AI Literacy and QMS Training Series
South Africa faces a dual pressure in AI capability. Demand for people who can design, operate, oversee and assure AI systems is rising rapidly. At the same time, a significant share of the professionals who currently hold the deepest experience in quality management, risk, assurance and regulated product development are approaching retirement age. The result is a widening gap between the competences organisations need for AI literacy, Quality Management Systems and good governance, and the supply of people who can deliver them.
This gap matters for both compliance and competitiveness. Under the King V Code on Corporate Governance for South Africa (effective for financial years beginning on or after 1 January 2026), governing bodies are explicitly required to govern data, information and technology - including emerging technologies such as AI - in a way that enables the organisation to sustain and optimise its strategy and objectives. King V expects boards to ensure human oversight, transparency, explainability, fairness, accountability, privacy and security in the use of AI.
In parallel, the Protection of Personal Information Act (POPIA) imposes strict obligations on Responsible Parties and Operators whenever personal information is processed by AI systems. For organisations placing high-risk AI systems on the EU market or dealing with EU counterparties, Article 4 of the EU AI Act requires measures that support AI literacy, while Article 17 requires a documented Quality Management System. EN 18286:2026 elaborates the competence, awareness and training expectations inside that system. Without enough people who combine technical understanding with process discipline, regulatory literacy and governance awareness, these overlapping obligations become difficult to meet in practice.
Global talent surveys continue to show acute difficulty filling AI-related roles, including AI Quality Management, deployment engineering, MLOps, AI security and AI literacy. These shortages are not limited to cutting-edge model-building skills. They include the ability to translate regulatory and governance requirements into operational controls, to manage risk across the AI lifecycle, and to maintain auditable evidence - the core work of both a Quality Management System and effective King V information governance.
Demographic trends compound the problem. South Africa's professional workforce in quality management, functional safety, medical device regulation, aerospace assurance and information security is ageing. The experience these practitioners hold in structured process control, residual-risk acceptance, documentation discipline and regulatory interaction is precisely what AI Quality Management Systems and King V technology governance require. When that cohort retires, organisations lose not only headcount but institutional knowledge that is hard to replace quickly through hiring alone.
Younger talent is often strong in model development, tooling and rapid experimentation. It is frequently weaker in the slower, more formal disciplines of design control, validation under intended purpose, change management, post-market monitoring, competence management, and the ethical and accountability expectations set out in King V and POPIA. Closing the gap therefore requires both attracting new people into these roles and systematically transferring knowledge from experienced practitioners before they leave.
The skills required sit at the intersection of AI technology, quality management, data protection and corporate governance. They can be grouped as follows.
These skills are rarely found in a single individual. Effective organisations distribute them across AI practitioners, Quality Management System managers, risk and compliance specialists, data stewards, Information Officers and oversight personnel, then bind them together through documented processes and competence requirements.
Experienced quality, assurance and governance professionals bring habits that pure AI talent often lacks: rigorous change control, scepticism about unvalidated claims, comfort with residual-risk decisions that must be documented and defended, and familiarity with external scrutiny. Those habits are transferable to AI systems. The technical content is new; the discipline of control is not.
When people with that background leave without structured knowledge transfer, organisations lose the ability to staff QMS and governance roles, to mentor younger staff, and to maintain continuity in audit-ready evidence. The shortage then becomes self-reinforcing: fewer experienced mentors means slower development of the next generation of competent practitioners.
King V requires governing bodies to ensure appropriate competence and oversight in the use of technology and AI. POPIA requires Responsible Parties to ensure that processing is lawful and that appropriate measures are in place. For organisations with EU exposure, Article 4 of the AI Act requires measures that support AI literacy, while EN 18286:2026 and Article 17 go further: competence must be determined, acquired, maintained and evidenced.
Training programmes therefore need two layers. The first is broad AI literacy - enough understanding for staff and relevant third parties to recognise AI use, appreciate opportunities and risks, and know how to raise concerns. The second is role-specific technical and process competence for those who design, validate, oversee or assure higher-risk systems. Both layers should be documented, reviewed for effectiveness and updated as systems, King V expectations and regulations evolve.
EN 18286:2026 has a useful effect on the skills mix required for organisations that must meet EU requirements. By translating the high-level obligations of Article 17 into a structured set of technical and organisational requirements, the standard substantially reduces interpretive uncertainty. Most of the practical effort becomes the design, implementation and evidence of controls, processes and competence - work that depends on the technical and Quality Management System skills listed above, rather than continuous legal reinterpretation.
Organisations that rely only on external hiring will struggle. The scarce combination of AI technical fluency, quality-system discipline and local governance awareness (King V + POPIA) is better built through targeted upskilling of existing quality, risk, engineering and compliance staff, paired with structured knowledge transfer from experienced practitioners who are still in post, and clear career pathways that make these hybrid roles attractive to newer talent.
The skills shortage in AI literacy and Quality Management System competence is real in South Africa. It is driven by rising regulatory and operational demand under King V and POPIA, the practical need to engage with the EU AI Act and international standards where organisations operate across borders, limited supply of people who combine AI understanding with process and assurance discipline, and the approaching retirement of many professionals who hold the deepest experience in structured control environments.
The technical skills needed are clear: AI and data fundamentals, QMS process capability across the lifecycle, regulatory and governance literacy focused on King V, POPIA, the EU AI Act and EN 18286:2026, and the professional skills that turn individual competence into organisational evidence. Organisations that treat the development of these hybrid competences as a core part of their AI, quality and governance strategy will be better placed to meet their obligations, to discharge the duties of the governing body under King V, and to sustain justified confidence in their AI systems over time.
