Free AI Governance Assessment - AI Governance Oversight Checklist

How to Use This Tool ▾

Purpose: This tool is a self-assessment instrument for directors of South African private and listed companies. It enables the board to assess the maturity of the organisation's AI governance practices against King V Principle 10 - Data, Information and Technology - and supporting international frameworks.

Who should complete this assessment: This checklist is designed for completion by the board as a collective exercise, facilitated by the company secretary or chair. Alternatively, individual directors may complete it independently and compare scores as part of a board discussion on AI governance.

Scoring: For each of the 30 questions, select one of three responses: Yes - In Place (2 points): the board is satisfied this is comprehensively in place. Partially / In Progress (1 point): some activity exists but material gaps remain. No - Not in Place (0 points): this is not in place or the board cannot confirm it.

Interpreting "Yes": A Yes response should reflect the board's own confident assessment - not management's assertion to the board. If the board cannot independently verify a practice is in place and functioning, the honest response is Partially or No.

After completing the assessment: Review your maturity level and domain scores. Use low domain scores to prioritise the board's AI governance agenda. Consider commissioning a formal BoardEvaluator™ AI Governance Status Assessment for independent expert analysis and a board-ready report.

Progress: Your progress saves automatically as you work. To return to a partially completed assessment, simply reopen this file - your responses will be restored. Use Save Progress to manually save at any point. Use Reset to start a new assessment (this clears all saved responses).

Governance Frameworks Referenced - Verified as at 11 May 2026

Framework	Version / Status	Custodian	Effective Date
King V Code on Corporate Governance for South Africa	2025 (final)	IoDSA / King Committee	Financial years on or after 1 Jan 2026
King V Disclosure Framework	2025 (final)	IoDSA / King Committee	Financial years on or after 1 Jan 2026
Companies Act 71 of 2008	Consolidated to 27 Dec 2024	South African Parliament	In force
OECD Principles on AI	May 2019, updated 2024	OECD	In force
NIST AI Risk Management Framework (AI RMF 1.0)	January 2023	US National Institute of Standards and Technology	In force
ISO/IEC 42001:2023	2023	ISO / IEC	In force
Protection of Personal Information Act 4 of 2013 (POPIA)	Fully operative from 1 July 2021	South African Parliament / Information Regulator	In force

Regulatory note: South Africa does not have dedicated AI legislation in force as at 11 May 2026. King V Principle 10 is the primary South African governance framework reference for board-level AI oversight. Directors should monitor regulatory developments through the AI Institute of South Africa and relevant government policy publications.

Important Notice - Please Read Before Using This Tool ▾

What this tool is: T-BG-SA001 is a self-assessment instrument designed to help directors of South African private sector companies evaluate the maturity of their board's AI governance practices. It is provided by Celagenix Corporate Academy as an educational and governance development tool.

What this tool is not: This tool is not a legal opinion, regulatory opinion, or formal governance evaluation. Completing this tool does not confirm compliance with any law, code or regulatory requirement. Scores are based on the board's own self-assessment and have not been independently verified. This tool does not constitute advice of any kind - legal, governance, technical or otherwise.

Governance framework basis: This tool is grounded in King V - the Code on Corporate Governance for South Africa, 2025, published by the IoDSA and the King Committee on Corporate Governance on 31 October 2025. King V is effective for financial years commencing on or after 1 January 2026. For JSE-listed companies, application of King V and use of the King V Disclosure Framework is required by the JSE Listings Requirements. For private unlisted companies, King V represents the leading governance standard and is persuasive but not statutorily mandatory.

South African AI legislation: As at 11 May 2026, South Africa does not have dedicated AI legislation in force. King V Principle 10 is the primary South African governance framework reference for board-level AI oversight. Directors should monitor regulatory developments through the AI Institute of South Africa and relevant government policy publications. The South African AI regulatory landscape is evolving rapidly; professional advice is recommended for material AI governance decisions.

Regulated financial services entities: Directors of companies regulated by the Financial Sector Conduct Authority (FSCA), the South African Reserve Bank Prudential Authority, or other sector regulators should note that additional governance requirements may apply to AI systems used in regulated activities. These additional requirements are not covered by this tool. Specialist regulatory advice should be obtained.

POPIA: This tool references the Protection of Personal Information Act 4 of 2013 (POPIA). POPIA as applied to AI data processing involves developing regulatory interpretation. Directors should seek guidance from the organisation's Information Officer and, where material, from a qualified information law practitioner.

Professional advice: The Academy strongly recommends that boards supplement this self-assessment with formal, expert-facilitated evaluation. For a formal, independently assessed AI governance evaluation - producing a consolidated board report and benchmarked recommendations - visit the BoardEvaluator™ AI Governance Status Assessment.

Frameworks-verified date: All governance framework and legislative references in this tool were verified against current sources as at 11 May 2026. This tool should be reviewed by May 2027, or earlier if material regulatory changes occur. Jurisdiction: South Africa · Private Sector · Companies Act 71 of 2008 · King V 2025.

Governance Maturity Assessment - Score Dashboard

0% Maturity

Not Yet Started

Complete the checklist below to assess your board's AI governance maturity. Answer all 30 questions across 6 domains to receive your full score and recommendations.

Your AI governance gap requires urgent board attention.

Your score indicates that the board's AI governance practices are at the Ad Hoc or Developing stage - a position of material risk in the context of King V Principle 10 and the director duty of care standard in s76 of the Companies Act. A self-assessment is the right starting point. But a self-assessment alone is not sufficient to address a governance gap of this magnitude.

The BoardEvaluator™ AI Governance Status Assessment provides:

Independent, expert-facilitated evaluation across all six AI governance domains
A confidential, board-ready assessment report with scored findings and specific recommendations
Benchmarking against comparable South African organisations
A prioritised remediation roadmap that the board can act on immediately

Commission a BoardEvaluator™ Assessment →

Strong foundations. Specific gaps remain.

Your score confirms that the board has established a credible AI governance framework that broadly meets King V Principle 10 expectations. The domain-level breakdown reveals where specific gaps remain. Closing those gaps - efficiently and with confidence - requires more than a checklist.

The BoardEvaluator™ AI Governance Status Assessment provides:

A formal, expert-evaluated assessment that validates your self-assessment scores and identifies blind spots
Targeted recommendations for each domain gap, with practical implementation guidance
A consolidated board report suitable for presenting to the board, its committees and key stakeholders
Benchmarking data to contextualise your score against peer organisations in the South African market

Request a BoardEvaluator™ Assessment →

Governance excellence, well evidenced.

Your score indicates that the board is operating at an Advanced level of AI governance maturity - consistent with King V Principle 10 and international leading practice. Achieving Advanced maturity is significant. Sustaining it - as AI technology evolves, the South African AI regulatory environment develops, and stakeholder scrutiny intensifies - requires ongoing discipline and independent validation.

The BoardEvaluator™ AI Governance Status Assessment provides:

Periodic independent validation of governance excellence, producing externally credible evidence of the board's AI oversight rigour
An updated benchmarking analysis as the South African AI governance landscape evolves
A board-ready assessment report that supports disclosure obligations under the King V Disclosure Framework
Early identification of emerging governance gaps before they become material risks

Schedule a BoardEvaluator™ Assessment →

0 – 25% · 0–15 pts

Ad Hoc

No formal AI governance structure. Immediate board action required.

26 – 50% · 16–30 pts

Developing

Some awareness but governance is informal and incomplete. Key gaps remain.

51 – 75% · 31–45 pts

Defined

Structured approach broadly in place. Specific domains require strengthening.

76 – 100% · 46–60 pts

Advanced

Robust, integrated AI governance consistent with King V Principle 10.

Yes - In Place = 2 points

Partially / In Progress = 1 point

No - Not in Place = 0 points

AI Strategy & Policy

Board AI Mandate & Strategic Direction

0/10

▾

King V Principle 10 requires the board to govern data, information and technology "in a way that enables the organisation to sustain and optimise its strategy and objectives." AI governance starts with the board: approving the framework, setting the risk appetite, and ensuring AI activity is integrated into - not isolated from - the organisation's strategy.

T-BG-SA001.1.1

Has the board approved a formal AI governance framework or policy that defines the organisation's approach to the acquisition, development, use and distribution of artificial intelligence?

King V Principle 10, Practice 2: "The governing body should consider and approve policies, standards and frameworks that give effect to its direction on the acquisition, development, use and distribution of technology products and services within and by the organisation." (IoDSA, King V Code, 31 October 2025)

T-BG-SA001.1.2

Does the board have sufficient collective understanding of how artificial intelligence is currently being used - or is proposed to be used - within the organisation and its material third-party relationships to fulfil its oversight obligations?

King V Principle 1, Practice 1(b)(i): Competence requires "acquiring sufficient working knowledge of... the risks and opportunities associated with the organisation's economic, social and environmental context." (IoDSA, King V Code, p.4); Companies Act s76(3)(a): Director must take reasonably diligent steps to become informed on matters of decision-making.

T-BG-SA001.1.3

Is the board's AI governance framework explicitly integrated into the organisation's overall strategy and business model - rather than treated as a standalone technology policy?

King V Principle 10: The governing body governs data, information and technology "in a way that enables the organisation to sustain and optimise its strategy and objectives." (IoDSA, King V Code, p.23); King V Principle 3, Practice 20: The governing body approves strategy "representative of integrated thinking." (IoDSA, King V Code, p.9)

T-BG-SA001.1.4

Has the board approved a defined AI risk appetite statement that sets the boundaries within which management may develop, deploy or procure AI systems - and is this statement reviewed at least annually?

King V Principle 10, Practice 2: The governing body must ensure "the assessment, evaluation and responses to the risks and opportunities associated with emerging, innovative and disruptive technologies to ensure the alignment of current risk exposures with established risk appetite and tolerance levels." (IoDSA, King V Code, p.24); King V Principle 8 (Risk).

T-BG-SA001.1.5

Does the board receive at least one dedicated briefing per year on artificial intelligence developments - including new AI deployments, material risks, regulatory updates and industry trends - to maintain the competence required for effective AI oversight?

King V Principle 5, Practice 37(g): "A programme for professional development, that includes regular briefings on legal, regulatory and corporate governance developments as well as on emerging risks and opportunities, is offered to members of the governing body." (IoDSA, King V Code, p.12); Companies Act s76(3)(b): Director must act with due care, skill and diligence.

Risk & Assurance

AI Risk Oversight & Assurance Framework

0/10

▾

AI systems introduce risks that conventional ERM frameworks may not capture. King V Principle 10 requires the board to ensure that risks associated with emerging and disruptive technologies are assessed, evaluated and aligned with the organisation's risk appetite. This domain assesses whether the board has the oversight structures, information flows and assurance mechanisms to govern AI risk effectively.

T-BG-SA001.2.1

Are AI-specific risks - including model failure, algorithmic bias, data quality failures, AI supply chain risk and reputational harm - explicitly included in the organisation's risk register and reported to the board at least quarterly?

King V Principle 10, Practice 2: "Assessment, evaluation and responses to the risks and opportunities associated with emerging, innovative and disruptive technologies to ensure the alignment of current risk exposures with established risk appetite and tolerance levels." (IoDSA, King V Code, p.24); King V Principle 8 (Risk).

T-BG-SA001.2.2

Has the board assigned clear oversight responsibility for AI governance to a specific board committee - such as the risk committee, audit committee, or a dedicated technology governance committee - with a defined mandate that includes AI?

King V Principle 6, Practice 66: "The governing body should delegate the oversight of the system of organisation-wide risk management to a dedicated committee... The governing body may delegate further responsibilities to it including oversight of compliance, as well as of data, information and technology." (IoDSA, King V Code, p.17); King V Principle 10, Practice 1: Delegation to "the committee responsible for risk governance or to another appropriate committee."

T-BG-SA001.2.3

Does the board receive structured assurance - from internal audit, external audit, or another independent assurance provider - on the effectiveness of the organisation's AI risk controls, at a frequency appropriate to the level of AI adoption?

King V Principle 12 (Assurance): The governing body is accountable for combined assurance; King V Principle 10, Practice 2: Effective oversight of technology includes "minimum requirements for assurance to be provided by the service provider." (IoDSA, King V Code, p.24); NIST AI RMF - Measure function.

T-BG-SA001.2.4

Does the organisation have a documented AI incident response protocol - including defined escalation thresholds, board notification triggers, and a post-incident review process - and has this been tested in the past 24 months?

King V Principle 10, Practice 2: "Arrangements for organisational resilience and disaster recovery planning and testing." (IoDSA, King V Code, p.24); NIST AI RMF - Manage function: AI risks are treated, responded to, and recovered from.

T-BG-SA001.2.5

Has the board satisfied itself that the organisation's enterprise risk management framework is sufficiently sophisticated to identify and assess AI-specific risks - and, where it is not, has it directed management to close identified gaps?

King V Principle 8 (Risk): The governing body governs risk "in a way that supports the organisation in setting and achieving its strategic objectives within its risk appetite." (IoDSA, King V Code, p.21); Companies Act s76(3)(c): Director must exercise care, skill and diligence in monitoring management and implementation.

Ethics & Accountability

Responsible AI & Ethical Governance

0/10

▾

King V Principle 10 explicitly identifies nine values - ethics, human centricity, accountability, transparency, explainability, security, privacy, fairness and trustworthiness - that must govern the organisation's AI practices. These are not aspirational; they are the board-level governance standard. This domain assesses whether the board has embedded these values and can demonstrate accountability for them.

T-BG-SA001.3.1

Has the board approved a set of AI ethics principles - aligned with King V's nine AI governance values (ethics, human centricity, accountability, transparency, explainability, security, privacy, fairness and trustworthiness) - that govern all AI development, procurement and deployment within the organisation?

King V Principle 10, Practice 2: "Adherence to the values of ethics, human centricity, accountability, transparency, explainability, security, privacy, fairness and trustworthiness." (IoDSA, King V Code, p.24 - exact wording); King V Principle 2 (Ethics): The board is accountable for ethical culture.

T-BG-SA001.3.2

Does the organisation have clearly defined accountability structures for AI decisions, outputs and outcomes - including named individuals accountable for each material AI system - and is this accountability structure reported to and overseen by the board?

King V Principle 10, Practice 2: "Clear accountability for designs, actions, outputs and outcomes - which includes subjecting the processes, data, models, algorithms, resources and tools used in the development, implementation, monitoring and management of automated technologies to human oversight and override mechanisms that are commensurate with the level of risk to the organisation and its stakeholders." (IoDSA, King V Code, p.24 - exact wording); OECD AI Principle 1.4: Accountability.

T-BG-SA001.3.3

Are human oversight and override mechanisms in place for all AI systems that make or materially influence decisions affecting stakeholders - and are these mechanisms calibrated to the level of risk posed by each AI system?

King V Principle 10, Practice 2: "Subjecting the processes, data, models, algorithms, resources and tools used in the development, implementation, monitoring and management of automated technologies to human oversight and override mechanisms that are commensurate with the level of risk to the organisation and its stakeholders." (IoDSA, King V Code, p.24 - exact wording); NIST AI RMF - Govern function.

T-BG-SA001.3.4

Has the board received assurance that the organisation's AI systems are regularly tested for bias, fairness and discriminatory outcomes - particularly in AI systems that affect employees, customers or communities?

King V Principle 10, Practice 2: Values of "fairness" and "human centricity." (IoDSA, King V Code, p.24); King V Principle 2, Practice 18(a): Corporate citizenship obligations including "employment equity... and diversity, equity and inclusion in the workplace." (IoDSA, King V Code, p.8); OECD AI Principle 1.1: Inclusive growth, sustainable development and well-being.

T-BG-SA001.3.5

Is the board satisfied that the organisation can explain, in terms accessible to affected stakeholders, how its material AI systems arrive at decisions or recommendations - and that this explainability is maintained as AI systems evolve?

King V Principle 10, Practice 2: Values of "transparency" and "explainability." (IoDSA, King V Code, p.24 - exact wording); OECD AI Principle 1.3: Transparency and explainability; King V Principle 13 (Stakeholders): Board accountable for quality of stakeholder relationships.

Data & Cybersecurity

AI Data Governance & Cyber Risk

0/10

▾

King V Principle 10, Practice 1 makes the board directly accountable for the effective, compliant and ethical management and control of data and information. Practice 2 extends this to cybersecurity. In South Africa, POPIA creates additional legal obligations for AI systems that process personal information. This domain examines whether the board is governing the data and cyber dimensions of AI.

T-BG-SA001.4.1

Has the board approved policies and standards governing the quality, integrity and provenance of data used to train, validate and operate the organisation's AI systems - including controls over biased, incomplete or unauthorised data?

King V Principle 10, Practice 1: "The governing body should provide the strategic direction and be accountable for the effective, compliant and ethical management and control (including acquisition, creation, use, dissemination and disposal) of data and information." (IoDSA, King V Code, p.23); NIST AI RMF - Measure function.

T-BG-SA001.4.2

Is the board satisfied that the organisation's AI data practices comply with the Protection of Personal Information Act 4 of 2013 (POPIA) - particularly in relation to AI systems that process personal information - and that the Information Officer has the necessary mandate and resources to oversee POPIA compliance in AI contexts?

POPIA ss8 and 22 and conditions for lawful processing; King V Principle 9 (Compliance): The governing body is accountable for the organisation's compliance with applicable laws; King V Principle 10, Practice 1: Ethical management of data includes legal compliance. Note: POPIA as applied to AI data processing involves developing regulatory interpretation. Directors should seek guidance from the organisation's Information Officer and, where material, from a qualified information law practitioner.

T-BG-SA001.4.3

Does the board receive regular reporting on cybersecurity threats specifically associated with AI systems - including adversarial attacks, model poisoning, data manipulation and AI-enabled cyber intrusions - and has the organisation's cyber security strategy been explicitly updated to address AI-specific threats?

King V Principle 10, Practice 2: "Effective cyber security strategies and practices to protect technology assets, resources, products and services." (IoDSA, King V Code, p.24); King V AI governance value: security.

T-BG-SA001.4.4

Has the board approved data lifecycle governance standards that address the full lifecycle of AI-related data - from acquisition and use through to archiving and disposal - including cross-border data transfer considerations where AI services are hosted or processed outside South Africa?

King V Principle 10, Practice 1: Acquisition, creation, use, dissemination and disposal of data and information. (IoDSA, King V Code, p.23); POPIA s72: Cross-border transfer of personal information - conditions apply to AI systems using offshore cloud or AI processing services.

T-BG-SA001.4.5

Is the board satisfied that the organisation maintains adequate data minimisation and purpose-limitation practices in its AI systems - ensuring that AI is not used to process personal information beyond the scope for which consent or another lawful basis was obtained?

King V Principle 10, Practice 1: Compliant management of data. (IoDSA, King V Code, p.23); POPIA Condition 3 (Purpose specification) and Condition 4 (Further processing limitation); King V Principle 9 (Compliance): Board accountable for compliance with applicable laws.

Procurement & Deployment

AI Acquisition, Oversight & Performance

0/10

▾

South African boards increasingly depend on AI systems procured from third-party vendors. King V Principle 10, Practice 2 makes the board accountable for the acquisition, development, use and distribution of technology - including managing the risks of outsourced AI services. This domain examines whether the board maintains effective oversight across the full AI lifecycle: from procurement through deployment, monitoring and decommissioning.

T-BG-SA001.5.1

Does the board's delegation of authority framework include defined thresholds for board approval of material AI procurement decisions - ensuring the board is not bypassed when AI systems with significant strategic, risk or ethical implications are acquired?

King V Principle 7, Practice 82: "The governing body should approve a delegation of authority framework that sets out the decision-making powers to be reserved for itself, and those that are delegated to management." (IoDSA, King V Code, p.19); King V Principle 10, Practice 2: Board accountable for compliant acquisition of technology.

T-BG-SA001.5.2

Does the organisation's AI procurement process require pre-deployment assessment of AI systems for ethical risk, bias, explainability limitations, and alignment with the organisation's AI ethics principles - before any material AI system is approved for production use?

King V Principle 10, Practice 2: "Assessment, evaluation and responses to the risks and opportunities associated with emerging, innovative and disruptive technologies." (IoDSA, King V Code, p.24); King V AI governance values of ethics, fairness and accountability. NIST AI RMF - Map function: AI risks and their context are identified and classified.

T-BG-SA001.5.3

Has the board satisfied itself that material AI vendor contracts include: minimum assurance requirements from the vendor; the organisation's right to audit AI system performance; provisions governing the vendor's data processing practices under POPIA; and liability and indemnity provisions that address AI-specific failure scenarios?

King V Principle 10, Practice 2: "Effective management of the risks associated with the acquisition and utilisation of outsourced technologies and services, including having minimum requirements for assurance to be provided by the service provider." (IoDSA, King V Code, p.24 - exact wording); POPIA s21: Operator obligations - where AI vendor processes personal information on the organisation's behalf.

T-BG-SA001.5.4

Does the board receive performance reporting on material AI systems - including accuracy metrics, error rates, fairness outcomes and user complaint volumes - at a frequency appropriate to the risk profile of each system?

King V Principle 10, Practice 2: Oversight and monitoring of technology performance. (IoDSA, King V Code, p.24); King V Principle 3, Practice 22: "Ongoing oversight and monitoring of the implementation and execution of strategy and operational planning." (IoDSA, King V Code, p.9); NIST AI RMF - Measure function.

T-BG-SA001.5.5

Does the organisation have a defined process for decommissioning AI systems - including data deletion, model retirement, vendor contract termination and stakeholder notification where required - and has the board received assurance that this process is consistent with the organisation's data management obligations under POPIA?

King V Principle 10, Practice 1: The governing body is accountable for the "effective, compliant and ethical management and control (including acquisition, creation, use, dissemination and disposal) of data and information." (IoDSA, King V Code, p.23 - the word "disposal" appears verbatim in Practice 1); POPIA Condition 7: The responsible party must secure the integrity and confidentiality of personal information, including destruction or deletion of personal information that is no longer needed.

Reporting & Disclosure

AI Transparency & Stakeholder Reporting

0/10

▾

King V Principle 4 and Principle 10 together create a board-level obligation to disclose AI governance practices in a manner that is transparent and useful to stakeholders. For JSE-listed companies, the King V Disclosure Framework is a mandatory disclosure vehicle. This domain examines whether the board is discharging its AI transparency and disclosure obligations effectively.

T-BG-SA001.6.1

Does the board's annual governance disclosure - whether through an integrated report, sustainability report, or the King V Disclosure Framework - include meaningful disclosure of the organisation's AI governance practices, including how Principle 10 has been applied in relation to AI?

King V Principle 10 (Disclosure Framework): The governing body must disclose whether it is satisfied that technology, data and information are being managed ethically, effectively and in compliance with law. (IoDSA, King V Disclosure Framework, 31 October 2025); King V Principle 4, Practice 25: Board approves reporting suite including King V Disclosure Framework. For JSE-listed companies, application of King V and its Disclosure Framework is required by the JSE Listings Requirements.

T-BG-SA001.6.2

Has the board considered how to communicate the organisation's AI ethics stance and AI risk posture to shareholders and other key stakeholders - and are AI-related risks and opportunities disclosed in the organisation's material risk reporting?

King V Principle 4, Practice 26: Sustainability information must encompass "matters that generate risks and opportunities which significantly affect... the organisation's financial position, financial performance, cash flows, access to finance or cost of capital over the short, medium or long term." (IoDSA, King V Code, p.10); King V Principle 13 (Stakeholders): Board accountable for quality of stakeholder relationships.

T-BG-SA001.6.3

Where the organisation uses AI in decision-making processes that materially affect customers, employees or communities, does it disclose the existence and general nature of such AI use in relevant communications, terms of service, or regulatory filings?

King V Principle 10, Practice 2: Values of transparency and explainability. (IoDSA, King V Code, p.24); POPIA s18: Notification obligation to data subjects regarding automated processing of personal information; King V Principle 13 (Stakeholders): Ubuntu-Botho philosophy of responsible engagement with stakeholders. Note: Directors of regulated entities should note that the FSCA and SARB Prudential Authority may impose additional disclosure obligations on AI use in financial services.

T-BG-SA001.6.4

Has the board approved a framework for managing reputational risk arising from AI-related incidents - including a communication protocol for public-facing AI failures, regulatory disclosures and stakeholder notifications - and has this framework been tested?

King V Principle 3, Practice 22(a): "The organisation continually assesses, and responsibly responds to, the negative impacts and outcomes of its activities and outputs on the resources and relationships which it uses and affects." (IoDSA, King V Code, p.9); King V Principle 4 (Reporting): Board accountable for integrity of external reports; Companies Act s76: Director duty to act in the best interests of the company.

T-BG-SA001.6.5

Is the board regularly updated on the South African and global AI regulatory landscape - including developments in South African AI policy, the status of the AI Institute of South Africa, and relevant international frameworks such as the EU AI Act - so that it can anticipate and prepare for regulatory change?

King V Principle 9 (Compliance): Governing body accountable for the organisation's compliance with applicable laws, including monitoring for regulatory developments. (IoDSA, King V Code, p.22); King V Principle 5, Practice 37(g): Directors receive regular briefings on "legal, regulatory and corporate governance developments as well as on emerging risks and opportunities." (IoDSA, King V Code, p.12). Note: South Africa does not currently have dedicated AI legislation in force. King V Principle 10 is the primary governance reference. Directors should monitor SA AI regulatory developments and commission periodic regulatory horizon-scanning.