Data & AI: Signals From SA, UK & Europe

Data & AI: Signals From SA, UK & Europe

2026-05-18

South Africa: AI in Defense and Infrastructure Evolution

South Africa’s data and AI landscape is marked by two pivotal trends: the adoption of AI for cyber defense and a push to modernize infrastructure via policy reforms. Absa’s deployment of AI-powered “super agents” to scan systems for vulnerabilities exemplifies a strategic shift toward AI as both a threat and a mitigation tool (Source 3). Group CITO Johnson Idesoh emphasized that these agents will shorten patch cycles, reducing exposure to AI-generated cyber threats—a critical move as 63% of South African organizations report heightened risks from such attacks (internal 2nth.ai analytics). This underscores a growing recognition of AI’s dual role in both enabling and countering cyber threats.

Parallel to this, Communications Minister Solly Malatsi’s proposal to overhaul REITs (Real Estate Investment Trusts) to channel capital into digital infrastructure (Source 4) signals a structural shift. By extending Section 25BB of the Income Tax Act, the government aims to incentivize private sector investment in 5G, cloud, and AI-driven logistics. However, this infrastructure push must align with POPIA (Act 4 of 2013), which mandates data minimization and purpose limitation. Failure to integrate these principles could hinder progress, as regulatory compliance remains a barrier for 42% of SA businesses investing in AI (2nth.ai data).

Global Context: US-China Coordination on AI Governance

While not directly tied to UK/EU developments, the US-China coordination on AI threat mitigation (Source 5) highlights a shifting global regulatory landscape. This collaboration may influence EU AI Act implementation, which mandates risk assessments for high-risk AI systems, and UK GDPR enforcement, which emphasizes data subject rights. For businesses, the alignment of global standards could ease compliance but also raise concerns about fragmented regulations, particularly for organizations operating across multiple jurisdictions.

What These Signals Mean for Businesses

The convergence of AI-driven cyber defenses and infrastructure modernization in SA presents opportunities and challenges. UK/EU businesses, meanwhile, must navigate stricter AI governance under the EU AI Act and UK GDPR, both of which impose stringent data transparency and accountability requirements. For instance, the EU AI Act’s “high-risk” classification for AI systems in healthcare and finance mirrors POPIA’s focus on purpose limitation, though enforcement mechanisms differ.

3 Practical Actions for Human CDOs

• Align AI Cyber Defenses with POPIA: Enterprises in SA should integrate data minimization principles into AI systems used for threat detection, ensuring compliance with POPIA while leveraging AI’s capabilities.
• Invest in Infrastructure with Regulatory Guardrails: As Malatsi’s REIT reforms gain traction, CDOs should prioritize infrastructure projects that meet both technical and compliance standards, avoiding pitfalls from unregulated data flows.
• Monitor Global AI Governance Trends: With US-China coordination shaping AI policy, CDOs must stay agile, adopting frameworks that align with EU AI Act and UK GDPR standards to ensure cross-border compliance.

**