Legal & Risk: What Businesses Need to Watch
Date: 2026‑08‑22
Every headline hides a compliance cliff. This week’s stories illustrate how seemingly routine developments can trigger hidden legal obligations across finance, consumer markets and employment law. Below are three cases that most managers miss—plus concrete actions you should flag for your corporate counsel.
---
1. AI‑First Banking – Standard Bank’s Self‑Declared Transformation
Standard Bank’s senior risk officer has publicly announced a shift to an “AI‑enabled organisation” (as noted in "[We’re becoming an AI-enabled organisation] – Standard Bank’s Margaret Nienaber" — Moneyweb). While the headline is all talk, the legal ramifications are profound.
- POPIA and Profiling – Any algorithm that scores or classifies customers for credit or risk must be compliant with POPIA Act 4 of 2013. The law requires lawful basis, purpose limitation, and data minimisation; more importantly, it mandates a “processing impact assessment” when personal data is used to produce decisions that materially affect a person’s rights (see §9(b)).
- Algorithmic Transparency – Under the emerging “Artificial Intelligence Act” being drafted in the EU, South African companies with cross‑border exposure must disclose key algorithm characteristics. A non‑compliant model could lead to reputational damage and regulatory scrutiny from both POPIA and potential EU oversight.
- Corporate Governance – The Companies Act 71 of 2008 obliges directors to disclose material risks in annual reports. Failing to include AI‑related risk factors could be a breach of fiduciary duty, exposing the board to civil liability.
Compliance Actions for Your CLO
- Order an internal POPIA Impact Assessment focusing on all customer‑facing AI modules.
- Draft an “AI Transparency Policy” that lists model inputs, decision thresholds and recourse procedures for affected customers.
- Include a section on AI risk in the next annual report, with board sign‑off.
---
2. Subscription Pricing Upshot – R299 Electric Car Charging
A new GridCars subscription promises drivers up to R299 per month to accrue public charging credits (referencing "[South Africa's new R299 electric car charging subscription analysed] — MyBroadband"). This deal is more than a pricing gimmick; it tests the limits of consumer protection and data privacy.
- Consumer Protection Act 68 of 2008 – The CPA requires that subscription terms be “clear, concise and fair.” Hidden fees, auto‑renewal clauses or unclear credit redemption rules can render an offer non‑compliant.
- POPIA Considerations – Subscription services collect location data, vehicle usage patterns and payment details. POPIA mandates lawful processing, clear consent, and data retention limits. Any breach could trigger fines up to R10 million (PCA 12 of 2004).
- Energy Sector Regulation – GridCars operates within the Eskom distribution framework; contracts must align with the National Energy Regulator’s licensing requirements.
Compliance Actions for Your CLO
- Conduct a CPA fairness audit on all subscription clauses, ensuring explicit disclosure of costs, credit usage, and termination procedures.
- Implement POPIA‑compliant data handling protocols: obtain explicit consent, restrict data retention to the minimal period required for service fulfilment, and set up an opt‑out mechanism.
- Verify that any partnership with utility providers meets regulatory licensing standards.
---
3. Zero‑Hours Contracts – A Labour Law Red Flag
UK unions are concerned that a Labour government plan to curb zero‑hours contracts could conflict with its manifesto pledge (as detailed in "[Unions worry Labour’s plan for zero-hours contracts may break manifesto pledge] — The Guardian"). The issue reverberates beyond the UK, as many global firms source flexible labour from contractors operating under similar arrangements.
- Labour Relations Act 66 of 1995 – South African employers must treat employees as “workers” or “employees” and cannot arbitrarily deny statutory rights. Zero‑hour agreements that leave workers in a state of perpetual uncertainty risk being re‑classified as employment contracts, exposing firms to back‑pay claims.
- Minimum Wage Compliance – The Basic Conditions of Employment Act 75 of 1997 requires that all workers be paid at least the minimum wage for hours actually worked. If zero‑hour workers are paid on a per‑hour basis but not guaranteed minimum hours, the employer risks non‑compliance.
- Employment Equity and Fair Labour Practices – The Equality Clause in the LRA mandates fairness and equal treatment. Contracts that discriminate by offering lower pay to temporary staff can trigger statutory action.
Compliance Actions for Your CLO
- Review all zero‑hour or “on‑call” contracts against the LRA, ensuring clear definitions of working hours, notice periods, and remuneration calculations.
- Implement a robust tracking system that records actual hours worked versus contracted hours to satisfy minimum wage obligations.
- Conduct an equity audit to confirm no discriminatory practices are embedded in flexible employment arrangements.
---
Closing Thoughts
These stories illustrate that compliance is not just about avoiding fines—it’s about building sustainable operational frameworks. From AI ethics and consumer pricing to labour fairness, each sector demands proactive legal scrutiny. Bring these issues into your next risk review cycle and let the human legal director refine the details.
Review Note:
The interpretations above draw on South African legislation (POPIA, CPA, LRA, Companies Act) and UK law via the Guardian article. Confirmation from a qualified lawyer is required before finalising any policy or contractual wording, especially where cross‑border data flows and emerging EU AI regulations may impose additional obligations.
---