Legal & Risk: What Businesses Need to Watch

Legal & Risk: What Businesses Need to Watch

2026-06-07

This week highlights two critical compliance areas for South African and international businesses: supply chain security and AI governance. While these stories may appear operational, they carry legal and regulatory risks that demand immediate attention.

1. Truck Hijackings and Supply Chain Contracts

The ongoing truck hijacking crisis in South Africa, reported in [1], underscores the need for robust contractual and compliance frameworks. Businesses relying on land-based logistics must review their supply chain agreements to include clauses addressing disruptions caused by theft or violence. This includes:

• Insurance requirements: Confirm that coverage extends to cargo loss during hijackings and that insurers are aware of localized risks.
• Compliance with local legislation: While no specific anti-hijacking laws are cited in the source, businesses must ensure they align with the Labour Relations Act (LRA), which mandates workplace safety measures. Employee safety protocols during transport should be documented to avoid legal exposure under the LRA.
• Data protection: If hijackings involve personal data (e.g., driver information), compliance with the Protection of Personal Information Act (POPIA) becomes critical. Businesses must ensure data minimization and secure handling of any affected data.

2. AI Regulation in South Africa and the EU

The formation of an expert panel to review AI policy in South Africa, as outlined in [4], signals impending regulatory changes. Businesses deploying AI systems should:

• Align with upcoming AI governance frameworks: The panel’s work may influence compliance with the EU AI Act for international operations and integrate AI governance with POPIA for local data processing. High-risk AI systems (e.g., those used in energy or healthcare) may require human oversight and transparency, mirroring EU requirements.
• Audit data flows: If AI systems process EU citizen data, cross-border transfers must comply with EU GDPR and POPIA localization rules, particularly for sensitive data.

3. Executive Compensation and Corporate Governance

The case of Peter Wharton-Hood, CEO of Life Healthcare Group (source [6]), raises questions about executive pay transparency. For listed companies, the Companies Act 71 of 2008 and the Labour Relations Act require shareholder approval for executive remuneration structures. Businesses should:

• Audit remuneration policies: Ensure compliance with disclosure requirements and avoid practices that could trigger employee dissatisfaction or legal challenges under the LRA.
• Monitor regulatory shifts: As AI and AI-driven analytics reshape corporate governance, businesses must prepare for evolving compliance expectations.

Compliance Actions for CLOs

• Review supply chain contracts for hijacking-related clauses and update insurance policies.
• Conduct AI system audits to align with POPIA and EU AI Act requirements where applicable.
• Verify executive remuneration policies against the Companies Act and LRA, ensuring transparency and shareholder approval.