Artificial intelligence (AI) has rapidly evolved from a specialised technology used primarily by technology companies into a mainstream business tool. Generative AI is now routinely used to draft documents, analyse information, create marketing content, support customer service functions, screen applications, conduct due diligence, develop software, and automate business processes. As organisations increasingly rely on generative AI and other AI-driven tools, it is becoming essential for commercial contracts to address the risks arising from their use.
Given the extent to which AI has become embedded in modern business operations, traditional contractual provisions dealing with confidentiality, intellectual property, data protection, warranties, indemnities, and limitations of liability may no longer be sufficient on their own. AI-specific contractual provisions are therefore emerging as an important risk management mechanism.
South Africa does not currently have a dedicated and comprehensive legislative framework specifically governing AI. However, existing legislative and regulatory frameworks may apply where AI is deployed, depending on the nature and purpose of the technology. These include the Protection of Personal Information Act 4 of 2013 (“POPIA”), the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008, the Competition Act 89 of 1998, intellectual property legislation, employment legislation, and various sector-specific regulatory frameworks.
A draft National AI Policy published in 2026 was later withdrawn to allow further development and consultation on national standards for the ethical use of AI. This development underscores the importance of ensuring that commercial agreements adequately address:
- The extent to which AI may be deployed, used, and relied upon, if at all.
- The nature and scope of any consents required from contractual parties where AI is used in the performance, administration, or enforcement of contractual obligations.
- Specific parameters governing the permissible use of AI, including measures required to protect sensitive information, personal information, confidential information, and other data processed through AI systems.
Many service-level agreements and commercial contracts already include provisions relating to confidentiality, cybersecurity, intellectual property, data protection, and warranties. However, these provisions were generally drafted on the assumption that contractual obligations would be performed by human actors or relatively predictable software systems. AI introduces a different set of risks, many of which require specific contractual consideration.
Risks associated with the use of AI in a commercial context include:
- AI systems generating inaccurate, incomplete, or misleading outputs.
- Confidential information being submitted, intentionally or inadvertently, to third-party AI platforms.
- Personal information being processed by AI models, service providers, or subcontractors.
- AI-generated content giving rise to intellectual property disputes or infringement claims.
- AI systems making, or materially influencing, decisions that affect individuals.
- AI providers changing their models, training methodologies, or terms of service without meaningful customer input.
- AI providers processing information outside South Africa in circumstances that may conflict with POPIA’s cross-border information transfer requirements, including those contained in section 72 of POPIA.
Another significant concern is how responsibility and accountability are allocated when AI-generated outputs result in financial loss, reputational harm, regulatory breaches, or other adverse outcomes. A central question for contracting parties is who bears the risk when AI is used to perform contractual obligations, particularly where the technology contributes to an error, omission, or unintended consequence.
Where contracts are silent on these issues, parties may find themselves involved in lengthy, costly, and complex disputes. By contrast, a well-drafted agreement can establish a clear framework for allocating responsibility, managing risk, and defining the rules governing AI use while the regulatory landscape continues to evolve.
As AI adoption continues to accelerate, organisations should proactively review their existing agreements and contracting practices to ensure they remain fit for purpose. Businesses that address AI-related risks during the contracting process are likely to be better positioned to protect their interests, maintain regulatory compliance, and reduce uncertainty in an increasingly AI-driven commercial environment.
Disclaimer: This article is the personal opinion/view of the author(s) and does not necessarily present the views of the firm. The content is provided for information only and should not be seen as an exact or complete exposition of the law. Accordingly, no reliance should be placed on the content for any reason whatsoever, and no action should be taken on the basis thereof unless its application and accuracy have been confirmed by a legal advisor. The firm and author(s) cannot be held liable for any prejudice or damage resulting from action taken based on this content without further written confirmation by the author(s).