RLP Training
  • 078 571 9945
  • 2nd Floor, HB Forum, <br> 13 Stamvrug Street, Val de Grace

Office Address

2nd Floor, HB Forum, 13 Stamvrug
Street, Val de Grace

Phone Number

078 571 9945

South Africa’s Draft AI Policy: A Practical Playbook for F&I and Insurance Teams

Shape Shape Shape

When the Department of Communications and Digital Technologies gazetted the Draft National AI Policy on 10 April 2026, the financial services industry took notice. Two weeks later, on 27 April, the document was pulled after fabricated academic citations were exposed. A reworked version is expected, but the regulatory direction is now clear: South Africa is moving towards a risk-based AI framework modelled on the EU AI Act, and the activities that sit at the heart of motor F&I and short-term insurance fall squarely inside the high-risk zone.

For dealership F&I desks and insurers, this is not a “wait and see” moment. The substantive obligations being signalled; explainability, algorithmic auditing, bias testing, and tighter alignment with POPIA, are unlikely to soften when the policy returns. Firms that start preparing now will be in a far stronger position than those that wait for a final document.

Why F&I and insurance are in the spotlight

The draft flags credit scoring, fraud detection, and underwriting as high-risk AI use cases. That covers most of what an F&I desk does on a daily basis: instant credit decisioning, affordability assessments, fraud screening on applications, and the pricing and approval of value-added insurance products. The FSCA and Prudential Authority’s joint November 2025 report on AI in the financial sector confirmed banks are leading adoption at 52%, while insurance sits at just 8% — meaning insurers and F&I providers will likely be regulated faster than they innovate. Add POPIA Section 71’s existing protections against automated decision-making, and the compliance gap is real.

The practical playbook

  1. Inventory your AI today, not later. Map every model, decision engine, and third-party tool that touches a credit decision, insurance quote, claims triage, or fraud flag. Include the AI features baked into the core systems your vendors run for you, and most F&I desks underestimate how much algorithmic decisioning is already embedded in their stack.

  2. Stress-test your explainability. For every high-impact model on that map, ask: can we explain a single decision to a customer, an FSCA examiner, or the Information Regulator in plain language? “The system declined them” is not an answer that will survive the new regime.

  3. Run a bias and fairness review. The draft proposes algorithmic audits, including bias testing and human rights impact assessments. Run a dry-run audit now on your credit and underwriting models against protected characteristics. Document the methodology — that documentation becomes your audit trail later.
  4. Keep humans on the consequential decisions. Section 71 of POPIA already restricts purely automated decisions that significantly affect a person. Build a meaningful human-in-the-loop checkpoint into credit declines, premium loadings, and claims rejections — not a rubber stamp, but a real review with authority to overturn.
  5. Renegotiate vendor terms with transparency in mind. Your AI vendors will be asked, through you, for model documentation, training data provenance, performance metrics, and bias testing. Get those clauses into your service agreements at the next renewal so the disclosure burden doesn’t land on you alone.
  6. Train the front line. F&I managers, underwriters, and brokers need to know what AI is doing inside the tools they use, where the limits sit, and when to escalate. Compliance training that ignores AI is no longer fit for purpose.
  7. Engage with the comment process when it reopens. The reworked draft will return for public comment. Sector-specific submissions, particularly on what counts as “high-risk” in F&I and short-term insurance, are how the rules get shaped. Silence will be filled by louder voices.

The bottom line

The Draft AI Policy was pulled, but the regulatory direction was not. Risk-based oversight of AI in credit, underwriting, and fraud is coming, and existing law under POPIA, FAIS, and the NCA already covers more than most firms realise. The firms that will be ready are the ones treating the next twelve months as a preparation window, not a pause.

 

Sources: