Phone your bank, your medical aid or your insurer this week and there is a fair chance the voice that answers will not be human. It will ask for your ID number. It will pull up your balance, your claims history, the last three conversations you had with the brand.
By Bruce von Maltitz, CEO of 1Stream
Millions of South Africans now share their private information with a machine every day, and few stop to ask the question: who decided that machine could be trusted with it?
For the moment, the honest answer is that nobody official did. South Africa currently has no law governing artificial intelligence. We were meant to have the beginnings of one by now.
But the draft National AI Policy that was gazetted in April was withdrawn within weeks, after it emerged that the document meant to govern AI had itself been written with AI. It would be easy to score points off that. I would rather draw a different lesson, because it is exactly what happens when a powerful tool is put to work and nobody checks its output.
The same failure can occur in a contact centre, a loan department or a clinic, and it is the person on the other end who carries the cost. A seven-member expert panel is now rebuilding the policy. Its report is due in August, a revised draft reaches Cabinet in November, and public consultation is unlikely to reopen before January 2027.
So the rules most of us expected this year have slipped, comfortably, into next. That leaves a window of more than a year in which AI keeps answering calls, helping to approve applications and handling personal data with no official national framework behind it.
Here my view may be less popular than you would expect from someone arguing for oversight. I do not believe the answer to this gap is to shove a thick stack of legislation into it. Government has signalled that it will fold AI into the regulators we already have rather than build a single new one, and that instinct is sound. Heavy, hurried rules tend to freeze the very investment and experimentation a developing economy needs, and they seldom deliver what they promise.
Consider the popular notion that keeping a human “in the loop” will protect jobs. It isn’t likely to do so (at least as a principle by itself). Human oversight is a real safeguard for the consumer, and I back it for that reason. As an employment protecting or advancing policy it is a bit more like wishful thinking. Jobs are protected by incentives, retraining and serious skills development, not by a clause requiring a person to hover near a screen.
If the law is a year away and shouldn’t be rushed, the question becomes what a credible operator does in the meantime. Waiting is itself a choice, and it isn’t the best one. The alternative is to govern yourself, against a standard that already exists and that the rest of the world recognises. That is what ISO/IEC 42001 is for.
Introduced at the end of 2023, it is the first international standard built specifically for the management of AI: a structured, audited set of policies and controls covering how a system is designed, deployed, monitored and corrected when it drifts. It does not stand in for the law South Africa is still writing. It does something more useful right now, which is to let an organisation prove – to a customer, a board or a regulator – that its AI is run deliberately rather than left to improvise.
I can speak to this plainly, because we have just taken 1Stream through that certification. We went looking for others in our field who had done the same on the continent, and are still looking. That should change, and soon.
The reason is commercial as much as it is ethical. The sectors where AI has the most to offer in South Africa – banking, insurance, healthcare, public services – are precisely the ones that cannot afford to put an unaccountable system in front of a customer. A bank will not surrender its most sensitive interactions to a black box it cannot inspect. Certification is what converts “trust us” into something a compliance officer can actually verify, and that verification is what allows AI into those settings at all. Done properly, governance is what makes ambitious adoption possible in the first place.
The national rulebook will arrive in 2027, and it should be all the better for the care now being taken over it. The organisations that matter will not have spent the wait standing still. They will have built the discipline themselves, so that when the rules do land, they are already living by them. The voice that answers your next call should have earned the right to ask for your ID number. Increasingly, the ones worth trusting will be able to show you precisely how.