Short answer
It can. Data held by US providers may fall under US law, and the CLOUD Act can compel them to hand over data wherever it is stored.
In detail: CLOUD Act and offshore AI: data sovereignty in SA
Why this matters for AI workloads:
- Every prompt sent to a foreign AI service is a small transfer of your business data, such as customer records, contracts or call recordings, into a provider you do not control.
- Under POPIA, sending personal information offshore for processing is a cross-border transfer, with the consent, jurisdiction and breach questions that come with it.
- For government, financial services, healthcare and any business holding sensitive records, foreign reach into data is a real risk, not a hypothetical one.
Sovereign AI means running AI on infrastructure in South Africa, under South African law. On FirstCoreAI's AI Factory in FirstNet's Durban data centre, inference stays in the country, so the only people who can reach your data are the ones you have authorised.
This is general information, not legal advice. For your own obligations, speak to your legal or compliance adviser.