At a glance
| Jurisdiction tier | Tier D - Not yet specified. No binding instrument that applies to insurers' own use of AI, and no issued regulator document addressed to this insurance market, sets out rules or expectations for AI. |
| Question to | the Information Regulator and the FSCA - complaints about automated insurance decisions |
| Band for this question | Contained |
| Rules reach | Insurers: directly · Reinsurers: directly · Intermediaries: directly |
| Last verified | [actual date of the launch-window check] |
South Africa's Protection of Personal Information Act limits decisions based solely on automated processing, and requires that people be given enough about the processing's logic to respond (section 71). It commenced on 1 July 2020.
The financial regulators' joint report on AI (November 2025) says institutions should disclose AI used in consumer-impacting decisions such as insurance pricing, and names a discussion paper as its next step. No sector-wide AI guidance has been issued.
Who these rules reach
- Insurers: directly, where it takes a decision about a person "which is based solely on the basis of the automated processing of personal information intended to provide a profile of such person" (section 71(1)).
- Reinsurers: directly, where it takes such a decision about a person, under the same words.
- Intermediaries: directly, where it takes such a decision about a person, under the same words.
This band describes how far the published record answers the question put to the Information Regulator and the FSCA. It is not a finding that either authority, or any firm it oversees, has fallen short of any rule.
Why the question goes to the Information Regulator and the FSCA: No South African insurer's own published account of AI in a consequential decision was found, so the question goes to the authorities.
The question
In briefSouth Africa's Protection of Personal Information Act 4 of 2013 provides that a person may not be subject to a decision that has legal consequences for them, or affects them to a substantial degree, "which is based solely on the basis of the automated processing of personal information intended to provide a profile of such person", including their health, reliability or conduct (section 71(1)). A decision taken in connection with a contract is exempt only if the person's request has been met or appropriate measures protect their interests. Those measures must let the person make representations, and must give them enough information about the underlying logic of the automated processing to do so (sections 71(2)–(3)). Non-compliance with section 71 is an interference with personal information on which the Information Regulator may act (sections 73 and 95). Where a complaint relates to a matter more properly within another regulatory body's jurisdiction, the Regulator must decide, after consulting that body, whether to refer it (section 78). In November 2025 the Financial Sector Conduct Authority and the Prudential Authority said that institutions should clearly disclose when AI is used in consumer-impacting decisions such as insurance pricing, that sector-wide guidance on ethical AI is envisaged, and that they would like to collaborate closely with the Information Regulator on alignment with the Act. If a policyholder complains that an insurer's AI model decided their cover or claim without the explanation section 71(3) requires, which authority deals with it: the Information Regulator under the Act, or the FSCA on referral under section 78?
Why this band: No company's own account could be tested, so the question rests on the statute and the regulators' own published report.South African privacy law already limits decisions made solely by automated processing and requires that people be given enough about a model's logic to respond. The country's financial regulators have said insurers should disclose AI in decisions such as pricing, and they envisage guidance but have not issued it. No public statement from any of these authorities settles which one would handle a complaint about an insurer's automated AI decision.
3. What the open question means for firms in South Africa
Until the authorities answer, a person in South Africa who complains that an insurer's AI decided their cover or claim without the explanation section 71 requires has no published statement on which authority deals with it. This entry gives no band to any firm.
4. What this entry does not establish
- The commencement of section 71 rests on legal news; the proclamation was not read.
- Whether any code of conduct covers insurers' automated decisions was not checked.
- The financial regulators' statutory remit over insurers' conduct was not read; the FSCA is named only as a possible referral body.
- No date set: the financial regulators' AI discussion paper; any Information Regulator guidance on automated decisions.
Sources
- Protection of Personal Information Act 4 of 2013, published in Government Gazette No. 37067, 26 November 2013 (printed). Statute. justice.gov.za PDF
- GoLegal, "Commencement of certain sections of the Protection of Personal Information Act", 24 June 2020 (printed). Legal news. golegal.co.za
- FSCA and Prudential Authority, press release on AI in the financial sector, 24 November 2025 (printed). Regulators. resbank.co.za
- FSCA and Prudential Authority, Artificial Intelligence in the South African Financial Sector, November 2025 (printed). Regulators. resbank.co.za PDF
- SAnews, "Minister announces withdrawal of draft AI Policy", Sunday, April 26, 2026 (printed). Government news service. sanews.gov.za
None share a law or regulator with this entry.
________________________________________
Commercial relationship with any party named here: None · Right of reply: indexreport.protocol@fijishi.com; with the sender's agreement, replies are published in full below the entry, dated · Cite as: Fijishi Jurisdiction Index 2026, Entry ZA · Corrections: none.