New AI Policy in South Africa Stresses Corporate Liability for Agentic Systems

Why It Matters

Companies operating in South Africa now face direct legal and financial exposure for autonomous AI actions, forcing a strategic overhaul of AI governance and contractual risk allocation.

Key Takeaways

• Corporate directors retain non‑delegable fiduciary duties over agentic AI deployments
• Burden of proving AI system failure rests on the organisation under ECTA
• Standard vendor contracts may misalign risk with AI autonomy
• Vicarious delictual liability applies when AI causes third‑party harm
• Compliance requires defined AI authority, monitoring and human‑review safeguards

Pulse Analysis

South Africa’s emerging regulatory stance on agentic artificial intelligence marks a departure from the traditional view of AI as a mere decision‑support tool. By classifying autonomous systems as delegated authorities, the law forces companies to treat AI outputs as corporate actions, subjecting boards to fiduciary duties under the Companies Act. This shift mirrors global trends where regulators are tightening accountability for AI that can act independently, but South Africa’s explicit attribution of liability under multiple statutes—contract, delict, and data‑protection law—creates a uniquely layered risk environment for businesses.

The practical impact on enterprises is immediate. Existing technology agreements, often drafted on the assumption of human oversight, now risk being unenforceable where they exclude liability for autonomous behaviour. Companies must renegotiate vendor terms to clearly delineate the AI’s "action space" and embed indemnities that reflect the system’s decision‑making scope. Moreover, the burden of proof for system failures under the Electronic Communications and Transactions Act compels organisations to maintain robust audit trails and real‑time error‑notification mechanisms, turning compliance into a continuous operational discipline rather than a one‑off checklist.

Strategically, the policy encourages a holistic governance model that blends legal oversight with technical safeguards. Boards should institute AI‑specific risk assessments, define strict limits on autonomous authority, and ensure human‑in‑the‑loop reviews for high‑impact decisions. Aligning internal controls with the Protection of Personal Information Act and the Consumer Protection Act further mitigates exposure to fines and reputational damage. Firms that proactively adapt their AI governance frameworks will not only avoid liability but also gain a competitive edge by demonstrating responsible AI stewardship to regulators, investors, and customers.