Abstract
The rapid advance of digital technologies and artificial intelligence (AI) has exposed
some structural shortcomings in South Africa’s cyber law framework, in particular with
respect to privacy protection, accountability, and regulatory coherence. This
dissertation seeks to shed a critical light on the capabilities of South Africa’s legal and
policy environment to guide AI and data-driven systems and whether it will be able to
deal effectively with future technological risks depending on existing instruments.
There is an argument that South Africa’s regulatory framework contains fragmentation,
limited institutional capacity and relies heavily on policy-led governance mechanisms
which are not legally binding. Although laws including the Protection of Personal
Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions
Act 25 of 2002 (ECTA) and the Cybercrimes Act 19 of 2020 offer basic rules of cyber
governance, they are not developed to control AI systems holistically. It leaves
significant gaps in algorithmic accountability, transparency and proactive risk
management. Research indicates existing laws are more reactive, and thus, cannot
offer the potential for intelligent AI-powered systems to overcome the complexities
associated with automated decision making and cross-border data flows. Additionally,
institutional fragmentation and capacity limitations undermine the enforcement
mechanisms and weaken the legal protections themselves.
Through a comparative analysis of the European Union’s (EU) legal framework,
particularly the General Data Protection Regulation (GDPR) and the Artificial
Intelligence (AI) Act, this dissertation examines how risk based regulatory models and
institutional coordination mechanisms might inform South Africa’s developing
approach to AI governance. The analysis shows that although comparative
perspectives offer valuable guidance, foreign regulatory models cannot simply be
transplanted into the South African context without careful adaptation.
The dissertation ultimately argues that South Africa needs a coherent and integrated
regulatory framework for AI. Such a framework should be grounded in enforceable
legal standards, adopt a risk-based approach, strengthen institutional capacity, and...