The South African Bureau of Standards (SABS) has published a series of draft standards on artificial intelligence (AI) for public comment.

The drafts adopt international ISO/IEC standards as South African documents, and cover transparency, data quality, human oversight, and the benefits and environmental impact of AI. While the standards are voluntary, they are likely to become the local benchmark for responsible AI, in line with international best practice, creating alignment between South Africa and global standards.

Interested parties, including organisations that develop or use AI, may submit comments by 10 November 2026.

The SABS has published draft standards, technical specifications and technical reports governing the use of AI in South Africa.

The drafts were prepared by the SABS Technical Committee on Information Technology and Artificial Intelligence (SABS/TC 001/SC 42), which has proposed that the documents should become South African standards, technical reports and technical specifications.

Each draft is an identical adoption of an existing ISO/IEC document on artificial intelligence, without local changes. In other words, the international text is replicated in the South African documents.

The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) are independent international bodies that develop standards through experts nominated by ISO member bodies. Their joint AI committee is ISO/IEC JTC 1/SC 42, which the local SABS committee mirrors. Because ISO/IEC standards are developed by consensus across many countries, they are widely recognised by regulators, investors and business partners, and are often used as a reference point for good practice.

The identical adoption of ISO/IEC standards is a worldwide norm. It promotes conformity with international benchmarks used by trading partners, and enables smaller countries to benefit from the work done by experts from many countries, rather than each country writing its own standards, promoting international consistency and certainty.

The drafts seek to create voluntary standards and specifications for organisations deploying AI, in the following four areas:

• Transparency (SANS 12792 / ISO/IEC 12792:2025): This sets out a common structure for the information that should be disclosed about an AI system, covering the system itself, the underlying model, the datasets used and the wider societal and environmental context. The aim is to help developers, deployers, auditors, authorities and end users understand how an AI system works, what it is meant to do and what its limits are.
• Data quality (SANS 2620 Parts 1, 2, 3 and 5 / ISO/IEC 5259-1, -2, -3 and -5): Data quality is critical to reliable AI, because AI systems learn from data sets. These parts set out key concepts and the data life cycle, measures for data quality characteristics such as accuracy, completeness and representativeness, requirements for managing data quality across the life cycle, and a governance framework for boards and management to direct and oversee data quality.
• Human oversight (SATS 8200 / ISO/IEC TS 8200:2024): This deals with the controllability of automated AI systems. It sets out a framework so that a human or other controller can monitor the state of an AI system and take over control when needed, with different levels of controllability and steps to test that these controls work.
• Benefit and environmental impact (SATR 24030 / ISO/IEC TR 24030:2024 and SATR 20226 / ISO/IEC TR 20226:2025):
  • The use case report collects 81 real-world AI use case summaries across sectors such as fintech, e-commerce, energy, agriculture, education, healthcare, insurance, manufacturing, media and entertainment, security and transport.
  • The environmental report gives an overview of the environmental footprint of AI systems across their life cycle and supply chain, including energy use, carbon, water and e-waste, and maps possible metrics and actions to reduce that impact.

Such standards are not legally binding (unless they have been made compulsory, for example by being referenced in law). Rather, they create voluntary standards which organisations can choose to adopt to improve quality, safety, transparency and the like, in accordance with the standards developed by internationally recognised experts.

How to comment

Anyone can comment on the draft standards by 10 November 2026, by email to dsscomments@sabs.co.za.

Comments must be submitted using the SABS commenting template (SABS_commenting_template.doc), with reference to the SABS User Guide.

The post SABS publishes draft AI standards for public comment appeared first on Werksmans Attorneys.

Artificial intelligence (AI) is ubiquitous, and the gambling and betting sector is no exception. AI is increasingly embedded in gambling and betting products and platforms. The question is not whether to engage with AI, but how to develop, deploy, use and regulate it effectively and responsibly. The policy and regulatory choices made now will influence whether AI is ultimately used to protect consumers or to exploit them.

For gambling operators, AI presents significant opportunities, from processing live information and developing advertising campaigns to creating new features, applications and games. But it also introduces regulatory challenges and risks. AI could support player safety, but it also has the potential to intensify harmful gambling behaviours.

Algorithms allow operators to understand player behaviour and preferences with growing precision. This enables tailored content, services and advertising, while potentially improving the player experience, reducing choice overload, improving stickiness and reducing churn.

AI can also be a powerful responsible-gaming tool, particularly online. Several studies have used player-tracking data and machine-learning models to predict problem gambling using behavioural and monetary indicators. The results have been promising and can inform targeted interventions, including personalised approaches to problem gambling.

Research in France illustrates how this can work. In 2015 and 2016, the French National Gambling Authority, then known as ARJEL, now ANJ, partnered with researchers to develop an online gambling harm-detection system using demographic and behavioural data. The resulting machine-learning models proved highly effective at classifying people by risk level, demonstrating how such research can inform harm-reduction strategies for online gambling.

AI remains an imperfect and developing technology. A key challenge is whether AI systems treat people fairly. AI can perpetuate and exaggerate human biases and inequities, including those based on socio-demographic characteristics. It can hallucinate. Its performance can change over time because of “drift”. It can also simply get things wrong.

AI raises distinct concerns in the gambling context. For example, research has found that large language models repeatedly made irrational, high-risk betting decisions in simulated gambling environments. Because AI systems learn from human-generated data, they can inherit cognitive distortions such as the gambler’s fallacy.

All of this creates a challenge for regulators. South African gambling legislation was drafted for a bricks-and-mortar world. South Africa does have laws protecting consumers in areas including data protection, consumer protection, competition, copyright and cyber law. But it does not yet have AI-specific laws of general application.

Internationally, different approaches are beginning to emerge. The EU AI Act establishes a risk-based classification framework for AI systems. It does not single out gambling, but AI systems used in gambling that fall within high- or limited-risk categories will trigger obligations.

The UK has adopted a cross-sectoral, principles-based approach rather than a single horizontal AI Act. Individual sector regulators, such as the UK Gambling Commission, must apply AI governance principles within their respective domains.

Malta is particularly proactive on this issue. Following consultations earlier this year, on 18 September 2026 the Malta Gaming Authority launched its AI Gaming Charter. The Charter is a sector-specific framework promoting the ethical and responsible use of AI across gaming platforms. It provides a voluntary, principles-based framework to support the responsible, transparent and proportionate use of AI across gaming operations, and practical guidance tailored to the realities of the gaming sector.

In line with the risk-based approach adopted in the EU, the Charter applies a risk-based approach, in which the level of documentation, testing, governance, transparency, human oversight and monitoring applied to an AI system should reflect the nature of the use case and its potential impact on players, player rights, gaming integrity, or regulated outcomes.

The Charter sets out the following principles, which are mapped to the EU AI Act and GDPR, and which are intended to respond directly to the practices, gaps and emerging risks observed across the gaming sector:

• Transparency, accountability and explainability
• Fairness and non-discrimination
• Environmental sustainability
• Data protection, security and governance
• Human oversight and responsibility
• Reliability, safety and robustness
• Compliance, monitoring and AI governance
• Reporting and metrics
• Notification requirements
• Involvement of the Malta Gaming Authority and the Malta Digital Innovation Authority

Existing gambling laws in South Africa and across Africa were not designed for AI. The regulatory gap is real and growing, and the faster AI develops, the harder that gap will be to close.

The post AI and gambling, the regulatory gap is growing appeared first on Werksmans Attorneys.

Artificial Intelligence (AI) is rapidly moving from answering questions to taking actions on our behalf. This emerging form of AI, often called agentic AI, can independently perform tasks such as sending emails, deleting files, or modifying customer accounts. It can also be tricked into following malicious instructions hidden in emails, documents, or websites. This vulnerability is known as prompt injection. This creates a new challenge for incident response. What happens when technology authorised to act becomes the source of harm? As AI gains autonomy and attackers find new ways to exploit it, incident response plans must evolve. Organisations must now prepare for incidents in which AI may cause, facilitate, or amplify a security breach.

Recent Developments

Recently, during an internal cybersecurity evaluation, OpenAI’s AI agents broke free of their controlled testing environment, accessed the internet indirectly, communicated with each other through an improvised messaging board, collaborated and delegated tasks to each other, breached another company’s systems, and carried out over seventeen thousand actions over four days before anyone noticed. The AI agents were not directed to do this, and no human hacker was involved. The agents, which sometimes referred to themselves as a “swarm” or “collective”, simply determined that the fastest route to their objective lay outside the boundaries they had been given.

At the same time, indirect prompt injection is reported to now rank as the top AI security vulnerability globally, with attacks reportedly increasing by 340% year on year. Earlier this year, a financial services company discovered that their customer-facing AI agent had been leaking internal pricing data for three weeks after an attacker tricked it into ignoring its system prompt.

These incidents show that AI agents can fail in two ways: they can depart from their instructions on their own, or be manipulated by outsiders into taking unauthorised actions.

What Makes An AI Incident Different?

Organisations may view AI incidents through the lens of familiar AI errors such as hallucinations or biased results. But AI errors are passive mistakes that do not spread or escalate.

Autonomous misbehaviour is what happened at OpenAI. The AI agent takes deliberate, connected actions in pursuit of its goal using methods nobody anticipated or authorised. The cause is internal: a misalignment between the AI’s objective and its chosen method. Indirect prompt injection is the mirror image. An external attacker steers the AI off course by hiding malicious instructions in content it processes. The agent follows the attacker’s instructions believing them to be legitimate.

The critical distinction is agency. AI agent incidents are active, not passive: the agent acts, observes the result, decides what to do next, and acts again. An agent with access to email, databases, or payment systems can send data to external servers, grant unauthorised access, or transfer funds, all using its own legitimate credentials, which means traditional security tools may not flag the activity as suspicious. By the time the deviation is noticed, the damage may already be widespread.

One Event May Trigger Several Legal Incidents

A single AI incident can trigger multiple legal obligations simultaneously. Consider an AI agent deployed to manage customer queries that is compromised through prompt injection and begins extracting customer personal information. That single event may simultaneously constitute:

• a security compromise under POPIA, triggering notification obligations to the Information Regulator and affected data subjects;
• a cybersecurity incident requiring reporting to the Prudential Authority, FSCA, or South African Reserve Bank (for payment system participants, within 24 hours);
• a potential cybercrime under the Cybercrimes Act, which applies regardless of whether the perpetrator is human or AI;
• a contractual breach of service agreements, data processing agreements, or supplier contracts; and
• a consumer or operational incident engaging consumer protection and operational risk management requirements.

Organisations cannot treat an AI incident as a single problem with a single response. It may require simultaneous notifications to different regulators under different timelines.

The Governance Gaps

Detection. Traditional cybersecurity monitoring detects known threat patterns such as malware signatures, abnormal logins, or unusual network traffic. But an AI agent may use its own legitimate credentials to access permitted systems, performing the actions it was designed to perform, while pursuing its objective through unauthorised means. Anthropic discovered that three of its AI models had breached three separate organisations during testing, and two victim organisations had no idea. Organisations must consider whether their monitoring distinguishes between an AI agent performing its assigned task and one that has deviated from it.

Authority to stop. When a traditional cybersecurity incident is detected, the response is straightforward: isolate the system, revoke credentials, shut down the service. An AI agent incident is more complicated. The agent may be performing a business-critical function midway through a complex task. Following the OpenAI incident, the United States proposed an AI Kill Switch Act. But a kill switch is only useful if someone knows when they are authorised to use it. Organisations need predefined authority: who can act, what criteria trigger action, and who decides when the situation is ambiguous.

Notification. As noted, an AI incident may trigger simultaneous notification obligations under different timelines. Mapping these obligations in advance reduces delays when a crisis occurs.

The AI Incident Response Plan Your Business Now Needs

Most organisations have cybersecurity incident response plans, but few account for AI agents. The following framework is a practical starting point:

1. Inventory AI agents. Identify every AI system that can take action (not just generate content), including those embedded in third-party software. Document what each agent can access and is authorised to do.
2. Apply least privilege. Limit each AI agent’s permissions, tools, data access, and external communication to the minimum necessary.
3. Update incident classification. Include AI-specific scenarios, such as an agent exceeding its authorised scope, prompt injection compromises, unauthorised system access, and actions technically within permissions but contrary to intended purpose.
4. Implement AI-aware monitoring. Track not just what the AI agent is doing but why. Monitor instructions, tool calls, transactions, and unusual behaviour.
5. Define decision-making authority. Identify who can investigate, escalate, and shut down an AI agent, with predefined thresholds for each level of response.
6. Map notification obligations. For every regulator, stakeholder, and contractual counterparty, document the legal basis, timeline, required content, and responsible person.
7. Audit AI provider contracts. Ensure contracts address permitted actions, monitoring, incident definitions, notification timelines, and liability allocation.
8. Enforce technical controls. Wherever possible, enforce boundaries through network isolation, access restrictions, and real-time termination capability, not just policy.
9. Test the plan. Run tabletop exercises simulating AI-specific scenarios, including agents acting within permissions but pursuing objectives in unauthorised ways, and multiple legal obligations triggered simultaneously.

Third-Party Accountability

Many organisations procure AI agents from third-party providers. When the AI goes wrong, whose incident is it? The organisation that deploys the AI agent and gives it access to its systems, data, and customers remains accountable. This is consistent with POPIA’s principle that a responsible party cannot escape its obligations by delegating to an operator.

Contracts with AI providers should address permitted actions, monitoring responsibilities, incident definitions, notification timelines, and liability allocation.

Conclusion

Businesses are rapidly deciding what their AI agents may do, and must equally decide what happens when an agent does something it was never expected or permitted to do. If nobody is monitoring the agent, nobody is authorised to stop it, and nobody knows whether the incident must be reported, the organisation has not delegated a task, it has delegated risk.

The events of July 2026 moved AI risk from the theoretical to the actual. AI agents that can reason, act, and adapt are now capable of causing real harm, not through malice, but through pursuit of their objectives. Prompt injection attacks are turning AI agents into unwitting tools for external attackers, and this threat is growing rapidly.

For South African organisations, the regulatory landscape is already in place: POPIA, the Cybercrimes Act, the Joint Standard for financial institutions, and sector-specific obligations all apply. What remains to be determined is whether your organisation is ready to meet its obligations when the incident is caused by your own AI system.

The post When AI becomes the incident: From rogue agents to prompt injection – Is your organisation ready to detect it, stop it and report it? appeared first on Werksmans Attorneys.

Regulatory change does not wait for a bill to become law before it starts to matter. Long before the Electronic Communications Amendment Bill [B12-2026] (“the Bill”) takes effect, it should already be shaping investment decisions, transaction planning, regulatory engagement and corporate strategy. Businesses considering acquisitions, infrastructure investment, market expansion or long-term commercial arrangements in the communications sector should not treat the Bill as a future compliance exercise to be assessed only once the parliamentary process has run its course. If enacted substantially in its current form, the Bill could reshape the commercial, investment and regulatory landscape of South Africa’s electronic communications sector. Now is the time to test whether existing commercial assumptions still hold in a regulatory environment that could look very different within a few years. The six questions below are a starting point.

1. Should we reconsider our long-term investment assumptions?

The Bill’s essential facilities provisions may affect the revenue assumptions behind infrastructure valuations, though how much will depend on the pricing rules and methodology ultimately prescribed by the Independent Communications Authority of South Africa (“ICASA”). Under the proposed s43(8), ICASA must compile a list of essential facilities, which could include high sites, cable landing stations, backhaul infrastructure, earth stations, ducts in road and rail reserves, municipal infrastructure and internet peering points. Once a facility is on that list, its holder must lease it out on request, subject to the applicable statutory requirements. The proposed s47 goes further, mandating (rather than merely empowering) ICASA to ensure that wholesale pricing is “cost-oriented” and, for essential facilities, reflects “cost plus a reasonable return”. The latter term is not defined in the Bill, but it is worth determining whether infrastructure investment still generates the returns assumed in current acquisition models. If regulated pricing pushes those returns down, some long-term investment cases may need to be reassessed.

The rapid deployment provisions in the Bill may ease the cost side of the equation. The proposed s21A requires the Minister responsible for local government to make standard draft municipal by-law covering, among others, uniform wayleave processes, cost-based fees and the terms and conditions for sharing municipal property and infrastructure. If municipalities apply it consistently, this could reduce deployment delays and the cost of extending facilities into underserved areas.

2. Should we revisit our planned transactions?

Regulatory due diligence in telecommunications transactions has traditionally focused on a target’s existing licences, compliance history, spectrum holdings and pending regulatory proceedings. That may no longer be enough. The proposed amended s67 replaces the existing market review regime, centred on significant market power, with a broader inquiry into market features that impede, distort or restrict competition. Under this regime, ICASA can identify licensees contributing to those features and impose proportionate pro-competitive remedies, including wholesale access obligations, rate regulation, separate accounting and, in appropriate cases, structural separation. The Bill also strengthens coordination between ICASA and the Competition Commission.

Transaction teams must therefore look beyond the usual due diligence checklist and ask whether target assets could become subject to regulated wholesale access, materially lower forecast revenues, or a market inquiry into the relevant market. Where projected cash flows depend on pricing freedom or exclusive control over network infrastructure and spectrum, future regulatory intervention could affect both the value of the assets and the expected return on investment. Deal teams should reflect these potential regulatory outcomes in their valuation models and transaction assumptions. Buyers who skip this step may find that the regulatory environment after completion looks quite different from the one on which the deal was priced.

3. Should we review our licensing assumptions?

Licence holders have long treated their licences as relatively stable regulatory assets. Although licence conditions have always been capable of amendment under certain circumstances, investors have generally modelled their businesses on the assumption that core rights and obligations would stay broadly predictable over the investment period. The Bill may unsettle that assumption. Following a market inquiry, ICASA will be empowered to impose pro-competitive licence conditions that could alter the commercial characteristics of licences already issued.

The Bill also introduces the concept of an “access provider”, which is defined as an electronic communications network service licensee that has been assigned International Mobile Telecommunications (IMT) spectrum (and whose network covers at least 90% of South Africa’s population. Access providers must provide national roaming and mobile virtual network operator (MVNO) services on request.

Separately, the Bill introduces a “use it or share it” principle in terms of which parts of spectrum that remain unused in a particular geographic area after the prescribed statutory period may become subject to compulsory secondary sharing. Unused spectrum may also be withdrawn in specified circumstances following the prescribed processes.

The value of a communications licence may therefore depend increasingly not only on the rights it currently confers, but also on the regulatory obligations that could attach to it in future. A licence that today permits considerable flexibility may, following a market inquiry, become subject to obligations affecting pricing, network access, operational autonomy or the ability to extract value from infrastructure investment. As a result, the regulatory risk profile is becoming less predictable, particularly for operators with a significant presence in the market or extensive network infrastructure.

4. Should we reassess key commercial agreements?

Many commercial agreements allocate rights, obligations and commercial risk on the basis of the current regulatory framework. Where the Bill changes the rules governing access, pricing or spectrum use, parties should consider whether those arrangements remain appropriate.

Access providers will have to conclude national roaming and MVNO agreements within prescribed periods, and unresolved disputes can be referred to ICASA for determination. That leaves parties less room to prolong negotiations or leave material terms unresolved, particularly around reference offers and dispute resolution provisions negotiated under the current legislative scheme. The Bill also removes the existing statutory right to refuse an essential facility request on the grounds that it is not technically or economically feasible. That considerably narrows a facility holder’s ability to resist compulsory access, though technical and operational constraints may still influence the terms ultimately agreed or imposed.

More importantly, the Bill signals a move from a regulatory environment in which access, pricing and risk allocation are predominantly determined through commercial negotiations, towards one in which regulatory rules may increasingly determine the outcome. Reference offers, wholesale pricing standards, prescribed negotiation periods and ICASA’s power to determine unresolved terms could narrow the range of outcomes available to contracting parties.

Infrastructure sharing, network access, wholesale supply, spectrum sharing, managed services and long-term customer contracts may all rest on assumptions about pricing flexibility, network utilisation, exclusivity or anticipated returns that could change as ICASA develops the Bill’s new regulatory regime.

Businesses should therefore consider whether existing contracts, and agreements currently under negotiation, are resilient enough to withstand these changes in the regulatory framework, paying closer attention to change-in-law provisions, regulatory cooperation obligations, pricing adjustment mechanisms, renegotiation rights, appropriately drafted force majeure and termination rights, and the express allocation of regulatory risk, including the prospect of future market inquiries, licence amendments or pro-competitive remedies, rather than leaving these matters to general boilerplate provisions.

5. Should we engage in the legislative and regulatory processes?

The Bill is currently before the National Assembly’s Portfolio Committee on Communications and Digital Technologies, which has invited stakeholders and interested parties to make written submissions on the Bill by 21 September 2026. The legislative process on the Bill is expected to continue well into 2027 and is expected to include public hearings across all nine provinces. In addition, much of the Bill’s practical effect will come from the regulations ICASA still has to make for national roaming, MVNO services, essential facilities, wholesale pricing, spectrum sharing and market inquiries, mostly within 18 months of commencement (12 months for the essential facilities list). The Minister responsible for local government also still has to make the standard municipal by-law contemplated by the proposed s21A.

Businesses with material exposure to the sector have a narrow but important window to influence the legislative text before the Bill is finalised, and afterwards to help shape the regulations that will give it practical effect. Engagement that is technical, well-informed and backed by economic modelling and operational data is most likely to produce a regulatory framework that reflects how networks are actually built and operated. Getting involved early is likely to prove more effective than waiting for the rules to be settled.

6. Should boards rethink how they oversee regulatory risk?

Viewed as a whole, the Bill’s various layers of ongoing regulatory obligation point to a potentially more dynamic regulatory environment than the one that businesses operate under today. It is worth considering whether existing governance frameworks are equipped to identify, monitor and respond to this kind of risk, and whether boards are receiving regular enough reporting on regulatory developments that may affect capital allocation, investment decisions or long-term strategy. A framework built for regulatory stability may not be adequate here. Governance frameworks should therefore be able to identify emerging risks, assess their potential impact and respond before those risks materialise.

The Bill represents more than a single legislative event. It suggests a shift towards a more actively managed market, one in which access may become compulsory, pricing methodology is regulated, spectrum may be shared, and two regulators exercise formalised concurrent jurisdiction through mandatory agreements, information sharing, coordination and mutual enforcement of findings.

Although day-to-day compliance will remain management’s responsibility, the Bill’s strategic implications for investment decisions, capital allocation, transaction strategy and long-term planning fall squarely within the board’s oversight responsibilities.

This calls for a strategic response, not merely a compliance one. Boards should build regulatory foresight into capital allocation, commercial negotiation and governance now, before positions harden and become difficult to reverse.

Conclusion

The Bill is still working its way through Parliament, and its terms may well change before it is finalised. Even so, it already gives a clear indication of where South Africa’s communications sector is headed. Businesses that use this period to reassess their investment decisions, transactions, licensing assumptions, commercial arrangements and governance frameworks are likely to be better prepared for the regulatory environment that emerges than those that wait until the new regulatory framework is fully in place. The time to act is now: review your strategic assumptions, engage with the legislative and regulatory processes, and ensure your board is equipped to oversee the regulatory risks ahead.

The post New Communications Bill proposes changes to telecoms access, pricing and spectrum rules appeared first on Werksmans Attorneys.

Over the past decade, organisations have invested heavily in securing workplace technology. Laptops, smartphones, cloud applications and enterprise networks are now subject to a range of security controls, including device management, multi-factor authentication and acceptable use policies. Wearable technology has, however, received far less attention. The latest generation of AI-enabled smart glasses, earbuds, watches and rings can receive confidential communications, analyse documents, authenticate users, record conversations and synchronise with cloud platforms. As these capabilities mature, organisations must decide whether wearables should still be viewed as personal accessories, or whether they have become another channel through which corporate information is accessed, processed and transmitted.

Wearables are no longer merely personal accessories

Wearables are electronic devices that can be worn on or attached to the human body. According to the IDC’s Worldwide Wearable Device Tracker, global wearable-device shipments totaled 145.7 million units in Q1 2026, an increase of 4.3% year-on-year.

Wearables, once associated mainly with fitness tracking, have become embedded in daily personal and professional life. Unlike laptops and smartphones, they are not always perceived as part of an organisation’s technology environment. Employees purchase them, wear them throughout the day, and design choices ensure they blend into ordinary clothing. Their familiarity masks their significance.

The change lies not only in what these devices do, but in how they operate. Earlier generations of wearables performed narrow, user-initiated tasks. Newer devices run continuously and with greater independence from the wearer. Interactions can occur through voice commands, gestures, visual prompts or automated sensing, without the wearer opening an application. A smartwatch connected to Outlook or Teams may provide almost immediate access to sensitive commercial information (emails, messages and calendar entries) without the employee touching a laptop. Smart glasses can capture photographs, video and audio, live stream, translate and interact with an AI assistant, all while resembling ordinary eyewear.

What matters most is the combination of capabilities these devices now contain. A device worn on the wrist or face may combine a camera, microphone, biometric sensors, location tracking, wireless connectivity, cloud synchronisation and AI-powered processing. It can collect information about the wearer, their colleagues, clients and the organisation, sometimes in the background, without any deliberate action by the wearer.

Many organisational controls still rely on familiar categories. Laptops are managed as workplace devices, smartphones fall under mobile-device controls, and cloud applications are assessed as third-party services. A watch, ring, pair of glasses or set of earbuds may not fit comfortably within any of these categories, even where their capabilities overlap with all three.

This creates a widening gap between how wearables are perceived and the role they actually play. Organisations should therefore consider whether their cybersecurity, information-governance and AI-governance frameworks adequately address the information these devices can access, capture, process, store and transmit.

Wearables may already be connected – even if the organisation has not approved them

Many organisational technology controls depend on visibility. Organisations know which laptops and smartphones they have issued, which personal devices have been authorised, and what security requirements apply. Procurement processes, minimum security standards, patch management requirements and device management controls are built around that visibility. Many organisations have detailed Bring Your Own Device (BYOD) policies governing personal smartphones, but those policies were drafted with smartphones in mind, not always-on, AI-enabled wearables that enter boardrooms and trading floors as unremarkable accessories.

A privately acquired wearable can bypass approval processes entirely. Employees may purchase and configure devices, install companion applications, connect to cloud services and synchronise with business applications, often without IT, information-security or legal involvement.

The connection does not necessarily have to be direct. A wearable may interact with corporate information through a paired smartphone, a companion application or a cloud-based account, without ever connecting to the corporate network independently. Its absence from the organisation’s inventory of devices therefore does not mean that it lacks access to workplace information.

An organisation may have secured its conventional workplace devices while inadvertently overlooking an entire layer of personally owned unmanaged wearables capable of interacting with corporate systems.

Corporate information may be exposed without anyone pressing “send”

Modern wearables can display email previews, messaging notifications, calendar appointments, authentication requests and other business communications. Sensitive information can become visible in circumstances not contemplated when those communications were sent.

A smartwatch displaying the subject line of a confidential merger within the view of a nearby passenger on a flight, or an executive’s smart glasses inadvertently recording a board meeting, illustrates the risks.

These risks do not depend on dishonesty or deliberate disclosure. They may arise from default device settings, automated functions, or a failure to appreciate how the device receives, displays and records information.

Wearables may expand the organisation’s cybersecurity attack surface

Wearables present cybersecurity risks beyond inadvertent disclosure of confidential information. Many devices communicate with smartphones, laptops, companion applications and cloud platforms, creating multiple pathways for information to flow. Depending on the device and its configuration, these connections may use Bluetooth, Wi-Fi or other wireless protocols.

The risk is not that every wearable is inherently insecure, but that each introduces additional software, credentials, connections and third-party services into the organisation’s environment. This expands the attack surface, the number of potential entry points through which systems or data could be compromised. Vulnerabilities may arise from outdated firmware, insecure device pairing, excessive application permissions, compromised cloud accounts or weaknesses in companion applications.

Physical connections create additional exposure. Where wearables or their accessories connect to laptops or desktops via USB for charging, synchronisation, firmware updates or data transfer, a compromised device could introduce malware or enable confidential information to be copied outside the organisation’s usual security controls.

Following a cybersecurity incident, regulators, insurers and litigants may ask whether the organisation’s security measures addressed all connected technologies capable of interacting with its systems.

AI-enabled wearables may fall outside existing AI governance controls

Several wearables now incorporate AI assistants that can summarise conversations, answer questions, draft messages and interact with business information through natural language. An employee might ask a wearable to summarise a confidential meeting or draft a response to a client.

The interaction feels different from opening a generative AI platform on a laptop and deliberately entering a prompt. A voice command during a meeting may seem like an ordinary interaction with a personal device, even though it could result in confidential or personal information being captured, transmitted and processed by an external AI service.

Organisations should ask whether confidential information is being processed by third-party AI providers; whether personal information is being transferred across borders; whether recordings, prompts or outputs are retained to train AI models; and whether their AI governance framework extends to wearables.

These issues are already surfacing in litigation. In the United States, AI-enabled smart glasses already the subject of lawsuits concerning data collection and processing practices. The allegations remain untested, but the dispute illustrates how the operation of AI-enabled wearables can create legal exposure extending beyond the individual wearer.

The technology may be new, but the legal duties are not

Legal obligations attach to the information processed, the conduct involved and the risks created – not the form of the device.

Where wearables collect or process personal information, the Protection of Personal Information Act, 2013 (POPIA) may apply. s19 requires responsible parties to implement appropriate, reasonable technical and organisational measures, identify reasonably foreseeable internal and external risks, and maintain appropriate safeguards. A device does not fall outside these requirements merely because it is personally owned.

The exposure, recording or external processing of business information through a wearable could breach employment confidentiality duties, NDAs, trade secret obligations or sector-specific requirements. Where communications with legal advisers are captured, organisations should consider the effect on legal professional privilege.

Directors remain bound by duties of care, skill and diligence reasonably expected of them. Although the Companies Act, 2008 does not prescribe controls for wearables, emerging technology risks may form part of the broader risk-governance matters warranting board oversight.

The organisation’s response to wearables must, however, also respect employees’ rights. Restrictions on personal devices, workplace monitoring and access to information collected by wearables should be proportionate, transparent and consistent with applicable privacy, employment and interception laws.

Governance should follow capability, not the label on the device

The appropriate response is not necessarily to ban wearables or draft a standalone wearables policy. Organisations should instead assess whether their existing cybersecurity, BYOD, acceptable use, confidentiality, AI-governance and incident-response frameworks address the capabilities of these devices and the circumstances in which they are used.

As part of that assessment, organisations should consider:

• Which wearables are being used in the workplace, and what are they capable of doing?
• May personal wearables interact, directly or indirectly, with corporate systems or display confidential communications?
• May camera- or microphone-enabled devices be used during confidential meetings or in sensitive areas?
• Do AI-governance and recording policies address functions such as live transcription, meeting summarisation, image analysis and contextual assistance?
• Do network-access and device-management controls adequately address wearable technology?
• Do recruitment and assessment protocols address candidates’ use of AI-enabled wearables?
• If information were captured, disclosed or compromised through a wearable, could the organisation’s incident-response processes identify, investigate and contain the incident?
• Is responsibility for wearable-related risks clearly allocated among IT, information security, legal, privacy and human-resources teams?

For many organisations, the answers may not be clear, not because they have chosen to accept the risks, but because their policies were written with laptops and smartphones in mind.

Any response should be proportionate to the device’s capabilities and the environment in which it is used. Some organisations may need to prohibit particular functions or devices in sensitive areas, while others may manage risks through configuration requirements, access restrictions and policy updates. Medical and accessibility needs must be accommodated.

Closing the governance blind spot

Wearables can no longer be excluded from organisational governance by default. Organisations should consider whether their existing frameworks govern the technology employees actually use, rather than only technology formally issued or approved.

The governance blind spot arises not from the device itself, but from policies and controls that fail to evolve as device capabilities do. Addressing the issue now enables proportionate safeguards and clear employee guidance before an unmanaged device becomes relevant to a confidentiality or cybersecurity incident.

The post Are your employees’ wearables creating a new governance blind spot? appeared first on Werksmans Attorneys.

The legal lifecycle begins long before a dispute reaches court, or a regulator commences an investigation. It starts when employees negotiate contracts, evaluate acquisitions, respond to regulators, investigate complaints, interpret legislation and make commercial decisions with legal consequences. Increasingly, employees turn to generative artificial intelligence (“AI”) before consulting legal advisers. They routinely ask AI to review contracts, interpret legal requirements, summarise documents and recommend courses of action. As a result, AI is becoming part of the organisation’s legal decision-making process. By the time a lawyer becomes involved, AI may already have influenced the commercial decisions taken, the information presented, and the organisation’s legal position itself.

Many organisations have developed AI governance frameworks addressing cybersecurity, privacy, intellectual property, acceptable use and regulatory compliance. However, comparatively little attention has been given to how employee use of AI can affect an organisation’s legal position. By the time a matter reaches the legal department, AI may have already influenced multiple stages of the legal lifecycle. Employees may have –

• asked AI whether contracts may be terminated, whether regulatory approval is required, whether a contractual provision is enforceable, whether an employee may be dismissed or how best to respond to a regulator;
• uploaded confidential contracts, board papers or correspondence to public AI platforms;
• asked AI to prepare a briefing for internal or external legal advisers;
• asked AI whether the organisation has a legal defence;
• generated summaries of evidence or lengthy document sets;
• prepared investigation reports using AI;
• drafted witness statements with AI assistance; or
• asked AI to recommend a litigation or regulatory strategy.

Each of these interactions has the potential to affect the organisation’s legal position in ways that may not become apparent until much later.

The risk is not simply that AI may produce inaccurate answers. Employees may unknowingly allow AI to influence how legal issues are framed, what information is presented to legal advisers, and which decisions are taken before legal advice is obtained.

This issue is no longer theoretical. Recent judicial decisions demonstrate that courts are applying long-established legal principles—confidentiality, legal professional privilege, evidential integrity and professional accountability—to the use of AI.

The question for boards, executives and General Counsel is no longer whether employees are using AI—in many organisations, everyday business practice has already answered that. The more important question is whether organisations are governing that use before it influences contracts, transactions, regulatory engagement, investigations and the legal advice upon which significant business decisions depend.

AI is increasingly influencing legal advice before legal advisers become involved

Generative AI is increasingly becoming the first point of reference when legal or regulatory questions arise—not simply a way to obtain information more quickly.

Historically, employees confronted with unfamiliar contractual provisions, regulatory obligations or employment issues would seek guidance from legal teams before taking significant decisions. Today, many employees first consult AI. This behavioural shift has important implications.

Legal advice is only as reliable as the factual information upon which it is based. If employees rely on AI to interpret contracts, summarise correspondence, identify legal issues or assess regulatory obligations before lawyers become involved, AI may shape not only the decisions taken, but also the information presented to legal advisers.

AI systems may simplify complex legal questions, present tentative propositions with unwarranted confidence, overlook jurisdiction-specific requirements or fail to appreciate commercial context. They may identify certain risks while overlooking others, prioritise commercially attractive options over legally prudent ones, or incorrectly assume that legal principles from one jurisdiction apply elsewhere.

This does not mean AI is unreliable. Sound legal advice depends not only on legal rules, but also on judgment, context, and an appreciation of the organisation’s commercial objectives and risk appetite.

The objective should not be to prohibit employee use of AI, which is embedded in everyday business practice. Rather, it is to identify matters where AI may appropriately support productivity, where legal review should remain mandatory, and where public AI platforms should not be used at all.

AI can unintentionally alter an organisation’s legal position

The legal implications extend beyond the quality of legal advice received. The way employees interact with AI may itself unintentionally alter the organisation’s legal position.

Consider a transaction team negotiating a high-value acquisition. An employee uploads a draft share purchase agreement into a publicly available AI platform and asks whether the indemnity provisions are market standard. A regulatory affairs manager uploads correspondence received from a sector regulator and asks AI to prepare a proposed response. An internal investigator uploads witness statements and requests AI to identify inconsistencies before interviews are conducted.

These scenarios illustrate two significant governance risks. First, confidential commercial information may be disclosed to third-party AI providers, and organisations may have limited visibility over how uploaded information is stored, processed or used. Second, the use of public AI platforms may affect claims of confidentiality or legal professional privilege.

In United States v Heppner, a US federal court held that communications with publicly available AI platforms are not protected by attorney-client privilege, even where used to prepare a defence strategy or legal arguments in anticipation of litigation. Similarly, in Secretary of State for the Home Department v Hamid, the English High Court held that uploading client letters and Home Office decision letters to an open-source AI tool places that information in the public domain.

These decisions illustrate a broader lesson: public AI platforms should not be regarded as confidential. Organisations should distinguish between enterprise AI environments with appropriate contractual safeguards and publicly available systems whose treatment of uploaded information may differ significantly.

The governance challenge is broader than preventing inaccurate outputs. It is ensuring that employee use of AI does not reshape the organisation’s legal position through disclosure of confidential information or erosion of privilege before legal oversight occurs.

Today’s AI interactions may become tomorrow’s legal record

Many employees regard AI interactions as informal working notes or preliminary research. However, in litigation, regulatory investigations, competition inquiries, tax audits or shareholder disputes, these interactions may form part of the organisation’s legal record.

Employees frequently ask AI to summarise witness interviews, prepare chronologies, analyse documentary evidence or draft investigation reports. Those outputs may create additional records capable of scrutiny in subsequent proceedings and may become embedded in board papers, regulatory submissions, internal memoranda or legal instructions. Organisations may ultimately be required to explain not only the decisions taken, but also the role AI played in reaching them.

Discovery obligations extend beyond final documents to drafts, communications and other electronically stored information. Organisations should proceed on the basis that prompts, uploaded documents and AI-generated outputs relating to significant matters may one day require disclosure.

Recent litigation illustrates that this is no longer merely theoretical. In Fortis Advisors LLC v Krafton Inc., AI communications became part of the evidence in the case. In Goodwin v Goodwin, the English High Court approached witness evidence with caution where draft witness statements had been uploaded to ChatGPT before being finalised. The case illustrates that AI-assisted drafting may affect the weight a court is prepared to attach to evidence where there are concerns that the statements no longer reflect the witness’s own words. In Conservation Law Found., Inc. v. Shell Oil Co (United States District Court, District of Connecticut Ruling of U.S. Magistrate Judge Thomas Farrish (May 2026), the court ordered the production of AI prompts used by an expert in preparing their report.

Regulators increasingly expect organisations to explain how significant decisions were reached, particularly where those decisions affect consumers, employees or regulated activities. If AI has materially influenced regulatory submissions, internal investigations or compliance assessments, organisations may be required to explain the role AI played.

AI governance should therefore extend beyond acceptable-use policies to encompass document retention, records management and investigation protocols. Organisations should preserve original source documents, avoid relying exclusively on AI-generated summaries in significant matters and ensure legal advisers have access to primary evidence. In an era where AI interactions may become part of the legal record, preserving the integrity of that record is as important as preserving the underlying documents.

The governance lessons emerging from recent cases

Recent judicial decisions do not suggest that organisations should avoid AI. Rather, they demonstrate that long-established legal principles continue to apply irrespective of the technology used.

Courts have reinforced that responsibility for the accuracy of legal work remains with the human user, not the technology. AI may assist decision-making, but it does not replace professional judgment or diminish human accountability. (See, for example, South African decision: Mavundla v MEC: Department of Co-operative Government and Traditional Affairs, KwaZulu-Natal and Others; US decision: Mata v Avianca Inc.; UK decision: R (Ayinde) v London Borough of Haringey; Al-Haroun v Qatar National Bank)

South Africa recently experienced these challenges. The withdrawal of the 2026 Draft National AI Policy following reports of alleged fictitious AI-generated references reminds us that AI-assisted work remains subject to human accountability, whether in the public or private sector.

Conclusion

AI can influence your organisation’s entire legal lifecycle—from negotiating contracts and pursuing acquisitions to responding to regulators, conducting investigations, managing compliance and resolving disputes.

Much discussion surrounding AI has focused on responsible use of AI by lawyers. That debate remains important, but overlooks an equally significant challenge: AI is influencing legal issues long before lawyers become involved. It may shape the information presented to legal advisers, alter an organisation’s legal position and create records subject to regulatory or judicial scrutiny.

Organisations should therefore move beyond generic AI governance and adopt a legal lifecycle governance approach that identifies where AI may appropriately support legal and commercial decision-making, where legal oversight should remain mandatory, and where public AI platforms should not be used.

The organisations that derive the greatest value from AI are unlikely to be those that adopt AI the fastest. They will be those that recognise AI is changing how legal risk emerges within organisations. Where legal risk may be influenced long before lawyers are consulted, effective AI governance is about governing the legal consequences of how the technology is used.

The post Think before you prompt: How employee use of AI can shape your organisation’s legal position before lawyers become involved appeared first on Werksmans Attorneys.

Digital taxation has moved from policy debate to regulatory reality. Governments across the world are implementing measures aimed at taxing revenue generated within their markets by digital businesses, regardless of their physical presence. These measures, including VAT on electronic services, digital services taxes and withholding-based mechanisms, are changing how digital commerce operates.

The rapid growth of the digital economy has fundamentally altered how goods and services are traded across borders. Businesses can supply digital products, services, and platforms into markets without establishing a physical presence in those markets, thus enabling unprecedented levels of cross-border e-commerce.

While digital taxes are often framed as a fiscal issue, their real impact is commercial. They are reshaping pricing, participation, and competitiveness in cross-border e-commerce markets, with implications for both multinational platforms and local businesses.

The economic logic behind digital taxes

Traditional international tax systems were designed around physical presence. A company paid tax in a country where it had offices, employees or tangible operations. The digital economy disrupted that model in ways that are now well understood, but still not fully resolved.

Social media platforms monetise user data without maintaining local offices. Streaming services generate subscription revenue from users across many countries. Online marketplaces facilitate transactions between buyers and sellers in countries where the platform itself may have no legal entity.

As digitalisation accelerated, governments became increasingly concerned about base erosion and profit shifting, loss of tax revenue, perceived inequities between local and foreign companies, and growing political pressure to tax large multinational technology firms.

Digital taxes have emerged as a response to these concerns. They are intended to both capture revenue and create parity between domestic and foreign businesses. However, in doing so, they inevitably change the underlying economics of how digital services are supplied across borders.

Global context: the OECD framework

The global response to digital taxation has been shaped in large part by the work of the Organisation for Economic Co-operation and Development (OECD).

Through its BEPS 2.0 initiative, the OECD has introduced a two-pillar framework. Pillar One seeks to reallocate taxing rights of large multinationals profits to markets where their goods or services are used, while Pillar Two introduces a global minimum corporate tax rate of 15%.

147 countries have committed to elements of this framework, although implementation remains complex and uneven. In the meantime, countries have continued to introduce unilateral or regional digital tax measures in their own markets.

For businesses, this creates a layered environment: global rules are emerging, but local regimes remain highly relevant and, in many cases, decisive.

The adoption of digital services taxes in Africa

Direct digital services taxes, i.e. turnover-based levies on gross revenue from digital services supplied by non-residents, remain relatively limited in Africa compared to VAT-based approaches.

A few African countries have implemented direct digital service tax regimes, including Kenya, Nigeria, Tunisia, Zimbabwe, Tanzania and Sierra Leone.

However, over 20 African countries have introduced VAT on electronic services supplied by non-resident providers, reflecting a more administratively straightforward first step in taxing the digital economy.

This shows that Africa is not creating a single model of digital taxation, but is rather experimenting with different approaches depending on administrative capacity, enforcement considerations and policy priorities.

The impact on pricing and market dynamics

One of the most immediate effects of digital taxation is on pricing.

Turnover-based digital services taxes, as well as VAT obligations on foreign suppliers, increase the cost of supplying digital services. In most cases, these costs are not absorbed entirely by the platform, but are passed on to consumers.

This is already visible across some digital services. Subscription prices, advertising costs and marketplace commissions are adjusted to accommodate digital service taxes. Although they are commercially rational, they have real implications for how businesses and consumers participate in digital markets.

The result is that digital taxes influence not only government revenue, but also consumer pricing and market demand.

For cross-border e-commerce, the effect is cumulative. Many African businesses rely on global digital platforms to reach their customers, advertise products and manage operations. As platform costs increase, so too does the cost of participating in those markets.

Cross-border e-commerce and structural friction

Digital taxes do more than increase costs. They introduce new forms of friction into cross-border trade.

The defining feature of digital commerce has been its ability to operate across borders with minimal structural barriers. Digital tax regimes are beginning to change that.

As countries introduce VAT, direct digital service taxes and withholding-based taxation of digital services, businesses must navigate:

• multiple tax regimes applied to the same transaction;
• differing definitions of taxable digital services. and
• varying compliance requirements.

This results in a more fragmented and complex cross-border environment.

From adoption to enforcement: evolving digital tax models in Africa

Beyond the question of adoption, a more important development is how digital tax frameworks are evolving in practice.

Across Africa, there appears to be a shift from relatively simple turnover-based models towards approaches that prioritise enforceability and broader jurisdictional reach.

In some cases, this involves expanding the basis on which tax is imposed. For example, Kenya’s transition from a digital services tax to a significant economic presence framework reflects a move from transaction-based taxation to a model grounded in sustained digital participation within the local market. This broadens the scope of taxable activity and introduces greater complexity in determining exposure.

In other cases, the focus is on how the digital tax is collected. For example, Zimbabwe’s move toward a withholding-based model demonstrates a different strategy, i.e., incorporating tax collection within the payment system itself. By requiring intermediaries to collect the tax at the point of transaction, the framework reduces reliance on voluntary compliance by foreign providers and significantly enhances enforcement.

Nigeria’s application of economic presence rules reflects a similar objective of asserting taxing rights over digital activity without requiring physical presence, while Tanzania’s approach demonstrates how existing income tax frameworks can be adapted to capture digital marketplace activity.

From a practical advisory perspective, these developments indicate that digital taxation in Africa has not been static, but is evolving toward models that are both more comprehensive in scope and more effective in enforcement, with direct implications for how cross-border digital services are structured and delivered.

Community and market implications

Digital taxes are often framed as a corporate tax issue. In reality, their effects are felt much more broadly.

Consumers may have to pay higher subscription prices for digital services, increased online advertising costs and, in some cases, reduced service offerings. Where platforms pass on tax costs, the impact is felt directly by users.

Small and medium enterprises are also affected. Businesses that rely on digital advertising, online marketplaces and cross-border platforms may face higher operating costs as platforms adjust pricing in response to tax obligations. At the same time, digital taxes may help level the playing field by reducing advantages enjoyed by large multinational firms.

For governments, digital taxation presents an opportunity to strengthen domestic revenue bases and support broader policy objectives, including infrastructure development and digital inclusion.

At the same time, there are legitimate concerns that these unilateral measures can create trade tensions, introduce compliance complexity and, in some cases, affect investment decisions. In practice, both perspectives have merit, particularly in emerging markets where the balance between regulation and growth is more delicate.

 Balancing competing policy objectives

For emerging markets, the central challenge lies in balancing competing priorities.

Governments want to generate revenue while continuing to attracting investment, support local innovation and ensure that digital services remain affordable and accessible. Digital taxation therefore intersects directly with digital inclusion policy and broader economic development objectives.

In the African context, this balance is particularly important. Digital markets are still developing, and policy choices in this area will have long-term implications for growth and participation.

 Strategic implications

For businesses, the implications are clear. Digital taxes are not limited to large technology companies. They affect a wide range of sectors, including digital advertising, streaming and audiovisual services, gaming and betting platforms, e-commerce marketplaces, SaaS providers and data-driven platforms.

Even in countries without direct digital services tax regimes, VAT enforcement on foreign suppliers has intensified.

At the same time, unilateral digital tax measures, including those adopted in parts of the European Union, have introduced additional complexity for multinational businesses operating across multiple countries.

As a result, digital taxation must be considered as part of broader commercial and regulatory strategy. Pricing, market entry, platform design and transaction structuring all need to take into account the evolving digital tax landscape.

Conclusion

Digital taxation is reshaping the economics of cross-border e-commerce in Africa. While the adoption of direct digital services taxes remains relatively limited, the broader direction of travel is clear.

While the adoption of direct digital services taxes remains relatively limited, the broader trend is clear. African countries are expanding their ability to tax digital activity through a combination of VAT, income tax and withholding-based mechanisms.

For policymakers, the challenge is to balance revenue mobilisation and fairness with the need to promote digital inclusion and economic growth.

For businesses, the implication is that digital tax is not just a peripheral tax issue. It is a central factor in how cross-border commerce is structured, priced and executed.

Understanding and responding to these dynamics will be critical for any business seeking to operate successfully in Africa’s evolving digital economy.

The post Digital taxes are reshaping cross-border e-commerce economics in Africa appeared first on Werksmans Attorneys.

Generative artificial intelligence (AI) is rapidly becoming one of the most contested issues in copyright law worldwide. At the centre of this transformation is a fundamental question: can copyrighted works be used to train AI systems without permission? Recent developments, including litigation in the US and the UK and recent UK policy reports, highlight the growing tension between AI innovation and the protection of creative works. As Africa’s creative industries continue to experience significant global growth, these developments raise important legal and policy questions regarding the use of African content in AI training datasets.

The Global Debate on AI Training Data

Generative AI models are developed using text and data mining techniques, which involve copying and analysing large volumes of digital content to identify patterns. Training datasets often include copyrighted materials such as books, music, news articles and journalism archives, images and films.

The central legal question is whether this use of copyrighted material constitutes copyright infringement, or whether it falls within permissible exceptions such as fair use.

Globally, several broad approaches are emerging:

Global Litigation Shaping the Legal Landscape

Courts are beginning to define how copyright law applies to AI training.

In Getty Images v Stability AI, Getty alleges that Stability AI used millions of its copyrighted images to train an AI model without permission. The UK High Court dismissed certain copyright claims on jurisdictional grounds, noting insufficient evidence that the relevant acts occurred in the UK. However, the case highlighted the cross-border complexity of AI training, where datasets may be compiled and processed across multiple jurisdictions, and did not finally determine the substantive copyright issues.

In The New York Times v OpenAI and Microsoft, the newspaper alleges that millions of its articles were used to train AI systems without authorisation. The case raises important questions about the legality of training on copyrighted journalism, potential market substitution and liability for AI-generated outputs. This case is particularly important for news publishers globally, including in Africa, where digital journalism increasingly relies on subscription and advertising revenue.

Similarly, in Andersen v Stability AI, visual artists allege that AI models were trained on scraped images without consent, raising questions about whether such datasets infringe on copyright and whether AI models may constitute derivative works.

These cases are likely to play a significant role in shaping how courts approach AI training globally.

Policy Direction: UK and Global Signals

Recent UK developments provide useful insight into how governments may approach these issues.

In its Report on AI, Copyright and the Creative Industries, the UK House of Lords Communications and Digital Committee adopts a strongly pro-creator stance, emphasising that generative AI systems rely extensively on human-created content, cautions against weakening copyright protections and emphasises the need to ensure that creators are compensated for the use of their works.

The, the UK Government’s Report on Copyright and Artificial Intelligence (March 2026) confirms that there is currently no consensus on how copyright law should apply to AI training and that further evidence is required before legislative reform. It stepped back from its earlier proposal for a broad opt-out exception, following strong opposition from the creative industries. It is now exploring more balanced approaches, reflecting the evolving and contested nature of the issue.

The UK is increasingly focusing on:

• supporting licensing frameworks
• improving transparency in AI training data
• encouraging market-led solutions

This reflects a broader global trend towards balancing innovation with protection of creative industries.

Why This Issue Matters for Africa’s Creative Industries

Africa’s creative industries have grown rapidly over the past decade and are increasingly integrated into global digital markets.

Music: African music has achieved global prominence, with genres such as Afrobeats and Amapiano reaching international audiences. Artists such as Burna Boy, Wizkid, Tyla and Black Coffee have gained global recognition, while streaming platforms distribute African music worldwide.

Film and Television: Nigeria’s Nollywood remains one of the largest film industries globally, producing thousands of films annually. South Africa’s television and broadcasting sector continues to produce locally relevant content, distributed through platforms such as DStv. Global streaming service providers are also investing in African content.

Digital Media and Journalism: African publishers such as Nation Media Group (Kenya), Daily Maverick (South Africa) and Premium Times (Nigeria) have built significant digital audiences. Their business models rely heavily on content monetisation through subscriptions and advertising.

As African content gains international reach, it is increasingly likely to be incorporated into global AI training datasets.

This creates a structural risk: African creative works may be used to train AI systems without the knowledge, consent or compensation of creators.

At the same time, African creators and businesses may have limited visibility into how their content is used in AI development, particularly where training occurs across multiple jurisdictions.

Most African copyright regimes were developed prior to the emergence of generative AI and do not expressly address the use of copyrighted works in AI training datasets. Copyright laws in most African jurisdictions do not yet directly regulate text and data mining or AI training.

Strategic Opportunity: African Data as an Asset

While much of the debate focuses on risk, AI training also presents a potential commercial opportunity.

Generative AI systems require large volumes of high-quality data, and AI developers are increasingly entering into licensing agreements with content owners.  African datasets that may become particularly valuable include language datasets (given the diversity of African languages), music catalogues (particularly in globally popular genres such as Afrobeats and Amapiano) and    media archives (including film, television and journalism).

This suggests that African creators and institutions may be able to participate in emerging markets for licensed AI training data.

What Businesses Should Do Now

The evolving legal landscape requires action from both AI developers and creative industry participants.

AI developers should:

• Ensure that training datasets are lawfully sourced.
• Implement governance processes to track data provenance.
• Monitor regulatory developments across jurisdictions.

Creative industries should:

• Strengthen copyright notices and licensing terms to include an express provision on whether content may be used for AI training.
• Implement technical measures to restrict unauthorised scraping, including tools that allow websites to block AI crawlers or charge for access to content.
• Embed copyright metadata or invisible watermarks into their content, which can help identify unauthorised use, prove ownership and track where works appear online.
• Collaborate through industry bodies to advocate for regulatory frameworks, negotiate licensing frameworks or developing collective rights management models.
• Explore opportunities to license content for AI training.

These steps can help mitigate risk while positioning businesses to benefit from emerging opportunities.

Conclusion

The global debate on AI training data remains unresolved, but its direction is becoming clearer. Governments are increasingly focusing on licensing, transparency and market-based solutions.

For Africa, the key question is how creative industries can both protect their content and participate in emerging data markets. The outcome of this debate will play a critical role in shaping the future of the continent’s creative economy.

As global approaches begin to converge around licensing and transparency, early strategic positioning will be critical for African creators and businesses.

The post Generative AI and Copyright: Emerging Legal and Policy Questions for Africa’s Creative Industries appeared first on Werksmans Attorneys.

Direct-to-device (“D2D”) satellite connectivity is emerging as one of the most consequential developments in the global telecommunications landscape. By enabling standard mobile devices to connect directly to satellites, D2D introduces a fundamentally different model of connectivity-one that is particularly relevant in regions where traditional network deployment has proven challenging, or infrastructure is unreliable or vulnerable to disruption. While this has the potential to expand coverage in underserved and remote areas, it also challenges long-standing regulatory frameworks built on a clear separation between satellite and terrestrial networks.

A Potential New Layer of Connectivity for Africa

Although mobile network coverage has expanded considerably across Africa, gaps remain in rural and hard-to-reach areas, and network resilience continues to be tested by environmental and other disruptions.

D2D introduces regulatory complexity that existing frameworks, historically based on a clear distinction between satellite and terrestrial services, were not designed to address. As these boundaries blur, regulators, operators and investors are confronted with evolving questions relating to spectrum use, licensing models, and market structure. These questions remain unsettled and are being approached differently across jurisdictions.

This article considers the key regulatory issues arising in relation to D2D across Africa, and where the technology may have the most meaningful impact.

Understanding D2D: The Convergence of Satellite and Mobile Networks

At its core, D2D refers to satellite-enabled communications services that connect directly to standard consumer devices, such as smartphones and Internet of Things (“IoT”) devices, without the need for terrestrial base stations or specialised equipment.

Two broad deployment methods are emerging.

• The first relies on spectrum traditionally allocated to mobile satellite servicers (MSS), typically requiring compatible device chipsets and operating within established international regulatory frameworks.
• The second involves the use of terrestrial mobile spectrum, usually through partnerships with licensed mobile network operators (“MNOs”), and raises more complex regulatory questions on spectrum sharing, licensing and competition.

Key Regulatory Issues

The emergence of D2D satellite connectivity raises a number of interrelated regulatory questions for African regulators, spanning several areas of telecommunications regulation.

Spectrum assignment and interference

The use of terrestrial mobile spectrum by satellite systems lies at the centre of current regulatory discussions. Although use of terrestrial mobile spectrum enables seamless connectivity using standard devices, it introduces the risk of interference with existing mobile networks. Regulators must therefore consider how to balance the efficient use of spectrum with the protection of incumbent licensees. For example, in Kenya, the Communications Authority of Kenya has initiated a technical review of satellite-to-device services, including assessing whether transmissions from low Earth orbit satellites to mobile devices could interfere with existing terrestrial mobile networks.

Licensing framework:

A key issue is whether existing licensing frameworks can accommodate D2D services, or whether new approaches are required. Traditional regimes distinguish clearly between satellite operators and terrestrial network operators. D2D, however, sits between these categories.

Some countries have indicated that existing frameworks may be capable of accommodating D2D, particularly where services are delivered through partnerships with licensed mobile operators. For example, in the Independent Communications Authority of South Africa authorised the use of MNO-licensed spectrum for testing purposes, suggesting a degree of adaptability within the current framework.

In other jurisdictions, there is less certainty. Questions remain regarding direct service provision to end-users, the form of authorisation required, and the regulatory treatment of user devices. These issues are still being actively explored in several countries, including Zambia, where a consultation process on the interim procedure to facilitate D2D has been initiated by the Zambia Information and Communication Technology Authority, but a D2D specific framework has not yet been finalised.

Role of MNOs

D2D also raises important questions regarding the role of MNOs in the evolving telecommunications ecosystem. While some models envisage direct service provision by satellite operators, industry stakeholders have consistently emphasised the importance of maintaining a role for licensed MNOs, particularly where terrestrial spectrum is used, both to ensure regulatory alignment and to support efficient spectrum management.

This is not only a regulatory issue, but also a commercial one. MNOs have made substantial investments in infrastructure, and there is concern that allowing satellite operators to bypass existing frameworks could disrupt established market dynamics. As a result, partnership-based models are increasingly being viewed as a practical means for aligning innovation with existing regulatory and commercial realities.

Competition and regulatory parity

The expansion of satellite operators into markets traditionally served by MNOs introduces a new competitive dynamic. Satellite operators may not be subject to the same regulatory obligations as local licensees, while MNOs are typically subject to licensing requirements, spectrum fees, consumer protection rules, and infrastructure commitments. This raises concerns that permitting comparable services without equivalent obligations could distort competition and undermine investment incentives.

Regulators must therefore strike a balance between encouraging innovation and protecting the integrity of their domestic telecommunications markets.

Cross-border and jurisdictional issues

Satellite services there are inherently cross-border, in contrast to the national focus of telecommunications regulation in Africa. As a result, operators must navigate fragmented regulatory regimes across jurisdictions, each with distinct licensing requirements and policy priorities.

For investors seeking to deploy D2D services at scale, this fragmentation presents a practical challenge. While harmonisation efforts may develop over time, current approaches remain largely country specific.

Regulatory Timing and Global Developments

The question of timing is also significant. A further issue is whether national regulatory approaches should be aligned with international developments, particularly the outcomes of the International Telecommunication Union’s World Radiocommunication Conference in 2027 (WRC-27), where aspects of non‑terrestrial network integration are expected to be considered.

Pending WRC-27, regulatory flexibility and interim measures may be required to enable testing and early deployment of D2D, particularly in markets where connectivity gaps remain significant. For example, the Tanzania Communications Regulatory Authority published guidelines for the provision of D2D, which it designed to serve as an interim measure until the global framework is finalised at WRC-27.

This divergence reflects a broader tension between the need for regulatory certainty and the desire to support innovation in a rapidly evolving technological environment.

Opportunities for Africa: Where D2D Could Have the Greatest Impact

While much of the focus has been on challenges, D2D also presents significant opportunities for Africa.

Its most immediate impact is likely to be in extending coverage to rural and underserved regions, where traditional network deployment remains economically challenging.

It also has potential use in sectors such as agriculture, mining, and logistics, where connectivity in remote locations is often critical.

D2D may further enhance emergency communications and disaster response, by providing connectivity where terrestrial networks are unavailable.

Conclusion

D2D satellite connectivity presents both significant opportunities and complex regulatory challenges for Africa. It has the potential to extend connectivity to underserved areas, but also raises important questions relating to spectrum, licensing, the role of MNOs, competition, regulatory parity and cross-border coordination.

Regulatory approaches across African jurisdictions are still evolving. While the outcomes of WRC-27 are expected to provide important international guidance, national regulators will continue to play a critical role in shaping frameworks that can support the effective deployment of D2D services.

Against this backdrop, a key question remains: will existing regulatory frameworks prove sufficiently flexible to accommodate D2D services at scale, or will more deliberate regulatory evolution be required?

The post Direct-to-Device Satellite Connectivity: Regulatory Implications for Africa’s Digital Future appeared first on Werksmans Attorneys.

In Africa, where satellite connectivity is increasingly relevant to digital infrastructure strategies, the central policy question is not simply how to enable deployment, but how to do so in a manner that balances investment, competition and national regulatory priorities. As satellite technologies evolve, regulators are reconsidering whether existing licensing frameworks remain fit for purpose. This requires navigating the intersection between globally coordinated satellite systems and domestically regulated communications markets, and determining how international frameworks can be aligned with national policy objectives.

Global Policy Direction and the GSOA Framework

Satellite connectivity is increasingly recognised as an important component of modern communications infrastructure. Against this backdrop, the GSOA Satellite Licensing Best Practices Report (January 2026) makes a compelling case for regulatory frameworks that simplify licensing processes, promote open skies policies and align national regulatory approaches with international coordination mechanisms, reducing regulatory barriers and enabling satellite capacity to be provided across borders more efficiently.

These principles are particularly relevant in the African context, where satellite connectivity is increasingly being considered as part of national digital infrastructure strategies.

At the same time, the implementation of such frameworks inevitably takes place within broader national policy contexts. Regulators across the continent therefore often consider how enabling satellite deployment can be achieved while remaining aligned with domestic regulatory responsibilities and policy priorities.

Satellite Connectivity and Africa’s Digital Infrastructure

While mobile network coverage in Africa is relatively high, structural constraints continue to limit the expansion of terrestrial broadband infrastructure in certain regions. In many areas, extending fibre or mobile networks may not be commercially viable in the near term.

Satellite systems complement terrestrial networks by enabling connectivity in areas where traditional deployment models are less viable. Satellite broadband can support access to essential digital services, including education platforms, telemedicine, financial services and e-government systems.

In this sense, regulatory frameworks that facilitate the rapid deployment of satellite services can support the advancement of national digital development strategies across the continent.

Open Skies and Market Access

One of the key themes highlighted in the GSOA report is the concept of “open skies” policies, under which satellite operators can provide satellite capacity across borders without requiring extensive national licensing procedures.

From a market perspective, such approaches may enable domestic telecommunications operators to access satellite infrastructure more easily, potentially increasing competition and expanding infrastructure choices for service providers.

For African regulators, the discussion often centres on how such frameworks can be implemented in a manner that facilitates market access while ensuring appropriate regulatory oversight of communications services provided within national territories.

In some jurisdictions, this may involve simplified landing rights regimes or registration mechanisms that enable satellite operators to provide capacity while maintaining regulatory visibility over services offered in the market.

Spectrum Management and International Coordination

Satellite communications operate within a global spectrum coordination framework managed by the International Telecommunication Union (ITU). The GSOA report emphasises the importance of aligning national regulatory frameworks with international coordination mechanisms, including the use of the ITU Master International Frequency Register (MIFR), which underpins the global coordination of satellite spectrum resources.

Greater reliance on international coordination processes can reduce regulatory duplication and facilitate cross-border satellite operations.

At the same time, national regulators remain responsible for managing spectrum use within their jurisdictions, including coordination with terrestrial services, mitigation of harmful interference and compliance with national regulatory requirements.

As satellite and terrestrial networks become increasingly integrated, spectrum coordination between these systems may become an increasingly important regulatory consideration. These considerations are particularly important in the context of large-scale satellite deployment, where cross-border consistency can significantly affect investment and service rollout.

Licensing Frameworks and Regulatory Oversight

Many African telecommunications markets operate under unified licensing frameworks that apply to both network operators and service providers. These frameworks typically include obligations relating to consumer protection, competition, spectrum management and lawful interception.

As satellite services expand within national markets, regulators may consider how existing licensing frameworks interact with satellite network architectures, which differ in several important respects from traditional terrestrial communications networks.

Satellite systems often operate across multiple jurisdictions, rely on globally coordinated spectrum resources and may not require the same physical infrastructure within national borders as terrestrial networks. Regulatory frameworks that recognise these characteristics while maintaining appropriate oversight may help support the efficient deployment of satellite services.

This raises a broader question as to whether existing licensing frameworks should be adapted to reflect the operational characteristics of satellite systems, or whether satellite services should continue to be accommodated within existing regulatory structures.

Regulatory Efficiency and Deployment Enablers

In addition to broader policy considerations, the GSOA report also emphasises the importance of regulatory efficiency in enabling the deployment of satellite services. This includes streamlined licensing processes, predictable approval timelines and regulatory fees that are limited to administrative cost recovery.

From a practical perspective, these measures may play a significant role in determining how quickly satellite services can be introduced into national markets. Lengthy approval processes, duplicative licensing requirements or high regulatory fees may delay deployment and increase the cost of satellite connectivity.

The report also highlights the role of blanket licensing frameworks for user terminals, which allow large numbers of satellite devices with similar technical characteristics to be authorised under a single licence. Such approaches can facilitate the rapid expansion of satellite connectivity, particularly in underserved areas.

For African regulators, these considerations are particularly relevant in assessing how regulatory frameworks can support both the availability and affordability of satellite-enabled services.

In this context, regulatory efficiency is not only an administrative consideration, but a key determinant of investment attractiveness and the pace of satellite deployment in national markets.

A Continuing Policy Conversation

The policy direction outlined in the GSOA report reflects broader global trends toward simplified licensing frameworks and greater regulatory harmonisation in satellite communications.

For African regulators, the discussion may increasingly focus on how these principles can be implemented in ways that support connectivity, investment and innovation while remaining aligned with domestic policy priorities and regulatory responsibilities.

Ultimately, the policy question may not be whether satellite services should play a larger role in Africa’s connectivity landscape. Rather, it is how regulatory frameworks can evolve to enable the rapid deployment of satellite connectivity while remaining consistent with national policy objectives.

As satellite technologies continue to develop, this is likely to become an increasingly important part of the regulatory agenda across African communications markets. The evolving policy landscape is already being tested by emerging technologies such as direct-to-device satellite connectivity, highlighting the importance of regulatory frameworks that can accommodate innovation while remaining aligned with national policy objectives.

The post Satellite Regulation in Africa: Aligning Global Frameworks with National Policy Priorities appeared first on Werksmans Attorneys.