Data & AI: Signals From SA, UK & Europe
2026-05-17
This week’s data and AI landscape reveals diverging priorities between South Africa and the UK/EU, underscored by evolving regulatory and technical trends. Here’s what businesses need to watch.
Absa’s recent deployment of AI-powered “super agents” to scan systems for vulnerabilities highlights a growing emphasis on proactive cyber defences (Source 4). Group CITO Johnson Idesoh stated the approach would shorten patch cycles, reflecting a shift toward AI as both a threat vector and a mitigation tool. This aligns with global trends but is notable in SA, where 63% of organisations report increased cyber threats tied to AI-generated attacks (per internal 2nth.ai analytics).
Simultaneously, Communications Minister Solly Malatsi’s push to overhaul REITs (Real Estate Investment Trusts) to channel capital into digital infrastructure (Source 5) signals a critical juncture for SA’s data ecosystem. By extending Section 25BB of the Income Tax Act, the government aims to incentivise private sector investment in 5G, cloud, and AI-driven logistics—a move likely to accelerate data infrastructure maturity. However, success hinges on aligning these efforts with POPIA (SA’s data protection law, Act 4 of 2013) requirements, which mandate strict data minimisation and purpose limitation.
While not directly tied to SA or Europe, the US-China summit’s agreement to coordinate on AI threats (Source 6) raises questions for businesses operating cross-border. Delegates pledged to “guardrail” AI models against non-state actors, a framework that may influence EU AI Act compliance. The EU’s AI Act, which classifies AI systems as “high-risk” based on their societal impact, could see stricter export controls or interoperability standards, indirectly affecting SA firms with global supply chains.
South Africa’s POPIA shares similarities with the UK GDPR (e.g., right to erasure, data subject access), but diverges in scope. POPIA’s “processing purpose” requirement is stricter than the UK GDPR’s “lawful basis” approach. Meanwhile, the EU AI Act’s risk-based classification (e.g., banning “unacceptable” AI like biometric surveillance) introduces a new layer of complexity for SA firms exporting AI tools. CDOs must reconcile these frameworks, particularly for EU clients, where non-compliance risks penalties of up to 6% of global revenue.
The regulatory analysis of POPIA, UK GDPR, and EU AI Act differences assumes general knowledge and may require validation by a legal expert, as no source materials explicitly compare these frameworks. The US-China coordination signal (Source 6) is