Will South Africa Become the Market for Devices Europe Rejects?
From December 2027, insecure connected products cannot be sold in the EU, and nothing in South African law stops them arriving here.
Sign up for my Substack daily AI newsletter here.
See my AI Training course portfolio for corporate Business Leaders here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
Consumer Reports issued a warning recently that will sound familiar to anyone with a connected kitchen. Smart appliances send a steady stream of information out of the home, including location, contact details and even video, and in 2024 the organisation found a doorbell flaw that exposed video feeds to hackers, leading to a product recall and a fine from the Federal Communications Commission. The warning was aimed at American households. The more important question for South Africa lies in what Europe has just done about the same problem, and what we have not.
CONTEXT AND BACKGROUND
The scale of collection is larger than most buyers assume. In one case, a single device sent the equivalent of 135,000 text messages of data a week back to its manufacturer, and security experts note that cheaper connected devices are often produced on thin margins with little investment in security. Europe has decided that this is a matter for law rather than consumer vigilance. The Cyber Resilience Act targets both weak product security and the lack of timely updates, with reporting obligations in force since 11 September 2026 and its main requirements applying from 11 December 2027. Manufacturers must file an initial report within 24 hours of learning of an actively exploited vulnerability; the rules cover low-cost consumer goods as well as industrial systems, and they apply to any manufacturer selling into Europe, wherever it is based. Britain moved first on transparency, requiring manufacturers since 2024 to publish the minimum period for which a product will receive security updates, in terms a non-technical buyer can understand.
INSIGHT AND ANALYSIS
South Africa has no comparable law setting minimum security requirements for connected products. POPIA governs personal information once it has been collected, yet it does not require a fridge to be patched, a default password to be banned, or a support period to be disclosed. The distinction matters, because the risk begins with the device itself.
The optimistic reading is that global manufacturers will build to the European standard everywhere, since maintaining separate product lines is expensive. That may hold for flagship models from large brands. It is far less certain for cheaper devices built on thin margins, and stock that cannot meet European requirements will need somewhere to go. This is not yet evidence of dumping. It is an incentive structure, and incentive structures tend to be exploited.
There is precedent for treating South Africans as second-tier customers. The Information Regulator has already acted against WhatsApp for applying weaker privacy terms to South African users than to Europeans, and although it has not issued specific guidance on smart wearables, POPIA provides a foundation to build on.
I have previously written about this. In a 2021 ITWeb column on the Internet of Things, I argued that many manufacturers rush connected devices to market with security as an afterthought, and that concerns about security and privacy would drive new legislation, with South African organisations needing to treat device data in line with POPIA. Europe has now legislated. South Africa has not.
IMPLICATIONS
For boards, the consequences are practical. Organisations buying connected equipment for offices, factories, fleets and buildings carry the risk of every unpatched device on their networks, and breaches are already rising. South African organisations reported 2,374 security compromises in 2024/25, with monthly notifications up 40% early in the following year. Procurement is the lever that does not wait for Parliament. Boards can require suppliers to state a security support period with an end date, provide a software bill of materials listing the components inside the product, commit to a vulnerability disclosure process, and confirm whether the product meets European requirements. For policymakers, the task is to decide whether South Africa will adopt, align with or ignore the European and British models before the 2027 deadline arrives rather than after it.
CLOSING TAKEAWAY
A device that fails Europe’s test will not disappear. It will be sold somewhere. Whether South Africa becomes one of those places depends on choices that can still be made, by regulators setting minimum standards and by boards refusing to buy what Europe will not accept. The cheapest moment to close this gap is before 2027. After that, we will be governing the consequences rather than the risk.
Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net
Comments