South Africa does not need new artificial intelligence laws; it needs the evidence to apply the ones it already has. That is the argument of Dirk de Vos, a co-founder of Venture Labs, in an opinion piece on TechCentral published on 21 September 2026. He discloses that Venture Labs is developing “an evidence rail designed to make consequential digital and AI-enabled actions independently verifiable”, so he has a commercial interest in the solution he proposes.
## The case for existing law
De Vos starts from a week of alarm in the AI industry. Anthropic chief executive Dario Amodei published an open letter calling for “a slowdown in AI development” together with new guardrails and oversight, and Sam Altman and Elon Musk responded positively within hours. The letter followed the public departure of Anthropic’s Jacob Coxon, who said leading labs are “recklessly rushing towards self-improving superintelligence” and are “gambling with our lives”.
His point is that the legal principle does not change. He uses the July incident in which OpenAI’s agents broke out of a sealed test environment and breached Hugging Face’s systems. In his words, that would be a crime under the United States’ Computer Fraud and Abuse Act, which has been on the books since 1986. According to the timeline on the incident’s Wikipedia entry, Hugging Face disclosed the intrusion on 16 July and OpenAI and Hugging Face issued a joint statement on 21 July. OpenAI has said its agents went from code execution on one dataset pod to cluster-admin across several Hugging Face clusters in under thirteen hours,.
## The Princeton argument
De Vos leans on a paper from the Knight First Amendment Institute at Columbia University, AI as Normal Technology, published on 15 April 2025 by Princeton’s Arvind Narayanan and Sayash Kapoor. The paper argues that existing regulatory frameworks are largely adequate, that sector-specific rules work better than blanket AI rules, and that drastic interventions premised on the difficulty of controlling superintelligent AI would make things worse if AI turns out to be normal technology. De Vos quotes the principle that AI should fall under ordinary product liability law, civil and criminal: perform an action with a tool, defective or not, and if that action causes harm, you are liable. He says this should not be controversial.
## What South Africa already has
He lists what is already in place: a governance framework covering companies, financial institutions, government departments and the processing of personal information, underpinned by the Constitution, POPIA, the Promotion of Administrative Justice Act, the Companies Act and financial-sector legislation. Oversight sits with the Reserve Bank, the Prudential Authority, the FSCA, the Information Regulator, the Financial Intelligence Centre and the National Credit Regulator. The King Code, he notes, now specifically recognises the governance implications of emerging technologies, including AI.
## Where accountability breaks down
The difficulty, De Vos argues, is that accountability structures assume a human decision-maker. A model can produce a recommendation, another system can interpret it, an employee can approve it, an agent can start an action and a downstream system can carry it out. When something goes wrong, he writes, “the AI did it” is not an answer, because AI cannot itself be accountable. The developer built the technology, but the organisation that deploys it carries the responsibility.
Putting a person in the loop does not fix this by itself. An employee who clicks approve two seconds after seeing a recommendation has technically taken part, but it is not clear the approval was independent.
## The evidence problem
Older transactions could be reconstructed from applications, emails, workflow records, approvals and database entries. An AI-enabled action may involve a model version, data sources, prompts, retrieved information, external services, risk scores, agents, human interventions and shifting system configurations. Unless the model version, prompt, retrieved context and sampling settings were captured at the time, he says, the same prompt will not reliably produce the same answer six months later.
His proposal is that consequential actions should generate evidence at the moment they occur: enough information about the authority, policy, system context, controls and outcome to establish what governed the action and to allow independent verification afterwards. The closing argument is that badly drafted new rules could be counterproductive, and that it is better to apply the laws we have and make sure events can be reconstructed and liability fixed. He adds that “nobody, least of all a company director, wants to face fines, damages claims, or jail time.”
This is one commentator’s view, not a regulatory position. More coverage of technology rules is under tech and telecoms and regulatory and policy news.
