Source: Pinsent Masons (Out-Law)

Employers in South Africa must combine domestic employment law and the Protection of Personal Information Act (POPIA) with international frameworks to govern AI use in the workplace responsibly. POPIA — a principles-based data protection law influenced by the EU 1995 Data Protection Directive and interpreted with reference to the GDPR — establishes eight conditions for lawful processing and contains section 71, which restricts purely automated decisions that have legal or substantial effects on individuals, including profiling of performance, reliability or conduct. Section 71 provides limited exclusions where decisions arise from contract execution or are governed by law or a code of conduct, but those exclusions require “appropriate measures” including giving affected data subjects the opportunity to make representations and receiving sufficient information about the logic of automated processing.

The draft South African national AI policy endorses international instruments and standards — including OECD AI principles, ISO/IEC 42001 and the NIST AI Risk Management Framework — as benchmarks for a risk-based regulatory approach and for practical governance steps employers can adopt now. The EU AI Act is highlighted as a global benchmark, with certain employment-related AI systems classed as “high-risk” and therefore subject to stringent obligations such as risk-management systems, documentation, traceability, accuracy, robustness, cybersecurity and meaningful human oversight; emotion recognition and manipulative AI are prohibited in workplace contexts. POPIA allows employer reliance on employee consent in employment contracts (unlike the GDPR), but employers are advised to embed data-protection-by-design, data minimisation and purpose limitation at system design and align AI deployment processes with procedural fairness under employment law.