> ## Content Index > Fetch the complete content index at: https://www.businessbagel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Bowmans is warning employers that staff using public AI tools could land the company in privacy trouble - URL: https://www.businessbagel.com/bowmans-popia-employers-staff-ai-tools/ - Published: 2026-10-06T03:45:00.000Z - Updated: 2026-10-06T03:44:59.000Z - Description: Law firm Bowmans says South Africa's privacy law can hold employers accountable when staff put personal information into public AI tools, and Europe's rules look much the same. - Author: Christian Maidman - Tags: Policy, Business Bagel News South Africa has no law written for artificial intelligence, so laws already on the books do the work. Law firm Bowmans has been walking employers through what the privacy law means for AI since August, and one of its points lands on the boss. If an employee puts someone's personal information into a public AI tool, the employer may be held accountable. The logic runs through how the Protection of Personal Information Act, or POPIA, hands out responsibility. The law makes a "responsible party" answer for personal information, and at work that is the employer, because it decides what the information is used for and how, and has to keep it secure. Partners Melissa Cogger and Talita Laubscher, who wrote the firm's guidance, say outsourcing to a recruitment agency or an AI vendor does not pass that accountability along. ## When software makes the call Much of the guidance is about software making decisions about people. Section 71 of POPIA says nobody may be subjected to a decision with legal consequences, or one that affects them substantially, based solely on automated profiling, and it names performance at work as one kind of profile. If an AI system rates an employee, picks someone for promotion or demotion, or rejects a candidate, and that output is all the decision rests on, section 71 applies. Section 71 has exceptions, for decisions tied to a contract with proper safeguards, or governed by a law or code that sets them out. Where the rule does apply, the person affected must get a chance to be heard, to deal with a human and to understand how the system reached its answer. That last part is hard when nobody can see how the model got there: the black-box problem. ## A European rule with a local twin None of this is unique to South Africa. Article 22 of Europe's GDPR gives people almost the same right not to face a decision based solely on automated processing, with a similar carve-out for contracts and a right to human intervention. The EU's AI Act adds another layer, listing AI used to filter job applications, decide promotions or monitor performance among its high-risk systems. Some companies abroad went for something blunter. Samsung's answer in 2023 was to stop staff using generative AI for a while, after engineers fed internal source code into ChatGPT. In South Africa, the habit is well ahead of the rulebook. In KnowBe4's 2025 survey of workers in six countries, South Africans were the most likely to use AI at work, at 70.1%. Only about 17% used it with their IT team's knowledge, and South Africa's 23.6% was the highest. Bowmans' fix starts with paper: an AI policy spelling out what staff may and may not do, limits on which kinds of personal information go in, closed company tools where possible, and data stripped of identifying details where not. Training completes the list. Every item on it is something the employer has to put in place, down to the POPIA clauses it writes into its AI vendors' contracts.