Vodacom has called on African governments not to fully adopt the EU's Artificial Intelligence Directive, warning that adhering to European standards could 'stifle innovation, push out developing African developers, and slow down equitable access to locally relevant AI.'
This argument is central to the document 'Governing Artificial Intelligence in Africa: A Principles-based Framework for Responsible Regulation,' which Vodacom developed with the law firm Bowmans and released on Wednesday. The publication coincides with South Africa's ongoing revision of its national AI policy. Communications Minister Solly Malatsi previously withdrew a draft in April after discovering fictitious references. His department now plans to release an updated version in the first quarter of next year, Malatsi announced at a presentation in Randburg last week.
During the launch of the document, Ayman Essam, Vodacom's Head of External Relations, stated: 'Africa must have a significant voice in shaping the rules that will govern its future in AI.'
Document Proposals
The document highlights four African specificities that should shape regulation: infrastructure limitations, fragmented data governance, uneven digital literacy, and deep inequality, given that about 86% of Africa's workforce is employed in the informal sector.
The framework is based on six principles (transparency, accountability, fairness, safety, privacy, and proportionality), which the authors claim are present in almost all reviewed national systems. The document adapts these principles to African conditions:
- Providing information in simple language in local languages;
- Having non-digital ways to appeal AI decisions where connectivity or literacy is limited; and
- Implementing fairness measures that account for people outside formal data systems.
It is also argued that risk assessment should be conducted at the local level. For example, a credit scoring system in an economy dominated by the informal sector should be classified differently than the same system in Europe because the 'potential for exclusionary harm is materially higher.'
Why Not Europe
The preferred model proposed in the document is a horizontal baseline 'building on elements of the EU AI Act' and supports the act's risk-based logic. However, it notes that the law presupposes the existence of conformity assessment bodies, market surveillance authorities, and specialized regulators, which many African countries lack.
Furthermore, it cites European Commission estimates of compliance costs ranging from 6,000 to 7,000 euros per AI application. According to the Commission, this amount applies to the average high-risk system type; other systems would have 'only minimal information obligations.' The UK model relies on mature industry regulators, as the document points out. Singapore's guidance-based approach is 'particularly relevant' for Africa, but it depends on private sector complexity, which is inconsistent across the continent.
Lessons for Pretoria
The document does not address South Africa's withdrawn proposal, which suggested seven new institutions, including a National AI Commission, an AI Ethics Council, and a National AI Security Institute. Vodacom believes that establishing a separate AI agency 'requires substantial resources that most African jurisdictions currently cannot allocate.'
Instead, it recommends a hybrid model: a leading coordinating body, preferably housed within an existing ministry or regulator; industry regulators applying AI rules in their respective domains; and a multilateral advisory council. It adds that in many countries, strengthening existing data protection, competition, and telecommunications laws 'may provide more immediate governance benefits than developing autonomous AI legislation.'
The department appears to be moving in a similar direction regarding sectors. In July, Acting Deputy CEO Jeanette Morwane told TechCentral that the review would allow individual sectors to write their own AI strategies based on a set of national guidelines. Khusela Diko, chairperson of the parliamentary communications committee, then stated: 'We do not necessarily need to create many new institutions.' But she added: 'It must go beyond principles; we understand the principles.'
The document's three-stage roadmap begins with a national AI strategy, a leading body, and basic transparency rules for high-risk systems, such as those determining access to credit, healthcare, or employment. Following certain triggers come mandatory impact assessments and incident reporting, including a data protection authority with enforcement powers and a budgeted AI strategy. Independent audits and national and regional registries of high-risk systems take the final place.
Vodacom is interested in the outcome. Recognizing its dual role as both an AI developer and a reform advocate, the company notes that 'this requires transparency.' It strongly urges governments to favor principle-based guidance and 'regulatory experiments over strictly prescriptive technical requirements,' which is a softer approach than the EU's.
Within its hybrid model, AI in telecommunications will fall under the purview of telecom regulators with whom Vodacom already works, rather than a new agency. Additionally, Heather Irvine from Bowmans is part of the independent expert group appointed by Malatsi in May to assist in restoring South Africa's policy, the firm disclosed.
International Level
The document views regional economic communities, such as the Southern African Development Community, as a potentially more realistic path than binding continental treaties. It notes that the African Union's Malabo Convention on Cybersecurity and Data Protection has only been ratified by 20 of its 55 member states.
Bowmans partner Kate Paterson stated: 'Africa has the opportunity to develop regulatory approaches that utilize best global practices while remaining firmly rooted in local legal, economic, and social realities.'