Governance

Responsible Party

Person or entity bearing liability for AI-related harm.

How the laws define this

Both frameworks establish a responsible party as an individual, private body, or public entity designated to bear primary accountability for operations conducted under a given legal framework. They agree that designating a responsible party creates a focal point for statutory duties and legal consequences. The major divergence lies in the scope of regulated activity and the mechanism triggering accountability. Under the Protection of Personal Information Act (POPIA), No. 4 of 2013, the responsible party is defined by decision-making control over data, identifying the entity that determines the purpose and means of processing personal information and ensuring compliance with lawful processing conditions. Conversely, under Federal Law No. 123-FZ (Federal Law on AI Liability and Updated Experimental Legal Regimes), the concept centers on liability for AI-related harm, establishing civil, administrative, or criminal accountability and attribution database listings for developers, experimental regime participants deploying AI, infrastructure providers, and supervising government agencies that fail in oversight.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

What it triggers

Under the Protection of Personal Information Act (POPIA), No. 4 of 2013 in South Africa, the responsible party must ensure compliance with the Act's conditions for lawful processing of personal information.source
Under Federal Law No. 123-FZ, the responsible party must be listed in the attribution database and may be held civilly, administratively, or criminally accountable for AI-related harm.

Definitions (2)

An individual or legal entity that bears liability for AI-related harm, including AI system developers, experimental regime participants deploying AI, infrastructure providers, and potentially supervising government agencies when oversight failures contributed to harm. The term is used to identify who must be listed in the attribution database and who may be held civilly, administratively, or criminally accountable.

Federal Law on AI Liability and Updated Experimental Legal Regimes (Federal Law No. 123-FZ)Definition 1 of 2

Responsible party is the public or private body or person who, alone or in conjunction with others, determines the purpose of and means for processing personal information and is accountable for ensuring compliance with the Act's conditions for lawful processing.

Protection of Personal Information Act (POPIA), No. 4 of 2013Definition 2 of 2

Not to be confused with

Owner

Unlike 'owner', which refers to the person or entity that controls, deploys, or operates an AI system, 'responsible party' specifically identifies who bears liability for harm or accountability for data processing compliance.

AI Actors

'AI actors' is a broader term for public authorities and private entities involved in AI development or deployment, while 'responsible party' focuses on those bearing liability for AI-related harm or data processing accountability.

Questions and answers

Who is accountable for personal data processing under South African law?

Under the Protection of Personal Information Act (POPIA), No. 4 of 2013, the responsible party is the public or private body or person who determines the purpose and means for processing personal information. This party is accountable for ensuring compliance with the Act's conditions for lawful processing.

Who bears liability for AI-related harm under Federal Law No. 123-FZ?

The responsible party includes AI system developers, experimental regime participants deploying AI, infrastructure providers, and potentially supervising government agencies when oversight failures contributed to harm. They must be listed in the attribution database and may face civil, administrative, or criminal accountability.

How does 'responsible party' differ from AI system owner?

The responsible party bears liability for AI-related harm or accountability for data processing, whereas the owner is the person or entity that controls, deploys, or operates the AI system.