Vodacom has urged African governments to avoid copying the European Union’s AI Act and to adopt a lighter, principles-based AI rulebook instead, in a policy paper released as South Africa rewrites its own national AI policy. The paper, Governing Artificial Intelligence in Africa: A Principles-based Framework for Responsible Regulation, was prepared with the law firm Bowmans, TechCentral reported on 21 October. This is a company’s policy submission, not government policy.
What the paper argues
Vodacom warns that European-scale compliance burdens could stifle innovation, price out emerging African developers and delay access to locally relevant AI. The paper cites a European Commission estimate of between €6,000 and €7,000 in compliance costs per AI application, which the Commission ties to an average high-risk system.
It names four African realities that regulation must reflect: infrastructure constraints, fragmented data governance, uneven digital literacy and deep inequality. About 86% of Africa’s workforce is in the informal sector, the paper says. It sets out six principles, namely transparency, accountability, fairness, safety, privacy and proportionality, and adapts them with measures such as plain-language disclosures in local languages and non-digital ways to challenge an AI decision.
Risk, the paper argues, should be judged locally. An AI credit-scoring system would be rated higher risk in Africa than in Europe, it says, because the potential for exclusionary harm is materially higher where many people sit outside formal data systems.
A hybrid model and a three-phase roadmap
The paper draws on parts of the EU Act as a baseline, but notes that the Act assumes conformity assessment bodies and market surveillance authorities that many African countries lack. It says the UK model depends on mature sector regulators, and calls Singapore’s guidance-led approach particularly relevant while noting that it relies on private-sector sophistication that varies across the continent.
Vodacom proposes a hybrid structure: a lead coordinating body, ideally housed in an existing ministry or regulator, sector regulators enforcing AI rules in their own fields, and a multi-stakeholder advisory council. It says a standalone AI agency needs resources most African jurisdictions cannot commit, and that strengthening data protection, competition and telecoms law may give faster governance benefits than standalone AI legislation. In telecoms, AI would fall to the existing telecoms regulator.
The roadmap has three phases. The first is a national AI strategy, a lead body and basic transparency rules for high-risk systems such as those deciding access to credit, healthcare or jobs. The second adds mandatory impact assessments and incident reporting once triggers are met, backed by a data protection authority with real enforcement capacity. The third brings independent audits and national and regional registries of high-risk systems.
The paper also favours regional routes such as SADC over binding continental treaties. It notes that only 20 of the African Union’s 55 member states have ratified the Malabo Convention on cybersecurity and data protection.
Vodacom group chief officer for external affairs Ayman Essam said Africa must have a meaningful voice in shaping the rules that will govern its AI future. Bowmans partner Kate Paterson said Africa can develop regulatory approaches that draw on global best practice. Vodacom itself acknowledges that it holds a dual role, as both an AI deployer and a reform advocate, which it says warrants transparency.
Where the South African rewrite stands
The paper does not mention South Africa’s withdrawn draft, according to TechCentral. That draft was approved by Cabinet on 25 March and gazetted for comment on 10 April. Communications minister Solly Malatsi withdrew it on 26 April after the department confirmed it contained fictitious sources in its reference list, which he said were likely generated by an AI tool and not checked. Another TechCentral report put the figure at at least six of 67 references.
On 12 May, Malatsi announced an independent panel to rebuild the policy, chaired by Wits University researcher Benjamin Rosman. Its members include Bowmans attorney Heather Irvine. The withdrawn draft had proposed seven new institutions, among them a National AI Commission, an AI Ethics Board and a National AI Safety Institute.
In July, acting deputy director-general Jeanette Morwane said the redraft would leave each sector to write its own AI strategy within national guidelines, and would not prescribe to sectors. Reporting on that symposium said the department was then still targeting Cabinet in November 2026, with January 2027 as the fallback. Parliament’s communications committee chair Khusela Diko wants a leaner model that relies on existing regulators, and said the country does not need a plethora of new institutions.
TechCentral reports that Malatsi has since said a revised version should be published in the first quarter of next year. The sources differ on timing, so the date should be treated as a target. Until a policy is gazetted, South Africa has no formal national AI framework.
Our earlier coverage explains how the withdrawn policy came undone and why South Africa is backing global AI rules while its own are unfinished. Companies planning AI projects can also see the SABS draft AI standards open for comment until 10 November.
