MINENHLE NZIMANDE | South Africa’s legal vacuum on AI must be urgently closed

South Africa has laws on the books that should be able to cover AI-related harm. For example:

• the law of delict exists precisely to compensate people wronged by the actions or omissions of others;
• the Protection of Personal Information Act (Popia) exists to protect the personal information that the AI systems in question are often trained on and process.
• the Consumer Protection Act (CPA) exists to protect consumers from unsafe or defective products and services; and
• the constitution guarantees dignity, equality and privacy, on which these laws sit.

The main issue is that all these laws focus on a natural or juristic person who acts, decides, and can be held legally liable. Delict requires conduct, fault (in a form of negligence or intention) and a causal link to a specific wrongdoer.

Popia regulates “responsible parties” who process personal information, a concept that strains badly when an AI system generates new, synthetic personal information no human ever inputs.

The CPA was drafted for goods and services, not for autonomous AI systems that adapt and make decisions that no supplier predicted. None of these statutes, nor the constitution itself, were enacted with AI legal personality, or the absence of it, in mind.

Our law is built to identify a wrongdoer and prove fault against them and hold them liable. When the ‘wrongdoer’ is automated, the ordinary rules of evidence and causation break down

The result is a legal vacuum, not a mere gap that clever litigation can bridge.

With harm caused by an autonomous AI system or by a deepfake generated at scale, our existing legal framework simply cannot trace that harm back to an accountable party.

The identification problem is the legal problem

At the heart of this vacuum sits a deceptively simple question: who caused the harm? With autonomous AI, the chain of causation runs through developers, deployers, data suppliers and the system’s own emergent behaviour, often in ways that are unknown even to the people who built it.

Deepfakes can be generated and distributed anonymously, across borders, in seconds. An AI-fabricated legal citation can find its way into a court filing without any single person intending to mislead the court.

This is not a technical difficulty but a legal one. Our law is built to identify a wrongdoer and prove fault against them and hold them liable. When the “wrongdoer” is automated, the ordinary rules of evidence and causation break down.

Without legislation that addresses accountability for AI-caused harm, plaintiffs are basically litigating against a defendant who, for practical purposes, is “unknown”.

The human rights at stake demand urgency

This debate cannot wait for the next legislative cycle. Deepfakes strike directly at dignity and privacy and disproportionately harm women, whose images are overwhelmingly the ones fabricated and weaponised without consent.

Children are in most cases exposed to manipulated content and automated decision-making with no framework built around their vulnerability. The right to equality is violated when AI systems are trained on biased data, perpetuating discrimination at a scale that no individual human ever could.

These are not abstract policy concerns. They are constitutional rights currently infringed, while the law that should protect them remains silent on the technology infringement.

What the legislation must do

AI-specific legislation does not need to discard existing law; it needs to complete it. It should establish clear guidelines of accountability across the AI supply chain from developers, deployers and users so that liability does not simply evaporate when harm is automated.

It should address AI-generated content specifically, including deepfakes, with obligations around detection, disclosure, and takedown.

It should give Popia’s principles real teeth where AI-generated data is concerned, and it should give courts and regulators the tools to compel transparency from AI systems whose decision-making is otherwise a black box.

For business, this is not merely a compliance burden to resist. Clear rules on AI accountability give companies certainty about their exposure, a defined standard to build compliance programmes around, and protection against reputational and legal risk when they deploy AI systems that cause harm they did not intend.

For ordinary South Africans, it means that when an AI system harms them, it’s not a case closed due to lack of an identifiable defendant.

South Africa does not lack the legislative or constitutional ambition. What it lacks is a policy that brings AI systems into account.

Parliament should treat this as the urgent matter that it is, because it is not a case waiting to be filed. It is already, quietly, underway.

• Nzimande is an admitted attorney and digital rights specialist

Sowetan