human accountability and board-level oversight.
• Building trust in AI systems and ensuring accountability for their consequences are paramount for responsible innovation and mitigating associated risks.

Trust is when we introduce technology, we understand that we are accountable for the consequences.

South Africa has demonstrated notable advancements in its digital security and data protection legislative framework, though significant challenges persist, particularly concerning the oversight and regulation of artificial intelligence. This assessment emerged from the recent ITWeb Governance, Risk and Compliance 2026 event held in Bryanston, Johannesburg, where experts convened to discuss the evolving landscape.

Sizwe Snail ka Mtuze, a professor of cyber law at Nelson Mandela University and managing director of Snail Attorneys, provided insights into the **Protection of Personal Information Act (POPIA)**. He highlighted that five years after its full implementation, **POPIA enforcement South Africa** is beginning to yield concrete results. Mtuze characterized the legislation as robust and effective, noting a more proactive approach from the **Information Regulator (InfoReg)** in its enforcement activities.

A clear illustration of this heightened regulatory vigilance is the R1 million administrative fine levied against First National Bank (FNB). The InfoReg imposed this penalty after determining that FNB had violated multiple provisions of **POPIA** following an incident that compromised client data. Mtuze emphasized that this action demonstrated the regulator's resolve to assert its authority. He further observed that courts have been active, indicating substantial progress in **POPIA** compliance, especially within the private sector. However, the legislation still faces hurdles, including ensuring it remains current with international standards like the GDPR and addressing its scope concerning the data protection of juristic persons, such as companies and trusts, in addition to individuals.

Amidst the progress in data protection, the governance of artificial intelligence emerged as a prominent regulatory challenge during the discussions. Dr. Cordell Robinson, CEO of Brownstone Consulting Firm, issued a stark warning, stating that AI operating without proper governance poses the next major cybersecurity crisis. He underscored the indispensable role of human accountability within any effective governance strategy.

Addressing the question of future **AI regulation South Africa**, Mtuze suggested that the InfoReg should not be tasked with the additional responsibility of becoming an AI regulator. Instead, he proposed the establishment of a dedicated AI governance institute, which could effectively complement the existing functions of the Information Regulator. This approach aims to create specialized oversight for the complex and rapidly evolving domain of AI, acknowledging its distinct regulatory needs.

Dr. Robinson elaborated on the critical importance of trust in the burgeoning AI-driven digital and data economy. He identified trust—in organizations, institutions, systems, and decisions—as the most coveted commodity. Organizations, he argued, must transition from merely adopting AI to cultivating 'trusted intelligence,' recognizing that cybersecurity increasingly involves safeguarding decisions made by or with AI systems. Governance in the context of AI, according to Robinson, necessitates a deep understanding of associated risks, clear identification of accountable parties, and a readiness to stand behind AI-driven decisions.

Robinson articulated a fundamental principle: "Trust is when we introduce technology, we understand that we are accountable for the consequences." He clarified that the objective is not to impede AI adoption, as responsible deployment of the technology offers substantial benefits across sectors like customer service, fraud detection, healthcare, finance, education, and government. However, he posed crucial questions regarding **AI governance risks SA**: Who governs the algorithm? Who owns, approves, validates, and monitors it? Who bears accountability when it errs or is manipulated? And, perhaps most critically, who possesses the authority to shut it down? Robinson concluded that "AI without authority is just software. With authority, it becomes an organisational actor."

The multifaceted nature of risks introduced by AI demands comprehensive **board-level oversight**, as highlighted by Dr. Robinson. He stressed that the responsibility for AI governance cannot be fully delegated to specific departments or roles, such as the CISO, CIO, legal, or compliance teams alone. Instead, it requires a broader, integrated approach from leadership. Robinson advised organizations to engage in a rigorous self-assessment by asking five key questions to ensure robust governance.

Furthermore, Robinson pointed to a significant opportunity for the African continent to assume a leadership role in developing and implementing trusted AI, rather than merely being a consumer of the technology. He encapsulated the essence of effective **AI governance risks SA** management with a powerful formula: 'AI plus capability plus authority minus governance equals unmanaged risk… AI plus governance plus security plus human accountability equals trusted innovation.' This framework underscores the necessity of integrating governance, security, and human oversight to unlock the full potential of AI responsibly.

Lawyers should advise clients on the heightened enforcement of POPIA, exemplified by the FNB fine, and proactively address emerging AI governance risks. They must prepare for potential new AI-specific regulations and ensure board-level oversight for AI strategies to mitigate compliance exposures.

Source: Original reporting via ITWeb Governance, Risk and Compliance 2026 event