The South African Bureau of Standards (SABS) has put draft artificial intelligence standards out for public comment, and anyone can comment until 10 November 2026. The drafts adopt international ISO/IEC documents without change and are voluntary, but Werksmans director Wendy Rosenberg says they are likely to become the local benchmark for responsible AI. South Africa has no AI law and no national AI policy at the moment, so for a business that uses AI, these are the nearest thing to written expectations. This is what is in them, what they do not do, and what to do before the deadline.
What this means for your business: nothing in the drafts is compulsory today, and nobody can fine you for ignoring them. But customers, banks and insurers need something to point to when they ask how you manage AI, and the documents give them a common vocabulary on disclosure, data quality and human control. Commenting is open to any organisation that develops or uses AI.
What SABS has published
The drafts were gazetted on 11 September 2026 in Government Gazette 55353 (Department of Trade, Industry and Competition Notice 4147 of 2026), which gives the standard 60-day comment period, so this is a deadline story, not a surprise announcement. They were prepared by SABS subcommittee SC 42, Artificial Intelligence, which mirrors the international committee that wrote the originals. Each draft is, in Werksmans’ words, an identical adoption of an existing ISO/IEC document, without local changes. The eight, as listed on the SABS public enquiry page:
| SABS draft | Subject | International source |
|---|---|---|
| SANS 12792 | A taxonomy of what to disclose about an AI system | ISO/IEC 12792:2025, standard |
| SANS 2620 parts 1, 2, 3 and 5 | Data quality for analytics and machine learning: overview, measures, management requirements, governance framework | ISO/IEC 5259 parts 1, 2, 3 and 5 (2024 and 2025), standards |
| SATS 8200 | Controllability of automated AI systems | ISO/IEC TS 8200:2024, technical specification |
| SATR 24030 | A collection of AI use cases | ISO/IEC TR 24030:2024, technical report |
| SATR 20226 | Environmental sustainability aspects of AI systems | ISO/IEC TR 20226:2025, technical report |
A note on numbers, because some early reports got them wrong: the transparency standard is ISO/IEC 12792, as the ISO catalogue shows, not 12892, and ISO/IEC 20226 is a technical report, not a technical specification. ISO also titles TR 24030 “Use cases”, whereas SABS’s list calls it “Beneficial AI systems”; it is a catalogue of examples, and Werksmans says it collects 81 use case summaries. A second batch of three AI drafts (guidance for AI applications, machine learning computing devices and functional safety) closed for comment on 16 September.
What they ask of a business
Most of the eight describe, not demand. Going by the text of the drafts:
- Transparency (12792). Its scope is a taxonomy of information elements that help AI stakeholders work out what transparency they need, across four levels: the wider context, the system, the model and the dataset. It is a menu of what could be disclosed, and the text says elements do not necessarily apply to every system, including cases where disclosure is not appropriate, such as proprietary source code.
- Data quality (2620, from ISO/IEC 5259). Part 3 is the one written as requirements: it covers establishing and improving the quality of data used for analytics and machine learning, with documented processes across the data life cycle. Part 5 sets out what the board or governing body should direct and oversee. Parts 1 and 2 are the overview, terminology and quality measures.
- Controllability (SATS 8200). This sets a framework for observing an AI system’s state and handing control back to a person. The text says the provider of an AI system shall give users descriptions and documentation of its controllability features. Controllability is a prerequisite of human oversight, not oversight itself.
- Use cases and environment (SATR 24030, SATR 20226). Both are informative. The environmental report gives a life-cycle view of workload, carbon impact, waste and other effects, with potential metrics, and places no duties on organisations.
Voluntary, and how that can change
The SABS says its standards are designed for voluntary use, but that laws and regulations may refer to them and make compliance compulsory. Two routes exist in law. Section 28 of the Standards Act lets a South African National Standard be incorporated in any law, for products and services that affect safety, health or the environment. Sections 13 and 14 of the National Regulator for Compulsory Specifications Act let the minister declare a standard compulsory, after which nobody may import, sell or supply the product except in accordance with it. We found no sign that any AI standard has been used in either way.
Two further points. Only SANS 12792 and SANS 2620 would become full South African National Standards; the drafts for SATS 8200 and the two technical reports say they do not have that status. And the Standards Act prohibits falsely claiming that a product or service complies with a South African National Standard, so do not print “SANS-compliant” on anything unless you have checked.
Not SABS’s first AI standards
These drafts sit on top of a foundation SABS already adopted. On 24 April 2026 it approved SANS 42001, the AI management system standard that organisations can build a programme around, together with SANS 42006 (requirements for the bodies that audit and certify such systems), SANS 42005 (AI impact assessment), SANS 23894 (AI risk management) and SANS 22989 (AI terminology), and it adopted SANS 38507 on AI governance in 2025. The SABS store lists SANS 42001 at R2,249.40. Whether any accredited body in South Africa yet certifies to ISO/IEC 42001 we could not confirm.
The policy vacuum around them
The standards arrive while government policy is being rewritten. The draft National AI Policy was published for comment on 10 April 2026 and withdrawn after it was found to contain fabricated citations; Communications Minister Solly Malatsi said on 26 April that the most plausible explanation was that AI-generated citations were included without proper verification. A Gazette notice withdrew it formally on 12 June. We covered it in South Africa’s AI policy was pulled after it cited studies that do not exist.
On timing, Malatsi told TechCabal on 15 October that government remains confident Cabinet will finalise the replacement before the end of March 2027, with public consultation expected to begin in April. Earlier targets of November 2026 and January 2027 have slipped. The department has also said the redraft will not prescribe rules to industry and will give sectors national guidelines to build their own strategies on, according to a senior official in TechCentral’s July report.
Until then, the rules that bind a business using AI are the general ones. Section 71 of the Protection of Personal Information Act says a person may not be subject to a decision with legal consequences or substantial effect that is based solely on automated processing of personal information to profile them, unless exceptions apply, and where they do the person must get a chance to make representations and sufficient information about the underlying logic. Information Regulator chair Pansy Tlakula told ITWeb on 17 September that with no national AI policy “it’s a free for all”. The Reserve Bank and the Financial Sector Conduct Authority reported in November 2025 that 52% of banks surveyed were using AI and asked institutions to disclose AI use in consumer-impacting decisions, but that is a report, not binding rules. Our POPIA data breach guide covers the data protection side.
How to comment, and what to do now
Comments go to dsscomments@sabs.co.za by 10 November 2026. The cover sheet of each draft asks you to use the SABS commenting template, to give the clause number each comment refers to, to motivate it and, where relevant, to propose amended text. SABS also says that the public enquiry will be repeated only if the committee agrees significant technical changes. Because the drafts are identical adoptions, we expect little room to change the text itself, so the most useful comments are likely to be on whether and how a local standard should be applied (our reading, not SABS’s statement).
- List where you use AI, including tools your suppliers run on your behalf, and which of those touch customer data or decisions about people.
- Ask vendors what they will disclose against the SANS 12792 headings: intended purposes, limitations, data used and known biases.
- Check POPIA section 71 wherever a system makes or heavily shapes a decision about a person.
- Decide whether to read the earlier standards, in particular SANS 42001, if customers are likely to ask for management-system evidence.
- Make a note of the deadline, and comment if the drafts would affect a product you sell.
Related reading: our guide to AI tools for your business, and South Africa’s push for UN rules on AI.
What we could not confirm
We could not confirm whether any SABS or accredited body certifies to ISO/IEC 42001 in South Africa, when SABS expects to approve the eight drafts, or whether the revised national AI policy will refer to SABS standards: no source says so, and the withdrawn draft did not mention SABS. The text of the National Norm that governs adoption is paid and we did not read it. The suspension of officials over the policy is the minister’s figure of two; some reports have said more.
