King V and the Board’s Responsibility for Technology.

On 31 October 2025 the Institute of Directors in South Africa and the King Committee released the King V Report on Corporate Governance for South Africa 2025 (“King V”). It supersedes King IV and applies to financial years beginning on or after 1 January 2026, with early adoption encouraged. King V reduces King IV’s 17 principles to 13 and adds a dedicated Disclosure Framework that standardises what organisations must say about how they apply each principle.

For boards, the most consequential change sits in Principle 10. Technology is no longer treated as an operational support function to be reported on once a quarter. It is a domain the governing body itself is accountable for.

King V Principle 10 at a Glance

Question	Short answer
What is Principle 10?	The principle under which the governing body governs data, information and technology to sustain and optimise strategy and objectives
Is King V law?	No. It is voluntary, but becomes binding where adopted in the Memorandum of Incorporation, and is referenced by the JSE Listings Requirements for listed issuers
Can the board delegate?	It may delegate responsibilities to the risk committee or another committee, but accountability is not transferred
What is new on AI?	Express requirements on ethics, accountability, and human oversight and override mechanisms commensurate with risk
Which law mirrors it?	POPIA (and in particular section 71 on automated decision-making)
Why do directors care?	King V is likely to be used as the yardstick for the duty of care, skill and diligence under section 76(3) of the Companies Act

What Does King V Principle 10 Actually Say?

Principle 10 reads: “The governing body governs data, information and technology in a way that enables the organisation to sustain and optimise its strategy and objectives.”

King V then splits the recommended practices into two streams, data and information, and technology, each structured as:

1. Steering and setting direction.
2. Policy and planning.
3. Oversight and monitoring.
4. Assurance.

Data and Information

On data and information, the governing body “should provide the strategic direction and be accountable for the effective, compliant and ethical management and control (including acquisition, creation, use, dissemination and disposal) of data and information”. Its oversight must ensure, among other things:

• Lifecycle structuring of data assets.
• Ethical and responsible handling.
• “[c]ompliance with laws and regulations”.
• Identification and classification of sensitive data.
• “[i]nformation security and data protection which safeguard the confidentiality, integrity and availability of data and information”.
• “[t]he protection of privacy of personal data and information”.
• Data quality.
• Effective management of third-party and outsourcing risk “including across jurisdictions”.

Technology

On technology, the board is accountable for the “effective, compliant and ethical acquisition, development, use and distribution of technology within and by the organisation”. Oversight must cover:

• Legal compliance.
• Organisational resilience and disaster recovery “planning and testing”.
• Benefit commensurate with significant technology investment.
• Responsible disposal of obsolete technology having regard to environmental impact and data security.
• “[e]ffective cyber security strategies and practices”.
• Minimum assurance requirements from outsourced technology providers over controls on significant risks.

King V and Artificial Intelligence: The Real Novelty

Principle 10 requires the governing body to oversee that the organisation’s acquisition, development, use and distribution of “emerging, innovative and disruptive technologies” results in sustainable value creation and in risk assessment aligned to the board’s stated risk appetite and tolerance. Specifically on artificial intelligence, it requires:

• “Adherence to the values of ethics, human centricity, accountability, transparency, explainability, security, privacy, fairness and trustworthiness”; and
• “Clear accountability for decisions, actions, outputs and outcomes – which includes subjecting the processes, data, models, algorithms, resources and tools used in the development, implementation, monitoring and management of automated technologies to human oversight and override mechanisms that are commensurate with the level of risk to the organisation and its stakeholders”.

Two Features Boards Should Notice

1. “Commensurate with the level of risk” imports a proportionality test. A chatbot answering FAQs and a model scoring credit applications do not attract the same controls, and the board must be able to show it calibrated.
2. Outputs and outcomes, not just policies. The obligation attaches to outputs and outcomes, not merely to adopting a policy. An AI policy that was approved but never tested will not satisfy this provision.

The loop is then closed: the board “should consider periodic assurance on the effectiveness, compliance and ethics” of both its data and information handling and its technology activity. Independent assurance over AI and cyber controls is now an expected board agenda item.

Delegation Is Permitted; Accountability Is Not Transferable

King V permits the governing body, at its discretion, to delegate its information-related and technology-related responsibilities to “the committee responsible for risk governance or to another committee, as is appropriate for the organisation”. The accountability imposed is not transferred with it. Nor does delegation to management discharge the duty: King V’s architecture is that the board sets direction, approves policy, then oversees and monitors execution.

Practically, this means a board that cannot evidence what it asked, what it was told, and what it did in response has an oversight gap, regardless of how capable its CIO is.

Where POPIA Bites: King V and the Protection of Personal Information Act

King V is not law. It is voluntary, although it becomes binding where an organisation adopts it in its Memorandum of Incorporation, and it is referenced by the JSE Listings Requirements for listed issuers. The Protection of Personal Information Act 4 of 2013 (POPIA) is law, and Principle 10 maps onto it closely enough that compliance failures in one will usually be visible in the other.

POPIA Section 71: Automated Decision-Making

Section 71 is the provision most likely to catch a board by surprise. An organisation that buys an AI-driven screening, scoring, pricing, or triage tool and deploys it without a human-in-the-loop may be in breach of POPIA quite independently of whether its King V disclosure reads well. King V paragraph 109(c)(ii) and POPIA section 71 are pointing at the same control, and only one of them carries a penalty.

How Is Section 71 Triggered?

On the Information Regulator’s own reading, in its Guidance Note on Direct Marketing (still the only published interpretive comment it has issued on the provision), the right is engaged only where three elements are cumulatively present:

1. The decision produces legal consequences or affects the data subject to a substantial degree.
2. The decision is based solely on automated processing.
3. That processing is intended to produce a profile of the person.

(Guidance Note on Direct Marketing in terms of POPIA.)

The Limited Reach of the Code-of-Conduct Exception

Note also the limited reach of the code-of-conduct exception. Section 60(4)(a)(ii) requires every code of conduct to specify appropriate measures for protecting the legitimate interests of data subjects insofar as automated decision-making under section 71 is concerned, and both codes currently in force do so:

• The Banking Association South Africa Code at clause 13; and
• The Credit Bureau Association Code at clause 11,

each effective 4 November 2022 (POPIA, s 60(4)(a)(ii)). The code route is therefore available only to a responsible party falling within the scope of one of those codes; every other responsible party must rely on the contract route in section 71(2)(a), or on a specific sector statute.

POPIA Enforcement: Active, but Contested

POPIA’s enforcement ladder runs as follows:

Step	Provision	What it does
Complaint	Section 74	Starts the process
Enforcement notice	Section 95	Requires specified remedial steps
Criminal liability	Section 103(1)	Failing to comply with an enforcement notice
Infringement notice	Section 109(2)(c)	Administrative fine of up to R10 million
Sentencing-style factors	Section 109(3)	Nature of the information, duration and extent of the contravention, numbers affected
Civil action	Section 99	Damages, including aggravated damages, without proof of negligence or intent

Critically, section 73 deems non-compliance with section 71 to be “interference with the protection of personal information”, which is what unlocks the whole Chapter 10 machinery.

What Has the Information Regulator Actually Done?

• Department of Justice and Constitutional Development. In May 2023 the Regulator served an enforcement notice requiring it to prove it had renewed its anti-virus, SIEM and intrusion-detection licences, and to institute disciplinary proceedings against the responsible officials. When the Department did not comply, the Regulator issued an infringement notice carrying a R5 million administrative fine on 3 July 2023 (Information Regulator media statements, 10 May 2023 and 4 July 2023). The Department neither paid nor appealed under section 97(1), electing instead to take the notices on review, and that litigation remained pending as at the Regulator’s briefing of 13 November 2025.
• South African Police Service. The Regulator issued an enforcement notice under section 95 following an own-initiative data-breach investigation under section 76(3) of POPIA (Enforcement Notice, SAPS, Reference CI 317-22, 4 April 2023).
• Direct marketing. It issued its first direct-marketing enforcement notice in February 2024, against FT Rams Consulting.
• Other matters. It has dealt with the IEC security compromise, and has obtained a High Court order under section 109(5) against Blouberg Local Municipality, where the court confirmed liability but reduced the administrative fine from R500 000 to R250 000 (Information Regulator media statements).

An Important Qualification: The Basic Education Judgment

Boards should read that record with one important qualification. In December 2025 a full bench of the Pretoria High Court upheld the Minister of Basic Education’s section 97(1) appeal and set aside both the Regulator’s enforcement notice and its R5 million infringement notice concerning the publication of 2024 matric results, on the basis that examination numbers did not render the published results personal information relating to an identifiable learner, with costs against the Regulator. No appeal against that judgment had been reported at the time of writing (Minister of Basic Education and Another v Information Regulator of South Africa and Others (148459/24) [2025] ZAGPPHC 1390 (12 December 2025)).

What Should a Board Take From the Enforcement Record?

The lesson for a board is not that enforcement can be ignored. It is that:

• The Regulator is willing to act on its own initiative.
• Its focus so far has been squarely on unglamorous security hygiene: expired licences, unpatched systems, breach handling.
• Its notices are reviewable rather than self-executing.

A board whose records show it interrogated exactly those hygiene items is in a materially different position from one whose minutes are silent.

Section 71 Has Not Yet Been Construed

No South African court and no published Regulator determination has yet construed section 71 itself. The absence of a decided case is not comfort. It means a board cannot predict with confidence how “solely” or “substantial degree” will be read, and should calibrate to the stricter rather than the looser reading.

Why This Is Also a Companies Act Exposure

The duties in section 76(3) of the Companies Act 71 of 2008 are to:

• Act in good faith and for a proper purpose.
• Act in the best interests of the company.
• Act with the degree of care, skill and diligence reasonably expected of a person with that director’s knowledge and experience.

These are measured against prevailing standards of director conduct, and King V is the most authoritative statement in South Africa of what those standards look like in practice. A director who ignored Principle 10 and whose company then suffered a notifiable breach or a discriminatory AI outcome will find King V used as the yardstick against which their diligence is assessed, and section 77 governs the resulting liability.

The business judgment protection in section 76(4) is available only to a director who, among other things, took reasonably diligent steps to become informed about the matter, which is precisely what a documented Principle 10 oversight trail would evidence.

A Board Checklist for King V Principle 10

Use this as a starting point for the next board or risk-committee meeting:

• Has the board (or its risk committee) been formally allocated data, information and technology oversight, with the allocation minuted?
• Can the board evidence what it asked, what it was told and what it did on cyber security and data protection in the last 12 months?
• Are disaster-recovery plans tested, not just approved?
• Are security licences, patching and breach handling reported on, given these are the Regulator’s focus so far?
• Is there an inventory of AI and automated decision tools in use, scored for risk?
• For each high-risk tool, is there human oversight and an override mechanism, and has it been tested?
• Have we assessed each tool against the three section 71 elements, and are we relying on the contract route, a sector code or a sector statute?
• Do operator and outsourcing contracts give the board the assurance King V expects over significant risks?
• Is independent assurance over AI and cyber controls on the agenda?
• Is King V adopted in our Memorandum of Incorporation, or required by the JSE Listings Requirements?

Conclusion: Principle 10 Builds Your POPIA Defence and Your Section 76 Record

King V has moved technology from the IT report to the board’s own accountability, and it has done so in a jurisdiction that already has an enforceable data protection statute with a specific prohibition on unchecked automated decision-making. The two instruments reinforce each other.

A board that takes Principle 10 seriously is simultaneously building its POPIA defence and its section 76 diligence record. A board that treats it as a disclosure exercise is building neither.

For assistance with a King V readiness assessment, an AI governance framework, or POPIA operator contracting, contact an expert at SchoemanLaw Inc in Cape Town or Paarl.