By Jaco Fraser – Associate | Commercial
This email address is being protected from spambots. You need JavaScript enabled to view it.
The rapid adoption of artificial intelligence (“AI”) across South African businesses has brought a familiar legal question into sharper focus: What standard of care do directors owe when a company deploys AI systems? The answer lies in the interaction between section 76 of the Companies Act 71 of 2008 (the “Act”) and the expectations set by King V.
Section 76 requires a director to exercise the powers and perform the functions of a director:
- in good faith and for a proper purpose;
- in the best interests of the company; and
- with the degree of care, skill and diligence that may reasonably be expected of a person conducting the same functions in relation to the company and having the general knowledge, skill, and experience of that director.
The Act does not create a separate duty for technology or AI. It does, however, require directors to apply an informed and careful standard to AI-related risks and opportunities, just as they would to any other material business decision.
King V Principle 10: Elevating technology and AI to board level
King V, which applies to financial years commencing on or after 1 January 2026, places data, information, and technology under a dedicated principle. Principle 10 requires the governing body to govern data, information and technology in a way that enables the organisation to sustain and optimise its strategy and objectives.
In relation to AI, the recommended practices include:
- promoting ethics, human-centricity, accountability, transparency, explainability, security, privacy, fairness, and trustworthiness;
- establishing clear accountability for automated decisions, actions, outputs, and outcomes; and
- ensuring appropriate human oversight and override mechanisms, proportionate to the risk posed to the organisation and its stakeholders.
The required level of oversight will depend on the use case. A low-risk internal chatbot will not require the same controls as a system used to assess credit applications, screen job candidates, or generate client-facing advice. Boards should be able to show that their approach was calibrated to the relevant risk.
Although King V is not legislation, the King Codes may assist a court in assessing what constitutes reasonable governance practice. Ignoring Principle 10 after an AI-related incident could therefore be relevant to whether directors took reasonably diligent steps to become informed.
A practical illustration: The withdrawn national AI policy
The withdrawal of South Africa’s Draft National AI Policy in April 2026, after fictitious sources were identified in the document, illustrates the risk of relying on AI-generated material without adequate human verification. The incident resulted in public scrutiny and reputational harm.
The lesson for boards is straightforward: AI output should not automatically be treated as accurate or final. The level of human review should reflect the possible consequences of an error.
Recommended board-level actions:
Directors who wish to discharge their duties responsibly in relation to AI should consider the following practical steps:
- Adopting an AI governance policy: This should identify permitted and prohibited uses, required review levels, escalation procedures, and approval requirements for material AI deployments.
- Requiring regular reporting: Management should report on material AI systems, key risks, incidents, near-misses, and the effectiveness of controls.
- Recording board consideration: Minutes should reflect that AI-related risks and controls were considered.
- Reviewing insurance: Directors should confirm whether insurance responds to AI-related claims, data misuse, algorithmic bias, and regulatory action.
- Building technological literacy: Directors need not become data scientists but should be able to ask informed questions and assess the answers received.
AI does not create a new category of directors’ duties. It applies the existing section 76 standards to a new and rapidly developing class of risk. Directors who adopt proportionate controls, receive regular information, and record their deliberations will be better positioned if an AI system causes harm or regulatory difficulty.