Many South African business leaders have quietly concluded that because there is no AI law here yet, there is no compliance question to answer. Adopt what you like, worry about the rules when they arrive. That reading is comfortable and wrong. The absence of legislation does not remove the risk of deploying AI. It simply leaves that risk sitting entirely with you, the organisation, with no framework to point to and nothing to stand behind if a decision goes wrong. This is why governance matters now, before the law, and what an organisation should do about it.
No law is not the same as no risk
It is easy to read a regulatory gap as a free pass. It is closer to the opposite. When there is a law, it tells you what good looks like and gives you a defined line to stay inside. Meet it and you have a defensible position. With no AI legislation in South Africa, that line does not exist yet, which means every decision your AI makes about a customer is one you are accountable for on your own terms, with no external standard to say you acted reasonably. The risk did not disappear. It became unallocated, and unallocated risk has a way of landing on whoever deployed the system.
What you are actually exposed to
Strip away the abstraction and the exposure is concrete. An AI system that mishandles a vulnerable customer. A decision about a person that you cannot explain after the fact. Data used in a way the customer did not expect. A model that behaves differently this month than it did last month. Each of these is a real event that a board, a regulator that arrives later, or a customer’s lawyer can ask you to account for. Without a framework, your answer is that you did your best, which is not an answer that survives scrutiny.
A framework that fills the vacuum
This is the gap ISO 42001 is built for. It is the international management standard for artificial intelligence, and certification means an independent body has audited how an organisation builds, governs and takes accountability for its AI. In a market with no local law, that audited framework becomes the credible line that legislation has not yet drawn. It lets an organisation say, and prove, that its AI is managed to a recognised international standard, covering ethics, transparency and accountability. 1Stream pursued and is certified to ISO 42001 for exactly this reason. In the absence of regulation, it is the strongest available basis for trusting how AI is run.
Why moving now beats waiting
There are two ways to treat the current gap. Wait for the law and adopt AI once someone tells you how, or adopt responsibly now against an international standard and be ready when the law lands. The second is the stronger position for a simple reason. Regulation is coming, here and everywhere, and it tends to formalise the same principles ISO 42001 already covers. An organisation that built on that framework will find the eventual law largely describes what it already does. An organisation that waited, or moved without any framework, will be retrofitting governance onto live systems under a deadline, which is slower, more expensive and more exposed. Governance built in early is cheaper than governance bolted on late.
What this means for your organisation
The practical takeaway is that you do not have to choose between moving fast and moving responsibly. Choosing an AI partner that is certified to a recognised standard lets you adopt AI now, with an audited basis your risk and compliance teams can rely on, and clears the internal approval that otherwise stalls these projects. It also means that when South African AI regulation does arrive, you are ahead of it rather than scrambling to catch up. In a vacuum, the organisations that set their own high standard are the ones that will look prepared, not exposed, when the rules are written.
If you are weighing up AI and want to understand what responsible governance should look like for your organisation while the law is still catching up, start with a structured conversation.
Book a CX AI Readiness Assessment at 1stream.co.za/cx-ai-readiness-assessment.
Frequently asked questions
Does South Africa have laws regulating AI?
Not yet. There is no dedicated AI legislation in South Africa, which means the responsibility for using AI safely and accountably currently sits with the organisation deploying it.
If there is no AI law, why does governance matter?
Because the absence of a law does not remove the risk, it leaves it with you. Without a framework you have no external standard to show you acted reasonably if an AI decision is challenged.
What is ISO 42001 and how does it help?
ISO 42001 is the international management standard for AI. Certification gives an organisation an independently audited framework covering ethics, transparency and accountability, which is the credible line to work to while local law is still absent.
Should we wait for AI regulation before adopting AI?
Waiting leaves you retrofitting governance later under a deadline. Adopting against an international standard now lets you move responsibly and be ahead of the regulation when it arrives.
Is 1Stream certified for responsible AI?
1Stream is certified to ISO 42001, the international standard for AI management, which gives buyers an audited basis for how its AI is governed.
