AI Before the Rulebook
AI is already assisting work that affects rights, money, employment, healthcare and access to public services, while AI-specific policy and case law are still developing. South African courts have already dealt with non-existent authorities in legal submissions and with a disclosed, AI-assisted payment reconciliation, and the same design questions apply when AI influences a claim, a loan, a job application or a government benefit. This six-part series covers what makes human oversight meaningful, how to stop assistance from silently becoming authority, what evidence an AI-influenced decision should leave behind, what information may enter which service, how a person can challenge an outcome, and which governance controls should operate now. One fictional South African lender carries the examples. General information, not legal advice: read the primary sources and take advice from a qualified legal practitioner.
6 articles
- Part 1The human in the loop must show their work"Human in the loop" can mean careful independent review or one person clicking approve. South African courts have already shown what happens when generated research is not checked. Part 1 sets out what makes oversight meaningful, why verification has to be independent of the tool, and how to leave evidence that the check happened.9 min read
- Part 2AI may assist the decision; it must not inherit authorityA system can organise evidence without being authorised to decide anything about a person. The risk is that assistance quietly becomes authority. Part 2 separates the two, shows how a simple reconciliation can travel into a court order, and sets out an authority matrix for every AI use.9 min read
- Part 3The prompt is part of the evidenceIf an AI interaction materially shaped a consequential decision, the organisation should be able to reconstruct it. Part 3 sets out a twelve-item AI decision evidence pack, how to protect it without publishing it, and why asking the same question again later is not reproduction.9 min read
- Part 4Confidentiality before convenience: what may enter which AI servicePublic AI tools are one browser tab away, which does not make them approved destinations for customer, employee or privileged information. Part 4 sets out what to decide before information enters an AI service, the nine controls that make the decision stick, and why the information should be classified before anyone chooses the tool.9 min read
- Part 5A person needs a route to challenge the outcomePeople cannot challenge a decision they do not know a system helped make. Part 5 sets out the seven elements of an accountable challenge process, what section 71 of POPIA does and does not cover, and why appeal belongs in the architecture with an owner, evidence and a service level.9 min read
- Part 6Governance before final regulationSouth Africa has no final national AI policy, and its draft was withdrawn in 2026 over fictitious citations. That is not a reason to wait. Part 6 sets out the ten operating controls that make AI governance real, why risk belongs to the use rather than the model, and how one lender put the controls in place in a quarter.9 min read
Working through any of this in your own organisation?
These articles come out of delivery work rather than theory. If the problems in this series look familiar, a short scoping conversation is usually the quickest way to work out what is worth doing first.
Talk to CloudNala