You are currently viewing The AI Dilemma: Legal Implications for Businesses in South Africa

The AI Dilemma: Legal Implications for Businesses in South Africa

In recent years, the very rapid advancement of artificial intelligence (AI) technology has transformed the business landscape significantly. South Africa, like many other countries, is witnessing a surge in AI adoption across various industries. While AI offers a lot of opportunities for businesses, it also brings forth various legal challenges and consequences.

Do you think ChatGPT is just another search engine? Or do you think AI can be the future of work? The good news is that if you were worried that AI would put you out of a job, you can relax – at least for now. However, no one really knows how AI will evolve in the future and what the world might look like. It is clear that the various AI systems such as ChatGPT are here to stay and they are becoming an everyday part of our way of doing business because whether we like it or not it does simplify the way we do business.

In this article, we will look at what the legal implications of generative AI in the workplace are and what you need to be aware of, whatever field you work in.

Data Collection

The most important developments in AI over the last couple of years have been mostly driven by machine learning which, in turn, is fuelled by data. As more and more data is being gathered, AI enables more sophisticated analysis of large data volumes. And we all know business across various industries collects data for different reasons.

In certain, very limited, instances businesses may use the data they hold for whatever reason they wish, including developing AI algorithms.  However, there are many instances where businesses are not free to use the data. An example of this would be if personal data is used to develop, train, or test AI algorithms, that processing has to be lawful and fair and comply with data protection laws.  Furthermore, if the data has to do with a third party, it might be confidential or provided under a limited license and if third parties have access to the data it can complicate data protection and confidentiality issues.

If we were to look at it from a compliance perspective, if a business creates or uses an AI system to collect data, it has to ensure that the AI system and its use thereof is compliant with various sections of the Protection of Personal Information Act 4 of 2013 (POPIA).

An example is Section 71(1) of POPIA, which governs automated decision-making. It aims to protect data subjects from being subjected to a decision that is based solely on automated decision-making, which results in legal consequences for the data subject and the data subject being profiled. What this means is that an AI system would have the ability to profile customers seeking a bank loan, for example, and determine their creditworthiness based on their income, previous loan repayments, and indebtedness. In such a scenario Section 71(1) will prohibit a bank from making a decision to grant or reject a loan application based on just the profile that was created by the AI system.

Section 57(1)(a) of POPIA further requires a responsible party to first obtain authorisation from the Information Regulator if it wishes to process any unique identifiers of data subjects for another purpose than intended at collection and with the aim of linking the information with information processed by other responsible parties. A “unique identifier” is seen as any identifier that uniquely identifies a data subject in relation to the responsible party such as an employee number or identity number.

AI systems learn and become more intuitive by gathering vast quantities of data. However, businesses must proceed with caution when the data inadvertently contains personal information. Before feeding the data into the system, the organisation should consider whether the information can be input in a de-identified form, which would exclude it from the application of POPIA.

Intellectual Property

If your business has created content that was generated by an AI system, would that content be your intellectual property? If AI is used to create original works, such as training material, articles, designs, or code, questions about copyright ownership and licensing may arise.

Situations like this have already started in the US. The US Copyright Office has been receiving applications for copyright registration of works generated by AI. It is important to mention that one registration application for a visual work created entirely by AI was rejected because “the work contained no human authorship”.

In another recent case, “the Office concluded that a graphic novel comprised of human-authored text combined with images generated by the AI service Midjourney constituted a copyrightable work, but that the individual images themselves could not be protected by copyright.”

Situations such as this have not yet been tested with the Companies and Intellectual Property Commission of South Africa, but if you want to claim work as your own, it would probably be best to ensure that it is written, drawn, or designed by a human being.


Multiple pieces of legislation relating to employment law exist in South Africa that employers must comply with. Some of these include the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, and the Employment Equity Act 55 of 1998.

The use of AI in the workplace is inevitably a very complex situation because each Act has its own requirements that must be complied with. Here are some of the factors to consider when using AI:

  1. Employment contracts and policies: Unfortunately there is no escaping the very big task of reviewing employment contracts, policies, and procedures to ensure that they address the introduction of generative AI systems. You may need to update intellectual property clauses, confidentiality provisions, and acceptable use policies in line with the AI technology you use.
  2. Training and skills development: If you wish to embed an AI system with your way of working, you need to provide training and upskilling opportunities to employees to enable them to adapt to the use of the AI system in their workplace.
  3. Workplace monitoring and privacy: Not only do you need to comply with the privacy requirements of POPIA, but you should also comply with the provisions of the Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 (RICA). This makes provision for situations where AI systems involve the monitoring of employee activities, such as analyzing communications or tracking work progress. In terms of RICA, you are obliged to make employees aware of the extent and purposes of this monitoring.
  4. Retrenchment: If the implementation of an AI system leads to restructuring or changes in job requirements within the business, as an employer you should be aware of your legal obligations. You should also know the requirements for fair retrenchment processes, compensation packages, and potential redeployment opportunities.

Contact Us

South Africa does not yet have comprehensive legislation that governs the use of AI and generative language tools like ChatGPT, unlike some other countries. However, we do have a very inclusive Constitution as well as legislation that is modern and progressive in areas such as labour, gender equality, data protection, etc. Therefore, you should ensure your use of generative AI does not breach any existing laws as it would not be a difficult task for courts to apply the current legislation to the use of AI.

If you are unsure as to whether your business is using generative AI lawfully and ethically, you should consult a legal professional. We are monitoring the use of AI in South Africa closely therefore if you have any questions on how AI might impact your business, contact us.

Please note that the information provided in this blog post is general in nature and should not be construed as legal advice.

Leave a Reply