---
title: "The architecture of trust: Why South Africa’s AI accountability framework is fragmented, not failing"
description: "Trust does not hold itself up. That was the starting premise of a panel that I joined at the inaugural LexisNexis Future of Law Conference in Sandton last week, under the banner “The Architecture of Trust: Accountability in the Intelligent Age”. The organisers put it well: trust rests on structures – codes of conduct, governance frameworks, disclosure obligations, professional standards and institutional culture – that determine who answers for what, and to whom. The question asked is whether that architecture remains fit for purpose now that artificial intelligence sits inside the governance framework of the very institutions it was built to support."
type: "NewsArticle"
publisher: "Daily Maverick"
site: "https://www.dailymaverick.co.za"
section: "Sponsored Content"
author: "ENS"
author_url: "https://www.dailymaverick.co.za/author/ens-africa/"
canonical_url: "https://www.dailymaverick.co.za/article/2026-11-11-the-architecture-of-trust-why-south-africas-ai-accountability-framework-is-fragmented-not-failing/"
published: "2026-11-11T04:00:00"
updated: "2026-11-11T10:37:55"
lang: "en-ZA"
word_count: 2269
---

# The architecture of trust: Why South Africa’s AI accountability framework is fragmented, not failing

> Trust does not hold itself up. That was the starting premise of a panel that I joined at the inaugural LexisNexis Future of Law Conference in Sandton last week, under the banner “The Architecture of Trust: Accountability in the Intelligent Age”. The organisers put it well: trust rests on structures – codes of conduct, governance frameworks, disclosure obligations, professional standards and institutional culture – that determine who answers for what, and to whom. The question asked is whether that architecture remains fit for purpose now that artificial intelligence sits inside the governance framework of the very institutions it was built to support.

By ENS · Published 11 November 2026, 06:00 SAST · Updated 11 November 2026, 12:37 SAST

## Content

My answer, which I seek to develop here and which I suspect not everyone may share, is that the architecture is broadly sound in its current form. It is fragmented, certainly, and it is being outpaced in places – but in practice not in principle. The real deficit in most South African boardrooms is not a missing statute. It is a visibility gap.

- Directors cannot hand their duties to a machine
- Our current framework: fragmented, not lawless
- Outpaced? In practice, yes. In principle, no.
- We in South Africa have “regulated in a rush” before – first for COVID-19 in 2020, and then in late 2022 in an effort to avoid the FATF grey list. The quality of both sets of regulation showed their urgency, although at least one clearly served its purpose: we are off the grey list. The merits of the COVID-19 regulations remain open to debate, but COVID-19 and AI do seem to share one thing: speed of spread and pace of evolution. Rules designed for the early stages of the pandemic struggled to keep up as the virus mutated. The lesson for AI is that we should not box ourselves into rules written for earlier “variants” of AI that are outdated shortly after they are enacted. If and when we do legislate, the rules should be principle-based in keeping with our common law tradition, technology-neutral and ideally be built to be revisited as the technology evolves.
- Who and what is missing? Let in the light

Company directors are and must be natural persons. They cannot abdicate (as distinct from delegate) their duties and responsibilities, whether to a committee, a consultant or an algorithm. AI can, and should, become an enormously helpful tool for directors. It cannot, however, replace the decision-making that company law reserves to the natural person directors.

AI should not yet be making board decisions, however, there is a strong argument that it should be informing them. That distinction matters a great deal, because accountability still sits with people. Once we blur the line between a tool that informs and a tool that decides, we begin to lose sight of who is answerable when things go wrong..

AI is double-edged. At board level it can sharpen analysis, surface risks earlier, challenge strategy and test assumptions; but too much reliance on it creates its own hazard. At operational level, it can transform efficiency; but deployed recklessly, it becomes a source of legal, regulatory and reputational exposure. Both edges need to be governed, and the key takeaway is this: it is ultimately the responsibility of the whole board to do so.

It is fashionable to say that South Africa has “no AI law”. That is true only in the narrowest sense. We have no dedicated AI statute. We do have a layered and, I submit, quite capable governance framework.

The Companies Act requires directors to act with the degree of care, skill and diligence. As Dinesh Govender, the CEO of Discovery Vitality, put it recently, one could argue that, in the modern world, it would be almost negligent for a board not to us AI as a decision-making tool – and equally negligent to rely on it without proper human oversight. . The standard of the reasonable director is not static. It moves with the tools reasonably available, and with the risks those tools introduce. It is telling, too, that the reliance protections in sections 76(4) and 76(5) extend to employees, professional advisers and board committees – people, not algorithms.

King V addresses AI directly. It expects AI use to be ethical, human-centric, transparent, explainable, trustworthy, fair and secure, with clear accountability for decisions and outcomes – including human oversight and override mechanisms commensurate with the level of [risk.in](http://risk.in) King V is not hard law. but, the JSE Listings Requirements give it force for listed companies. and our courts have long treated King provisions as evidence of what reasonable governance looks like. A board that ignores Principle 10 and then suffers AI-related harm should expect that omission to feature prominently in any argument that its directors breached their duty of care under section 76.

The Protection of Personal Information Act (“**POPI**”) does not regulate AI as a technology, but it bites wherever an AI system processes personal information – which is to say, very often. Section 71 is the provision every board should read. It protects people from decisions with legal or significant consequences based solely on automated profiling, for example of their creditworthiness, their work performance or their conduct. The exceptions are limited.

As Rakhee Dullabh, executive in ENS’ TMT team argued, many organisations assume they can sidestep section 71 by inserting a human somewhere in the process. That may not be enough. A nominal reviewer who lacks the information, expertise or authority to challenge a system’s recommendation is not meaningful oversight; a recruiter who simply confirms an AI tool’s rejection of an applicant is rubber-stamping, not deciding. Add a damages remedy that does not require proof of intent or negligence, and POPI already has real teeth in the AI context.

In addition to the above, there are a number of specific statutes and sectoral regulations that would apply, as well as the common law that may be engaged when a negligently deployed algorithm causes a loss. And a board must take cognisance of all of these is designing governance frameworks and conducting risk assessments.

So is our existing framework being outpaced? Not at the level of principle. But for many companies, it is being outpaced at the level of practice . The laws are fragmented but that doesn’t translates into a wholly inadequate governance framework.

The gap, if anything, is a visibility gap. As my colleagues have observed, data governance is not AI governance. An organisation may know exactly what information it holds and which employees may access it, while having little visibility over whether they are uploading it into generative AI tools and which ones – the phenomenon now widely called “shadow AI”. It may procure a technology solution without appreciating that AI functionality has been embedded in it, or that a supplier’s next update will change how that functionality behaves. AI can begin operating across an organisation faster than the governance structures intended to manage it. The answer is not to build parallel structures.

Effective AI governance does not require organisations to reinvent their existing governance architecture; in most cases they should simply build on it and not run parallel ones. What that looks like in practice is not complicated, though it requires discipline. A good framework would include an AI charter - an umbrella document setting out the company’s philosophical approach - flowing into more detailed policies. AI and data risks and opportunities should then sit on the agendas of the board and its sub-committees, notably the risk committee, with assigned responsible executives, and potentially a cross-functional AI working group drawing legal, risk, compliance, privacy, IT, HR and the business together. An AI inventory and risk assessment is also vital to inform the governance required. Directors must know where AI is being used in the organisation. This cannot be over-emphasised. The inventory should identify each use, whether genuine human oversight exists, and which uses are high risk and which low. Individual responsibility should then be assigned as part of the governance process. Finally disciplined contracting is also essential as is understand the liability regime with AI providers as these are often well drafted but heavily favour the provider.

In the absence of a statutory allocation of responsibility between those who build AI systems and those who use them the vendor contract becomes the primary instrument of liability attribution

### **Looking abroad: two models, and a case for watching and waiting**

Internationally, jurisdictions have diverged sharply. The United States appeared at one stage to be heading towards strict regulation, but my assessment is that concern about constraining domestic developers in the technology innovation race with China – and the national security interest in staying ahead – has outweighed the perceived risks of lighter-touch oversight. This was certainly true prior to the recent mid-term elections, but the political pendulum may swing strongly back the other way now in light of the Democratic blue wave that flowed from those elections. Advantage China?

Europe went the other way. Regulation (EU) 2024/1689, the EU AI Act, is comprehensive, risk-based hard law. The civil law tradition made codification a more natural and perhaps necessary instinct there than it is for our common law system. Two features of the EU model do, however, appeal to me. First, it bifurcates regulation between “providers” – those who develop an AI system and place it on the market under their own name – and “deployers” – those who use an AI system under their authority – with distinct obligations for each. Deployers of high-risk systems, for example, must assign human oversight to natural persons with the necessary competence, training and authority. Second, it classifies AI systems into four tiers: (i) prohibited practices; (ii) high-risk systems subject to strict requirements; (iii) systems carrying transparency obligations; and (iv) minimal-risk systems that are largely left alone.

South African companies should not regard this as foreign news. The Act extends to businesses outside the Union where the output produced by the AI system is used in the Union. Fines for prohibited practices can reach EUR35 million or 7% of worldwide annual turnover, whichever is higher. If you do business in Europe, you should establish now whether the Act applies to you.

From a domestic perspective, however, my personal view is that we can afford to watch and wait a little longer. As I have suggested above, our accountability framework may be fragmented, but it is not inadequate. Rather than burdening South African companies with more compliance now for the sake of it, we should observe how regulation actually plays out in jurisdictions that legislate and those that do not, and learn from both. One caveat: if something truly significant goes wrong and heaven forbid there is such as loss of life, or limbs, or a broad cross-border banking system failure or some such – and AI gets the blame, there may well be a rush to regulate, if only so that lawmakers can be seen to be acting. That would be understandable politically. It would not, however, change my view on the merits.

So who should design the accountability mechanisms? In a company it is the board which answers to the shareholders who appoint it. We are not yet at the point where specific shareholder votes on AI are required, as we now see with remuneration for public and state-owned companies under sections 30A and 30B of the Companies Act, which came into force on 22 May 2026. But we may get there.

Who is usually missing is more context-specific, but most often it is the people the decision actually affects. If you describe yourself as a people-first business, give your people a voice. If you are customer-first, hear your customers. If you govern a broad-based empowerment or employee share scheme, the beneficiaries and employees should be heard.

And there is an institutional mechanism already built for this. A properly functioning Social and Ethics Committee that reports to shareholders at the AGM – is a natural home for the ethical, governance and social impact questions that AI raises. It already considers most ESG matters, and AI touches every one of those headings, including the environmental. Every prompt consumes water and electricity. The early viral estimates of that usage may have been overstated, but AI is not free from an environmental cost perspective, and that cost belongs in the board’s line of sight. We do not need new law for any of this.

I am not convinced the architecture of trust needs to be rebuilt. But if I could change one thing, it would be to enhance transparency – in processes, in decision-making, and towards shareholders, stakeholders and regulators. Transparency from regulators and from AI providers themselves is equally vital. Transparency guards against corruption and builds confidence.

The degree of transparency required is context-specific. It is critical for listed and state-owned companies and for regulators, and less so for privately held companies – unless they carry a large social impact, for which the Companies Act already uses the public interest score as a proxy. That proxy may prove a useful calibration tool if and when we come to regulate AI directly. In the meantime, King V already hard-wires in transparency: its apply-and-explain regime requires a public narrative of governance choices, an explanation for practices not adopted and a concluding statement on whether governance outcomes have been achieved.

I closed my remarks with a quote I first heard from our well-read Chairman, Prof Michael Katz. It is from an author, Louis Brandeis who, before joining the United States Supreme Court as a justice in 1916, wrote *Other People’s Money and How the Bankers Use It*. In it he said that “*sunlight is said to be the best of disinfectants; electric light the most efficient policeman*”. Brandeis was writing about bankers more than a century ago, but today you could easily replace “money” with “information and data”, and “bankers” with “algorithms”, and the point stands undiminished.

If you cannot explain transparently how you are using AI, that in itself should prompt the question whether you are using it properly – or whether you should be using it at all. That, rather than another statute, is where the architecture of trust begins. I would welcome the debate.**DM**

*Author:**Matthew Morrison, Executive: Corporate Commercial, ENS*