When does King V apply?

King V was published on 31 October 2025. Its disclosure provisions apply to financial years starting on or after 1 January 2026, and early adoption is encouraged. It keeps the apply-and-explain approach of King IV.

Does King V make AI a board matter?

Yes. It treats data, information and technology, including artificial intelligence, as something the governing body oversees rather than leaves to management, and asks it to explain how it does so.

Is there an AI law in South Africa yet?

Not yet. The draft national AI policy was withdrawn in April 2026 and the final policy is expected in 2027. Until then POPIA, the Cybercrimes Act and King V apply, and ISO/IEC 42001 and the NIST AI Risk Management Framework are the benchmarks most buyers use.

Can an IT firm give the board assurance?

It can give an independent technical review: evidence about how systems and AI actually behave, from people who did not build them. Formal audit opinions are for registered auditors; a technical review sits alongside their work, it does not replace it.

Insights · Governance & AI

King V for boards: technology, AI and the case for an independent view

King V asks boards to govern data, information, technology and AI, and to explain how. For most directors the honest answer starts with a question: how would we know?

November 2026 4 min read ASi Imperium advisory

Short answer: King V makes the governance of data, information, technology and AI a board responsibility, and asks the board to explain how it meets it. Most boards hear about these systems only from the people who run them. An independent technical review gives directors evidence, not reassurance, and it is the most direct way to answer the question King V now puts to them.

What changed on 1 January 2026

The Institute of Directors in South Africa and the King Committee published King V on 31 October 2025. It replaces King IV, consolidates its principles from 17 to 13, and keeps the apply-and-explain approach: an organisation explains how it achieves each principle and discloses where it does not follow a recommended practice. Disclosure applies to financial years starting on or after 1 January 2026, with early adoption encouraged.

For technology the shift is one of emphasis. King IV already treated technology and information as a governance matter. King V widens that to data, information and technology together, names artificial intelligence explicitly, and is read by practitioners as placing oversight with the governing body rather than with management.

What it asks of directors in practice

The Code sets principles, not a checklist, so no two boards will answer it the same way. The questions most directors will need to be able to answer are these:

What do we run? An up-to-date view of the systems, data and AI tools the organisation depends on, including the ones staff adopted on their own.
What could go wrong, and what would it cost? Risks ranked by consequence, in the board's language rather than the engineers'.
Who decided, and on what basis? Clear ownership of each significant system and AI use, with the decisions recorded.
How do we know the controls work? Evidence that security, privacy and AI controls do what management says they do.
What would we tell the regulator, clients and shareholders on a bad day? A tested plan for a breach or an AI failure, including the POPIA section 22 notice.

The fourth question is the hard one. A board that only hears from the people who designed, bought or built a system is hearing their view of their own work.

Where AI regulation stands

South Africa has no AI-specific law yet. The draft national AI policy was withdrawn in April 2026 after its reference list was found to contain sources that did not exist, and the final policy is now expected in 2027. Waiting is not a neutral choice: POPIA, the Cybercrimes Act and King V already apply to how AI is used.

In the meantime two frameworks have become the practical benchmarks. ISO/IEC 42001, published in December 2023, sets out an AI management system an organisation can be certified against. The NIST AI Risk Management Framework gives a structure for identifying, measuring and managing AI risk. Neither is mandatory here, but both are what serious buyers, investors and international partners ask about.

How the large firms answer the question

The firms boards already know sell this as named, independent work. Large audit and advisory firms such as Deloitte offer AI assurance as independent testing of AI models and reviews of how an organisation's AI risk framework is implemented, aligned to ISO/IEC 42001. Specialist security firms sell fixed engagements with clear names: compromise assessments, technical risk assessments and tabletop exercises. Some technology companies embed their engineers inside the client's operation, because the real system is never quite the one in the documentation.

The common thread is independence and evidence: a named scope, someone who did not build the system, tests rather than walkthroughs, and a report a board can rely on.

What an independent technical review is, and is not

It is an examination of how systems and AI actually behave, by engineers who did not build them, with evidence for each finding and a plain statement of what is sound and what is not. It is not an audit opinion. Opinions on financial statements and formal assurance reports under auditing standards are the work of auditors registered with the Independent Regulatory Board for Auditors. A technical review sits alongside that work and often prepares an organisation for it.

A sensible first year under King V

Inventory. Build the register of systems, data and AI in use, with an owner for each.
Independent baseline. Commission one independent review of the systems and AI that matter most, and present the findings to the board or risk committee unedited.
Rehearse the bad day. Run a tabletop exercise with the executive team on a breach or AI failure.
Pick a benchmark. Use ISO/IEC 42001 or the NIST AI Risk Management Framework as the yardstick for AI, and ISO/IEC 27001 for information security.
Report and re-test. Track what was fixed, re-test it, and use the record in the King V disclosure.

This is an engineering firm's reading of King V and the surrounding rules, written to help directors ask better questions. It is not legal or audit advice. Read the King V documents published by the IoDSA for the authoritative text.