South Africa has made progress in digital security and data protection legislation, but challenges remain, particularly around the governance and regulation of AI.
This was a key takeaway from the ITWeb Governance, Risk and Compliance 2026 event, held yesterday in Bryanston, Johannesburg.
Sizwe Snail ka Mtuze, professor of cyber law at Nelson Mandela University and MD of Snail Attorneys, provided an overview of the Protection of Personal Information Act (POPIA).
Mtuze said that, five years after coming fully into effect, POPIA was beginning to deliver results. He described it as strong and “a great piece of legislation”, adding that the Information Regulator (InfoReg) was taking a more proactive approach to enforcement.
Citing the recent R1 million administrative fine imposed on First National Bank (FNB), after the regulator found that the bank had contravened multiple provisions of POPIA following an incident in which clients’ data was compromised, Mtuze said the regulator “had pressed to show its teeth”.
“The courts have been busy...POPIA compliance has come a long way, especially within the private sector,” he noted.
However, challenges remain. These include concerns about whether POPIA has kept pace with international legislation such as the General Data Protection Regulation (GDPR), as well as its provisions for the protection of data belonging to juristic persons, including companies, trust funds and organisations, rather than only private individuals.
AI governance also featured prominently in discussions about regulatory challenges. Mtuze said the InfoReg should not also become an AI regulator. He suggested that establishing an AI governance institute could complement the regulator's existing role.
Risk of AI without governance
In his opening keynote address, Dr Cordell Robinson, CEO of Brownstone Consulting Firm, said AI without governance posed the next cyber security crisis. He stressed that human accountability was critical to any governance strategy.
Dr Robinson said trust was the most sought-after commodity in the AI-driven digital and data economy, including trust in organisations, institutions, systems and decisions.
He said organisations needed to move from AI to trusted intelligence, adding that cyber security was increasingly about protecting decisions.
Governance in the context of AI, he said, involved understanding risk, identifying who was accountable and being prepared to stand behind decisions.
“Trust is when we introduce technology, we understand that we are accountable for the consequences.”
Robinson said the goal was not to slow AI adoption. Organisations that used the technology responsibly could benefit in areas such as customer service, fraud detection, healthcare, finance, education and government.
“But who is governing the algorithm? Who owns it? Approved it? Validated it? Monitors it? Who is accountable when it is wrong, or manipulated? … and perhaps the most important question of all – who can shut it down? AI without authority is just software. With authority, it becomes an organisational actor,” he added.
Robinson said AI brought together multiple areas of risk and therefore required board-level oversight. Responsibility for its governance could not be delegated entirely to the CISO or CIO, legal or compliance teams.
He advised organisations to ask five questions:
- Do we know where AI exists?
- What data does each system touch?
- What authority does it have?
- Can we explain and defend its decisions?
- Can we stop it?
Robinson said Africa had an opportunity to take a leading role in trusted AI.
“There’s an opportunity to lead, not just consume,” he added. “AI plus capability plus authority minus governance equals unmanaged risk… AI plus governance plus security plus human accountability equals trusted innovation.”
Share
