AI regulation and enterprise readiness: POPIA, the EU AI Act and what boards must document

Enterprises tend to approach AI regulation as a forecasting problem. Which rules will apply, when, and in what form. It is an understandable instinct and a poor use of effort, because the readiness posture that serves you is largely the same under every regime currently drafted or in force. Regulators are converging on the same four demands: know what you are running, classify it by the harm it could cause, name someone accountable, and be able to show a human can intervene.

An organisation that can satisfy those four demands is ready for most of what is coming. An organisation with an elegant policy and no inventory is not, whatever the policy says.

POPIA, and why purpose limitation bites first

For South African enterprises, POPIA is the operative instrument and it did not need amending to cover AI. Its principles apply to any processing of personal information, and three of them do most of the work in an AI context.

• Purpose specification. Personal information collected for one purpose is not automatically available for another, which is where model training programmes most often run into difficulty. Data gathered to service a customer is not, without more, training data.
• Minimality. Processing must be adequate and not excessive, which sits awkwardly with the instinct to give a model access to everything and let retrieval sort it out.
• Accountability. The responsible party carries the obligation. A vendor’s assurances do not transfer it, and contractual comfort is not a compliance position.

Section 71 deserves separate attention because it is the provision most directly about automated decisions. Where a decision resulting in legal consequences for a data subject, or affecting them to a substantial degree, is based solely on automated processing, the data subject has rights that constrain how the decision may be made. The practical consequence is straightforward: a documented, genuine human review step in the decision path is worth considerably more than an argument about whether the processing was solely automated.

Cross-border processing under section 72 is the other frequent trigger, and it is one of the more common reasons enterprises decide to keep inference inside the country rather than negotiate the transfer position.

The EU AI Act, including for enterprises outside the EU

The AI Act applies extraterritorially in a way that catches organisations that do not think of themselves as EU-facing. Providers and deployers established outside the Union can fall in scope where the output of an AI system is used in the Union. An African enterprise serving EU customers, or supplying an EU group company, should assume it needs to answer the classification question.

Obligations are phased rather than arriving at once, with prohibited practices and AI literacy duties applying first, general-purpose model obligations following, and the substantial high-risk system requirements landing later. That phasing is a planning gift: it means classification work done now determines how much of the later burden actually applies to you.

Most enterprise AI sits in the bottom two rows. The programmes that get expensive are recruitment, credit and access-to-service use cases, and those are worth identifying deliberately rather than discovering during a classification exercise conducted under time pressure.

Standards: which one, and when

Two instruments matter and they serve different purposes. ISO/IEC 42001 is a certifiable management system standard, so it suits organisations that already run ISO management systems and that will need to demonstrate their arrangements to a third party. The NIST AI Risk Management Framework is not certifiable, but it maps risks to functions in a way that is genuinely more useful while you are designing controls.

The common pattern is to think in NIST terms during design and present in ISO structure when an external party needs assurance. What we would advise against is adopting either before you have one deployed use case, because frameworks applied to hypothetical systems produce hypothetical controls that nobody can operate.

In South Africa there is a third instrument that is often more useful than either: King IV, and specifically Principle 12 on technology and information governance. It is the language your board already speaks. Positioning AI oversight inside it, rather than as a new risk category requiring new machinery, shortens the approval path substantially.

What a board must be able to produce

Strip away the frameworks and a defensible position reduces to a small number of documents that can be produced on request. If these exist and are current, most regulatory engagements start from a position of credibility.

1. A register of AI systems: what each decides, what data it reads, who owns it, and whether it can act without approval.
2. A classification for each system against whichever regime applies, with the reasoning recorded.
3. Evidence that a human can intervene in any decision affecting an individual, and a record of when that has happened.
4. Evaluation results over time, showing that quality is measured rather than assumed.
5. An incident record, including things that went wrong and what changed as a result.
6. A decision-rights document showing who approved what, and who can withdraw approval.

A readiness sequence

1. 01

   Inventory, with amnesty

   Find what exists, including unapproved tools. Amnesty produces accurate data; enforcement produces a clean register that is wrong.

2. 02

   Classify by potential harm

   Sort by effect on individuals rather than by technical sophistication. A simple rules engine that declines applications matters more than a sophisticated model that drafts internal notes.

3. 03

   Name owners

   One accountable individual per system, in the business. Systems with no owner are either retired or adopted, and both outcomes are progress.

4. 04

   Prove human intervention

   For anything affecting individuals, document the intervention path and test it. An untested path is an assertion.

5. 05

   Then choose a framework

   With the register in hand, framework selection becomes a short exercise rather than a strategic debate.

None of this requires predicting the regulation, which is the point. It requires knowing your own estate, which you should want regardless of what any legislature does next.