Governance Has Moved Beyond Compliance, But Are South African Boards Ready?

Introduction

Regulators around the world are writing rules faster than most organisations can absorb them. In Europe, businesses are scrambling to meet EU AI Act deadlines. In the UAE, banks are being warned that their anti-money laundering controls are lagging behind the international fraud agenda. And in the UK and Singapore, public accountability and climate exposure are fast becoming priority board agenda items rather than the technical reporting tasks they once were.

South African organisations are facing the same strain, shaped by this country’s own laws, codes, and regulators. The expectations placed on boards are compounding at a rapid pace, while the capability to meet those expectations typically builds much more slowly, if at all.

King V puts accountability on the record

That gap has been building for years, but the launch of King V, effective for financial years beginning on or after 1 January 2026, now brings it into plain view. The new Code is deliberately outcomes-based, with governance quality judged less by compliance with recommended practices and more by whether those practices actually achieve measurable good governance outcomes like ethical culture, value creation, and legitimacy. King V also puts accountability for these outcomes squarely at the feet of an organisation’s governing body, positioning the board as the focal point of governing well, leading ethically, and ensuring clear reporting evidence of governance practices.

Contrary to misperceptions, AI is already regulated

Among the outcomes King V expects boards to own, technology and AI stand out, because this is where the misconceptions run deepest. Many boards still believe that South Africa has no AI regulation; but the absence of a standalone AI law does not mean there are not rules. South Africa's approach is policy-led and anchored in legislation that already applies to data-driven technologies. POPIA governs how AI systems collect, process, and use personal information, covering profiling, automated decision-making, and transparency duties, and it allows inpiduals to challenge automated decisions that significantly affect them. Sector regulators in finance, credit, communications, and healthcare also oversee AI-enabled activities within their domains, while the National AI Policy Framework sets out the blueprint for future legislation, aligned with African Union principles for ethical and trustworthy AI.

However, there are still few boards that confidently claim to have the knowledge to manage their growing technology and AI governance responsibilities. Grant Thornton's own 2026 AI Impact Survey found that 78% of executives globally lack strong confidence that they could pass an independent AI governance audit within 90 days. There is little evidence to suggest that South African boards would fare any better.

The recent grey list exit raises the bar further

The same question of sustained capability hangs over financial crime. While South Africa’s removal from the FATF grey list on 24 October 2025 ended 32 months of enhanced scrutiny and reflected genuine institutional reform, this was by no means a finish line. The FATF requires ongoing demonstration of compliance through measurable outcomes, and institutions must maintain vigilance and embed sustainable compliance cultures. The discipline built under external pressure must now become permanent organisational muscle, owned at board level. A relapse would cost far more than the original listing did.

Investors are not waiting for a climate mandate

Climate risk is following a similar pattern, except that here the pressure is coming from investors rather than lawmakers. The JSE's disclosure guidance is aligned with the ISSB's IFRS S1 and S2 standards, and the CIPC has opened public consultations on mandatory sustainability reporting, with a regulatory impact assessment on adopting the ISSB standards underway.

Across the continent, countries are following suit, with Nigeria already embedding the standards in its regulatory framework. Investors increasingly treat credible, assurance-ready climate and ESG information as the price of capital. Boards that are still waiting for a legislated mandate have misunderstood who is actually setting the climate disclosure deadlines.

One agenda, not four projects

The temptation is to treat all these developments as separate compliance workstreams. That would be a mistake as they are highly interdependent, and King V's outcomes-based lens is designed precisely for this interconnection. Compliance is only part of the challenge. The real test lies in translating requirements into effective governance practices, reliable data, and meaningful insight. Embedding sustainability into governance, risk management and decision-making strengthens stakeholder confidence and strategic resilience. Strategic oversight of all this cannot be delegated to teams or committees below the board.

An anonymised client example of integrated governance in practice:

A large financial services organisation consolidated its Anti-Money Laundering (AML) remediation programme and Data Governance programme under a single executive steering committee reporting to the Board Risk Committee in South Africa. This integrated oversight structure enabled coordinated decision-making, improved accountability for regulatory compliance and data quality, and provided the board with a unified view of key risks, remediation progress, and control effectiveness across both initiatives.

The boards that will successfully navigate this era of heightened governance responsibility are the ones that treat ethics, technology, sustainability, and risk as a single lens on every material decision, not as four separate charters overseen by four committees. Through oversight that is coherent rather than being a series of parallel tick-box exercises that merely accumulate cost without adding real capability, these boards will not only ensure that they achieve the governance levels required by regulation, but also that their organisations earn the trust of all their stakeholders.