Services on Demand
Article
Indicators
Related links
-
Cited by Google
-
Similars in Google
Share
Obiter
On-line version ISSN 2709-555X
Print version ISSN 1682-5853
Obiter vol.45 n.1 Port Elizabeth 2024
ARTICLES
Towards drafting artificial intelligence (AI) legislation in South Africa
Sizwe Snail Ka MtuzeI; Masego MorigeII
ILLB LLM; Adjunct Professor, Nelson Mandela University Visiting Professor, The Center for Technology & Society (CTS), FGV School of Law
IIBCom LLB; Candidate Attorney, Snail Attorneys
SUMMARY
Artificial Intelligence also abbreviated as "AI" has been the subject of much legal debate and legal writing. This article seeks to identify internationally accepted AI principles and norms that are contained in the South African Constitution. This article also seeks to identify policy such as the PC4IR Report and legislation that regulates and accommodates the use of AI in South Africa. What emerges clearly is that there has never been a deliberate attempt to legislate AI, and that the legislation referred to is applicable by coincidence not intention. The article goes on to highlight African and BRICS policies and best practices on AI, European best practices and legal norms and values on AI, and the draft EU AI Act. The article concludes with a recommendation that South Africa introduce AI legislation as a matter of urgency.
1 INTRODUCTION TO ARTIFICIAL INTELLIGENCE
Artificial Intelligence (AI) is not the kind of utility that needs to be regulated once it is mature but needs to be regulated now. It is a powerful force, a new form of smart agency, which is already reshaping our lives, our interactions, and our environments.1 When people think about AI, they may have visions of the future. But AI is already in use. The term Artificial intelligence (AI) is reputed to have been coined in 1956 by American scientist John McCarthy. Gravett,2 quoting the works of McCarthy explains:
"[A]n attempt will be made to find how to make machines use language, form abstractions and concepts, solve kinds of problems now reserved for humans, and improve themselves ... For the present purpose the artificial intelligence problem is taken to be that of making a machine behave in ways that would be called intelligent if a human were so behaving."3
In its simplest form, AI is defined as the recreation of aspects of human intelligence in computerised form.4 A more sophisticated definition of AI was formulated by Gennatas and Chen, who define AI as "[t]echnology that allows humans to build intelligent machines".5
Since then, AI has come to encompass areas such as automated reasoning, natural language processing, expert systems, game playing, vision and learning capabilities.6 Roberts et aí, citing the works of Floridi, define AI as:7
"a cluster of smart technologies, ranging from machine learning software, to natural language processing applications, to robotics, that has unprecedented capacity to reshape individual lives, societies and the environment."8
AI has many applications that act similarly to human beings in modern times. AI is used for voice-operated personal assistants like Siri,9 self-driving cars, and text and image generators.10 Alongside its growing power and its potential, AI raises moral and ethical questions. The technology has already been at the centre of a plethora of ethical risks and dilemmas, and multiple scandals such as the infringement of laws and rights, as well as racial and gender discrimination.11 Belli et aí point out that AI is being used not only for e-commerce, but also for facial recognition technologies and access to financial services, and this fact impacts not only the economy, but also people's lives and democracy itself.12 Etzioni has suggested that there is a need to regulate artificial intelligence in order to steer its development and application,13 but he is not as concerned as technology entrepreneur Elon Musk, who referred to AI as an existential threat to humanity.
This article commences with a short introduction to AI and then examines some generally accepted AI principles and norms. It then discusses the South African legal position on AI and initiatives on the African continent to regulate AI. Lastly, it takes a glimpse at the recent draft European Union (EU) AI Act.
2 GENERAL AI LEGAL PRINCIPLES AND NORMS
AI has the potential to transform society significantly, and it is a means to enhance human development. AI systems need to be human-centric, and developers should seek to maximise the benefits of AI solutions while minimising their risk14 and exposure to legal claims arising from AI-related violations of basic human rights. Brand points out:
"In the context of public law there are many questions and challenges relating to individual rights. For example the right to privacy, and regarding the role and responsibilities of government relating to policy development and regulation dealing with technological developments ... that give rise to questions about the values, ethical standards and regulatory environment relating to the current digital era, also referred to as the Fourth Industrial Revolution."15
Marengo states that AI systems must respect five ethical principles: respect for human autonomy, prevention of harm, fairness, substantive dimensions and explicability in the development and deployment of trustworthy AI.16Jobin et al state, according to their study of several states around the world, that:
"eleven overarching ethical values and principles have emerged from our content analysis. These are, by frequency of the number of sources in which they were featured: transparency, justice and fairness, non-maleficence, responsibility, privacy, beneficence, freedom and autonomy, trust, dignity, sustainability, and solidarity."17
The Organisation for Economic Co-operation and Development (OECD) defines AI as
"a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. AI systems are designed to operate with varying levels of autonomy."18
The OECD views AI as a general-purpose technology having the potential to improve the well-being and welfare of people, contribute to sustainable global economic activity, assist in responding to key global challenges, and increase innovation and productivity. Alongside all these benefits, AI poses various challenges to our society and economy, specifically with regard to democracy and human rights, economic shifts and inequalities, competition, and transitions in labour markets.19
The Recommendation on Artificial Intelligence adopted by the OECD Ministerial Council on 22 May 2019 aims to encourage trust and innovation in AI by encouraging the responsible stewardship of trustworthy AI, while safeguarding human rights and democratic values, as well as existing OECD standards such as privacy, digital security risk management, and responsible business conduct.20 The OECD Recommendation identifies five core value-based principles, which are as follows:21
1. "Accountability" entails that AI actors are required to be accountable for the proper functioning of the AI systems and should respect the principles.22
2. "Transparency and explainability" requires AI actors to provide meaningful information that is appropriate to the context, as well as consistent with the state of art, to bring awareness to stakeholders of their interactions with AI systems, to foster general understanding of AI systems, and to allow those affected by AI systems to challenge its outcome based on plain and easy-to-understand information.23
3. "Robustness, security and safety" requires AI systems to function in an appropriate manner and ensure that they do not impose unreasonable safety risks. AI actors should ensure traceability of its datasets, processes, and decisions made during the AI systems life cycle in order to analyse the AI system's outcomes and responses to inquiry, appropriate to the context and consistent with state of art.24
4. "Human-centred values and fairness" must be respected. AI actors must respect the rule of law and democratic values, as well as human rights, which include freedom, dignity, autonomy, privacy, data protection, nondiscrimination, diversity, equality, fairness, social justice and internationally recognised labour rights.25
5. "Inclusive growth, sustainable development and well-being" means that stakeholders must proactively partake in responsible stewardship of trustworthy AI, such as increasing human capabilities and enhancing creativity, advancing inclusion of minority populations, reducing economic, social, gender and other inequalities, as well as protecting natural environments.26
The OECD Recommendation makes five additional recommendations for policy makers relating to international and national cooperation for trustworthy AI.27 These include:
1. Building human capacity and preparing for labour market transformation: Governments should empower people to effectively use and interact with AI systems, as well as equip them with the necessary skills.
2. Shaping an enabling policy environment for AI; Governments should promote a policy environment that supports the transition from the research-and-development stage to the operation-and-deployment stage.
3. Fostering a digital ecosystem for AI: Governments should foster the development of, and access to, a digital ecosystem for trustworthy AI.
4. Enhance international cooperation for trustworthy AI.
5. Investing in AI research and development: Governments are encouraged to consider long-term public investments, as well as encourage long-term private investments, in research and development, as well as in datasets that represent and respect privacy and data protection.28
During the 40th session of UNESCO's General Conference in November 2019, it adopted Resolution 37, which mandated the Director-General "to prepare an international standard-setting instrument on the ethics of artificial intelligence (AI) in the form of a recommendation".29
The UNESCO Resolution on Artificial Intelligence30 does not seek to provide a single definition of AI, since such a definition would continually evolve over time in accordance with technological developments. Its ambition is to address those features of AI systems that are of central ethical relevance.31 Addressing risks and ethical concerns should not impede innovation and development, but should give new opportunities and encourage ethical research and innovation that anchor AI technologies in human rights and fundamental freedoms, values and principles, as well as morals.32
The UNESCO Recommendation approaches AI systems as systems that have the capacity to process data and information in a similar way to intelligent behaviour, and generally includes aspects of reasoning, learning, perception, prediction, planning or control. Three central elements relate to AI systems:
1. AI systems are information-processing technologies that are designed to perform at different degrees of autonomy by way of knowledge modelling and representation, as well as exploiting data and calculating correlations.
2. Ethical questions that have been raised relate to all stages of the AI system life cycle. Furthermore, an AI actor can be defined as any actor involved in at least one stage of the AI system life cycle, such as natural and legal persons, researchers, programmers, engineers and data scientists, among others.
3. AI systems raise new types of ethical issues, such as the system's impact on decision-making, labour and employment, social interaction, education, consumer protection and personal data, rule of law, human rights, and fundamental rights such as freedom of expression.33
UNESCO provides for various values and principles that should be respected by AI actors in the AI system life cycle, and, where appropriate be promoted through amendments to existing (and the evolution of new) legislation, regulations and business guidelines that must comply with international law, including the United Nations Charter and member states' human rights obligations, as well as internationally agreed obligations such as the United Nations Sustainability Development Goals (SDGs).34 The values and principles are as follows:
"[R]espect, protection and promotion of human rights and fundamental freedoms and human dignity ... AI systems must be consistent with international law and human rights law; proportionality and Do No Harm, AI systems in its life cycle should ensure that they do not exceed what is necessary to achieve its legitimate aims and objectives ... fairness and non-discrimination, AI Actors are required to promote social justice, fairness and non-discrimination of any compliance with the international law; safety and security; right to privacy, and data protection; ... transparency and explainability, responsibility and accountability ..."35
The Recommendation states that the trustworthiness and integrity of the AI system life cycle is essential to ensure that AI technologies will work for the good of humanity, individuals, societies, the environments and ecosystem, and that they will embody the Recommendation's values and principles.36However, UNESCO recognises that member states will be at different stages of readiness for implementation of the Resolution; thus UNESCO will develop a readiness assessment methodology to assist interested member states, as well as ensure support for interested member states in terms of developing a UNESCO methodology for "ethical impact assessment" (EIA) of AI technologies, sharing of best practices, assessment guidelines as well as other mechanisms and analytical work.37
The United Nations (UN) defines artificial intelligence as
"the capacity for computer systems to be programmed to complement, mimic, or replace human 'thinking', for example by spotting patterns, making decisions, or predicting likely outcomes on a particular task."38
It is abundantly clear that international organisations such as UNESCO, the UN and the OECD have spearheaded the effort toward creating and enforcing internationally acceptable norms and values for regulating AI around the world.
3 AI IN SOUTH AFRICA
South Africa currently lacks legislation, regulation or official policy that dictates or guides the ethical use of AI,39 and there is little legal literature about it. Adams summarises the definitions of foreign authors and defines AI as "the simulation of human intelligence by algorithms, computer programmes and machines".40 Gravett, citing the works of Turing,41 and Shubhendu and Vijay,42 gives this definition:
"[A] computers' ability to imitate human intelligent behaviour, especially human cognitive functions, such as the ability to reason, discover meaning, generalise and learn from past experience ... machines that respond to stimulation consistent with traditional responses from human, given the human capacity for contemplation, judgment and intention."43
The international developments highlighted above provide useful guidance for the development of an AI legal framework in South Africa. These principles are foundational to the new AI regulation in the EU, and provide a well-founded, comprehensive, regulatory framework for the development and use of AI; thus, they are a good point of departure for countries embarking on the road of regulating AI.44
Brand states that, when looking at South Africa's constitutional provisions on human rights compared with the key principles for regulating AI (as referred to above), he finds that most principles are contained in the Constitution of the Republic of South Africa, 1996 (Constitution).45 Brand also points out that "respect for human rights" can be found in sections 1 and 7 of the Constitution. Section 1 also gives effect to the principle of "transparency" and "accountability".46 Brand goes on to state that the principle of "privacy and data governance" can be found in section 14 of the Constitution. Brand concludes that the "rule of law" principle can be found in sections 1 and 2 of the Constitution, and the principle of "non-discriminating and fairness" can be found in sections 1, 9 and 10 of the Constitution.47 The principle of "freedom and autonomy" is also enshrined in sections 12, 13 and 16, and "dignity" is enshrined in section 10 of the Constitution.
In 2019, the South African President constituted the Presidential Commission on the Fourth Industrial Revolution.48 The Commission's Report (PC4IR Report)49 came up with eight key recommendations, including the establishment of an artificial intelligence (AI) institute and the review and amendment (or creation) of policy and legislation.50 Existing legislation, although it may be loosely applicable to AI, is generic and limited in its relevance, while government policy focuses almost exclusively on economic development, and not on the appropriate use or ethical issues associated with AI.51
There are few pieces of legislation that already accommodate and/or promote the use of AI. One example is the Electronic Communications and Transactions Act52 (ECT Act), which provides that an automated transaction is an electronically concluded transaction where one or both of the parties make use of automated systems (that is, a software program that communicates with or responds to third parties without any human intervention). An automated transaction is an electronic transaction performed or conducted by electronic means in which software is used without human intervention to form contracts and perform obligations under existing contracts.53
Section 20 of the ECT Act provides very specific rules to ensure that the resulting agreement will be fair and effective. In terms of section 20(a), an automated transaction may be formed where an electronic agent performs an action required by law for agreement formation. Section 20(b) of the ECT Act states that an agreement may be formed where all parties to a transaction (or either one of them) uses an electronic agent. In terms of this provision, a party on whose behalf software or an electronic agent has been programmed to respond by concluding contracts will be bound to the preprogrammed actions of the technology deployed. Section 20(c) of the ECT Act provides that a party using an electronic agent to form an agreement is, subject to section 20(d), presumed to be bound by the terms of that agreement, irrespective of whether that person reviewed the actions of the electronic agent or the terms of the agreement. Section 20 of the ECT Act has created a strict statutory regime for the validity and enforceability of automated transactions. Section 20(d) of the ECT Act provides a party contracting with an electronic agent the right to review the transaction as a whole prior to the formation of a contract.54
In addition, the right of consumers not to be unlawfully targeted with unsolicited electronic communications (spam) and automated decision-making is also acknowledged in both of sections 69 and 71 of the Protection of Personal Information Act55 (POPIA), which deals with automated decision-making. This latter provision prohibits automated decision-making where this results in legal consequences for the data subject that affect the data subject to a substantial degree and where the decision is based solely on the automated processing of personal information that pertains to the data subject's work performance, creditworthiness, reliability, location, health, personal preferences or conduct.
In addition, section 71 of POPIA provides that data subjects who are subject to automated decisions made in connection with the conclusion or execution of a contract, and where the decision has legal consequences or can have a substantial effect on them, have the right to sufficient information about the underlying logic of the automated process and to make representations about the decision.56 Similarly, section 5(g) of POPIA confers upon a data subject the right not to be subject, under certain circumstances, to any decision that is based solely on the automated processing of his, her or its personal information intended to provide a profile of such person.57 Adams makes it clear that POPIA limits AI's ability to make decisions where those decisions use the personal information of a data subject.58
Thus, according to De Stadler et al, "automated decisions" are also permissible where there is a law or code of conduct in which "appropriate measures" are taken to safeguard the legitimate interest of data subjects.59Another example is found in the Financial Services Conduct Authority Rules, which include fit-and-proper requirements for intermediaries who give automated advice.60 Furthermore, "automated advice" is defined as "the furnishing of advice through an electronic medium that uses algorithms and technology without the direct involvement of a natural person". Lastly, section 4 of the Cybercrimes Act61 also criminalises instances where hackers could use a computer program in the form of AI to acquire, access, intercept or interfere with electronic communications or data.
The above pieces of legislation are the only laws that regulate or have relevance to AI. However, it is noteworthy that none of them were enacted with specific intention to regulate AI. The lack of regulation of artificial intelligence in South Africa has recently resulted in the courts giving scathing comments against practitioners who have used AI. In the case of Parker v Forsyth,62 the court highlighted the misuse of AI in the preparation of court papers and heads of argument. The defendants' attorneys were unable to access any of the cases cited by the plaintiff's counsel, and the plaintiff's attorney was also unable to furnish them. At the hearing, the plaintiff's counsel explained that his attorney had sourced the cases through the medium of ChatGPT.63
The court described ChatGPT as an intelligent chatbot that uses natural language processing to create human-like conversational dialogue. It went on to state that the language model responds to questions and composes various written content, including articles, social media posts, essays and code. The plaintiff's attorneys had used artificial intelligence to conduct legal research without satisfying themselves of the accuracy thereof. It turned out the cases did not exist and that the names and cases were fictitious. As a result, the facts and decisions were fictitious.
The defendants' counsel submitted that it was an attempt to mislead the court and must be met with an appropriate punitive order for costs. In deciding not to grant a costs order de bonis propriis, the court held:
"[the attorneys] placed undue faith in the veracity of the legal research generated by artificial intelligence ... Courts expects lawyers to bring a legally independent and questioning mind to bear on especially novel legal matters ... not merely repeat in parrot fashion, the unverified research of a chatbot."64
The plaintiff was instead ordered to pay 60 per cent of the defendants' legal costs.65
So where to now with regard to AI regulation? Although there is no dedicated national legislation on AI strategy, it is addressed in the framework of the 4IR strategy currently in the making. The Department of Communications and Digital Technologies has been tasked with establishing a 4IR Strategic Implementation Coordination Council, and an AI Institute as well as with reviewing and amending existing policy and legislation.66Donnelly is of the view that South Africa, as a UNESCO member state, must be guided in its national legislative and policy development agenda by the 2021 UNESCO Recommendation on the Ethics of Artificial Intelligence.67This may change in the near future as AI software becomes more autonomous through machine learning. Countries like Kenya and Canada have adopted AI strategies already.68
4 RESPONSE TO AI BY AFRICA, BRICS AND G7 HIROSHIMA SUMMIT
4 1 Africa
There is a dearth of data on all aspects of AI in Africa, and much of the available information is thus anecdotal.69 Meanwhile, there is a need for African policy responses at the national, regional, continental and international levels, aimed at ensuring that the continent's innovators, enterprises, communities, governments and other actors are able to reap AI's benefits and mitigate its threats. Sound policy approaches will be needed to enable African nations to build ecosystems that are inclusive, socially beneficial, and adequately integrated with on-the-ground realities.70AI is slowly making it to the agenda of continental organisations across Africa.
At the AU level, there are attempts to develop a pan-African AI strategy.71The African Union Convention on Cyber Security and Personal Data Protection72 (AU Convention) is an important piece of African international law - a pioneer in data protection and cybercrime and cybersecurity law in Africa - but it has limited regulation on AI. In terms of article 9, its regulation of data processing includes the automated processing of personal information (for example, through the use of Al), and article 14.5 confers the right on all people not to be subject to
"a decision which produces legal effects concerning him/her or significantly affects him/her to a substantial degree and which is based solely on automated processing of data intended to evaluate certain personal aspects of him/her."73
The AU Convention is premised on the important theme of "Information and Communication Technologies in Africa: Challenges and Prospect for Development"74 and the Abuja Declaration.75 As of March 2022, 13 states have ratified the AU Convention.76 In October 2019, in Sharm-El-Sheik, Egypt, AU ministers in charge of communications, ICTs and postal services convened as the AU Specialised Technical Committee on Communication and Information Communication Technologies (STC-CICT). The Committee called on member states to establish a working group on AI based on existing initiatives and in collaboration with African institutions to study the creation of a common African stance on AI, the development of an Africa-wide capacity-building framework, and the establishment of an AI think tank to assess and recommend projects to collaborate on in line with Agenda 2063 and the SDGs.77 In addition, the African Commission on Human and Peoples' Rights (ACHPR) adopted the Declaration of Principles on Freedom of Expression and Access to Information in Africa during its 65th ordinary session in 2019.78 The Declaration was released at a critical time when the world was confronted with global health crisis Covid-19.79 In relation to this health crisis, it is important to note that freedom of expression, access to information and the right to privacy are essential elements of the right to health.80 In addition, the Declaration contributes to the strengthening of the African data protection framework.
During its 31st extraordinary session held from 19 to 25 February 2021, the ACHPR adopted Resolution 473 on the Need to Undertake a Study on Human and Peoples' Rights and Artificial Intelligence (AI), Robotics and Other New and Emerging Technologies in Africa.81 The Resolution emphasises the need for legal reform of African laws to deal with legal problems posed by the advent of AI in the context of 4IR. Resolution 473 deals with the need for comprehensive and multidisciplinary research on the legal, ethical, safety and security opportunities, and for legal reform based on the legal challenges raised by AI technologies, robotics and other new and emerging technologies in Africa.82
Resolution 473 also recognises that AI companies, as well as organisations and businesses that use AI technologies, robotics and other new and emerging technologies, have a significant impact on human rights protection in Africa, and that there is no comprehensive framework governing their operations to ensure that they comply with human rights obligations.83 The Resolution calls on the AU and regional bodies to develop a regional regulatory framework that ensures that these technologies respond to the needs of the people of the continent. It is also committed to undertake a study to further develop guidelines and norms that address these concerns.84
In addition, the African Union (AU) Digital Strategy Information for Africa for the year 2020-2030 has proposed a continent-wide digital governance African Peer Review Mechanisms on the use of AI within member states. Therefore, the AU has prescribed rules on AI based on solidarity and cooperation to ensure that Africa's forthcoming digital infrastructure with AI is cooperative, transformative, inclusive, home-grown, safe and allows member states to have varied levels of "Digital Maturity".85
The Southern African Development Community (SADC)'s Data Protection Model Law also provides some regulation of AI, including provisions for algorithmic transparency, by providing that the Model Law's provisions are applicable to automated processing of personal information, and that data subjects' rights include the right to information86 "about the basic logic involved in any automatic processing of data relating to him/her in case of automated decision making".87
Additionally, AUDA-NEPAD has published a White Paper on Regulation and Responsible Adoption of AI in Africa Towards Achievement of AU Agenda 2063 (White Paper on AI) in 2024 for public comment, where some central objectives where outlined as follows: promoting responsible AI adoption, ensuring ethical, transparent, and accountable use; strengthening African policymakers' and decision-makers' capacity and enabling the utilisation of AI technologies in partnership with the private sector; addressing AI myths, misconceptions, and policy challenges, linking policy research with stakeholders.88
4 2 BRICS
AI technologies are being employed for a wide range of purposes in BRICS countries (Brazil, Russia, India, China and South Africa). These technologies present opportunities to achieve faster and better results in different activities. However, they also present risks to fundamental rights and liberties, especially to the right to non-discrimination, privacy and data protection. These risks and opportunities call for regulatory action, which is being developed or is already deployed by all BRICS countries at the moment.89 Belli is of the view that a four-pronged approach should be applied by BRICS in regulating AI: (1) rule-making processes; (2) areas of convergence; (3) using what already exists; and, lastly (4) focus on effective implementation.90 Global digitisation and the emergence of AI-based technologies pose challenges for all countries of the world. BRICS is no exception.
It is essential for BRICS to implement smart policy and create suitable conditions for the development of digital technologies, including AI. For this reason, one of the most important tasks for BRICS is to develop an adequate approach to the regulation of AI-based technologies.91 The BRICS bloc of countries has set its sights on creating an AI study group. This was revealed by Chinese president Xi Jinping during the recent 15th Summit of Brazil, Russia, India and South Africa (BRICS Summit). South Africa hosted the annual summit of the BRICS bloc of emerging economies from 22 to 24 August 2023.92
4 3 G7 Hiroshima Summit 2023
Influenced by the principles provided for by the OECD, the aim of the Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI Systems is to promote safe, secure, and trustworthy AI globally. It will provide guidelines for organisations developing and using advanced AI systems. The list of guiding principles is discussed and elaborated upon as a living document to build on the existing OECD AI principle, considering recent developments in advanced AI systems. The aim of these guiding principles is to assist in the uptake of the benefits of these new technologies as well as address the risks and challenges they bring.93
The Hiroshima Process suggests that different jurisdictions may take their own approach in implementing these guiding principles. While governments develop more detailed governance and regulatory approaches, it is important for organisations to follow these actions in consultation with other relevant stakeholders. While the organisation is still working on the guiding principles, it is committed to developing proposals in consultation with the OECD and the Global Partnership on Airtificial Intelligence ('GPAI') as well as other stakeholders in order to introduce monitoring tools and mechanisms that will assist organisations to stay accountable when implementing these actions.94
It is important for organisations to respect the rule of law, human rights, due process, diversity, fairness and non-discrimination, democracy and human centricity while harnessing the opportunities for innovation in the design and development and deployment of advanced AI systems; and states must abide by their obligations under international human rights law to further promote respect for and protection of human rights.95
These guidelines encourage organisations to identify, evaluate and mitigate risks across the AI life cycle, prior to and during the deployment and placement of advanced AI systems on the market; identify and mitigate vulnerabilities, incidents and patterns of misuse; increase accountability and ensure transparency by publicly reporting advanced AI systems' capabilities, limitations and domains of appropriate and inappropriate use; work towards responsible information sharing and incident reporting among organisations developing advanced AI systems; and develop, implement and disclose AI governance and risk management policies.96
The guidelines further encourage organisations to invest in robust security controls, including physical security, cybersecurity and insider threat safeguards across the AI life cycle; prioritise research to alleviate societal, safety and security risks, and prioritise investment in effective mitigation measures; develop and deploy reliable content authentication, and source mechanisms such as watermarking to enable users to identify AI-generated content; prioritise the development of advanced AI systems to address the world's biggest challenges, such as, and not limited to, the climate crisis, global health and education; implement appropriate data input measures and protections for personal data and intellectual property; and advance the development and adoption of international technical standards.97
5 THE PROPOSED EU AI ACT
The European Union (EU) is considering a new legal framework that aims to significantly bolster regulations on the development and use of AI. The proposed legislation, the Artificial Intelligence Act, focuses primarily on strengthening rules around data quality, transparency, human oversight and accountability. It also aims to address ethical questions and implementation challenges in various sectors, ranging from health care and education to finance and energy.98 Roberts et al note that the EU released its first document addressing the issue of AI governance in May 2016 - a draft report, published by the European Parliament's Committee on Legal Affairs (JURI) entitled "Civil Law Rules on Robotics". This report called for a coordinated European approach that would employ a mix of hard and soft laws, including a new guiding ethical framework, to guard against possible risks.99 At its meeting in May 2018, the Committee on Digital Economy Policy (CDEP),while developing a Council for Recommendations, agreed to assemble a group of experts on AI to scope principles to cultivate trust in the adoption of AI in society.100
Following the announcement made by President Von der Leyen in her Political Guidelines for the 2019-2024 Commission,101 the Commission, on 19 February 2020, published a White Paper on AI,102 which sets out policy options on how to achieve objectives for the uptake of AI, as well as the risks associated with the use of certain technologies. The proposal aims at implementation of a legal framework for trustworthy AI.103 Brand also points out that many high-level meeting and research groups have debated the ethical and legal considerations relating to responsible AI over the years.104Brand goes on to note that the European Commission's High-Level Expert Group on AI (AIHLEG) published the framework document "Ethics Guidelines for Trustworthy AI" in 2019.105 They argue that trustworthy AI has essentially three components: first, AI must be "lawful"; secondly, AI must be "ethical"; and lastly, AI must be "robust, both from a technical and a social perspective".106
Brand then goes on to note that the Council of Europe's Ad Hoc Committee on Artificial Intelligence (CAHAI)107 proposed nine principles that should underpin the regulation of AI - namely, "human dignity", "human freedom and autonomy", "prevention of harm", "non-discrimination, gender equality, fairness and diversity", "transparency and explainability of AI systems", "data protection and the right to privacy", "accountability and responsibility", "democracy" and the "rule of law". The Commission proposed specific objectives for the regulatory framework on AI to ensure that AI systems placed and used in the Union market are safe, and that the existing law on fundamental rights and Union values is respected, and to ensure legal certainty to facilitate investment and innovation in AI. In addition, the objectives included the enhancement of governance and effective enforcement of existing law on fundamental rights and safety requirements applicable to AI systems, as well as facilitating the development of a single market for lawful, safe and trustworthy AI applications and the prevention of market fragmentation.108
The European Commission's 2021 draft of the Artificial Intelligence Act109was the first attempt to codify a unified AI law for the EU. It seems the definition of an "artificial intelligence system" was agreed to be "a machine-based system designed to operate with varying levels of autonomy that can, for explicit or implicit objectives, generate output such as predictions, recommendations, or decisions influencing physical or virtual environments". As the AI Act is intended to prevent harm from AI, a definition of AI is fundamental.110
The draft AI Act proposed, a risk-based approach to regulating AI and outlined four categories of risk:111 unacceptable risk, high risk, limited risk and minimal/no risk. Systems deemed to pose an unacceptable risk would be prohibited; these included cases of social scoring and subliminally manipulative systems.112 For high-risk AI, including systems that are safety-critical components and those that pose specific risks to fundamental rights, specific obligations are set out for providers, importers, distributers, users, and authorised representatives of AI. Specific transparency requirements are made for limited risk systems, which include those that interact with humans, are used for biometric categorisation, or generate manipulative content (for example, deepfakes). Finally, for systems that are not high risk, voluntary codes of conduct were encouraged. Violating these regulations could lead to fines of up to 6 per cent of global turnover or 30 million euros.113
In closing, on the 13th March 2024, Members of European Parliament endorsed the Artificial Intelligence Act114 ("AI Act"), which according to Lewis, is the world's first comprehensive AI law and likely to have significant influence on the quick development of AI Regulation in other jurisdictions including in the United States. However, Prof. Borges in his webinar on The European AI Act is of a different view that the AI Act is not comprehensive because it does not cover any liability and is mainly a product safety law for AI with supplements.115
6 CONCLUSION AND RECOMMENDATIONS
It is clear that South Africa must enact AI legislation as a matter of urgency to give effect to South Africa's policy on 4IR in the PC4IR Report as well as to join the regional, African and international trend to legislate on AI. Since many of the universally accepted and legal principles and norms (grounded in the UNESCO Recommendation on AI) are reflected in our Constitution, it should not be a mammoth task for our legislature to begin the process of drafting a bill on AI and commence engagement with the public and other stakeholders. It is not just a South African priority but an African priority, to keep South Africa in line with international best practice, legal rules and norms on AI.
1 Floridi, Cowls, Beltrametti, Chatila, Chazerand, Dignum, Luetge, Madelin, Pagallo, Rossi, Schafer, Valcke and Vayena "AI4People - An Ethical Framework for a Good AI Society: Opportunities, Risks, Principles, and Recommendations" 2018 28 Minds & Machines (M&M) https://doi.org/10.1007/s11023-018-9482-5 (accessed 2023-03-30) 689.
2 Gravett "The Dark Side of Artificial Intelligence: Challenges for the Legal System" 2020 35(1) Southern African Public Law (SAPL) https://doi.org/10.25159/2522-6800/6979 (accessed 2023-04-04) 3.
3 McCarthy, Minsky, Rochester and Shamin "A Proposal for the Dartmouth Summer Research Project on Artificial Intelligence" (1955) http://www-formal.stanford.edu/jmc/history/dartmouth/dartmouth.htm (accessed 2023-04-04) 3. [ Links ]
4 Ormond "Artificial Intelligence in South Africa Comes With Special Dilemmas - Plus the Usual Risks" 2023 The Conversation https://theconversation.com/artificial-intelligence-in-south-africa-comes-with-special-dilemmas-plus-the-usual-risks-194277 (accessed 2023-0330) 1. [ Links ]
5 Gennatas and Chen "Artificial Intelligence in Medicine: Past, Present and Future" in Xing, Giger and Min (eds) Artificiaí Inteííigence in Medicine: Technicaí Basis and Cíinicaí Appíication (2020) 3.
6 Shinghal Formal Concepts in Artificial Intelligence: Fundamentals (1992) 1.
7 Roberts, Cowls, Hine, Mazzi, Tsamando, Taddeo and Floridi "Achieving a 'Good AI Society': Comparing the Aims and Progress of the EU and the US" 2021 27 Science Engineering Ethics (SEE) https://doi.org/10.1007/s11948-021 -00340-7 (accessed 2023-0216) 68.
8 Ibid.
9 Ormond https://theconversation.com/artificial-intelligence-in-south-africa-comes-with-special-dilemmas-plus-the-usual-risks-194277 1.
10 Ibid.
11 Belli, Venturini, Mariscal, Frati and Benussi "Regulación en IA (Regulation in AI)" (2022) https://cyberbrics.info/regulacion-e-ia (accessed 2023-03-30) 1.
12 Ibid.
13 Etzioni "How to Regulate AI" (2017) https://www.nytimes.com/2017/09/01/opinion/artificial-intelligence-regulations-rules.html (accessed 2023-06-12) 2.
14 Gilburt "Ethics Guidelines for Trustworthy AI Summarised" (2019) https://towardsdatascience.com/ethics-guidelines-for-trustworthy-ai-summarised-1c86174e788b (accessed 2023-03-30) 2.
15 Brand "Algorithmic Decision-Making and the Law" 2022 12(1) JeDEM https://doi.org/10.29379/jedem.v12i1.576 (accessed 2023-03-30) 115.
16 Marengo Data Protection in Charts (2020) https://payhip.com/fmarengo (accessed 2023-0719) 11.
17 Jobin, Lenca and Vayena "The Global Landscape of AI Ethics Guidelines" 2019 1 Nat Mach Intell (NMI) https://doi.org/10.1038/s42256-019-0088-2 (accessed 2023-02-25) 394.
18 OECD "Artificial Intelligence & Responsible Business Conduct' (2019) https://mneguidelines.oecd.org/RBC-and-artificial-intelligence.pdf (accessed 2024-03-28) 1.
19 OECD Recommendation of the Council on Artificial Intelligence (2019) https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449 (accessed 2024-0328).
20 OECD Recommendation of the Council (2019) 4.
21 Naidoo, Naidoo, Bottomley, Donnelly and Thaldar "Artificial Intelligence in the Healthcare: Proposal for Policy Development in South Africa" 2022 12(1) SAJBL http://dx.doi.org/10.7196/SAJBL.2022.v15i1.797 (accessed 2023-02-27) 3-6.
22 OECD Recommendation of the Council (2019).
23 Ibid.
24 Expert Group on Artificial Intelligence at the OECD (AIGO) "Scoping the OECD AI Principles: Deliberations of the AIGO" OECD Digital Economy Papers (2019) https://read.oecd-ilibrary.org/science-and-technology/scoping-the-oecd-ai-principles_d62f618a-en (accessed 2024-03-28) 22.
25 AIGO https://read.oecd-ilibrary.org/science-and-technology/scoping-the-oecd-ai-principles_d62f618a-en 21.
26 AIGO https://read.oecd-ilibrary.org/science-and-technology/scoping-the-oecd-ai-principles_d62f618a-en 20.
27 OECD Recommendation of the Council (2019) 8-9.
28 OECD Recommendation of the Council (2019) 8.
29 OECD (2021) https://read.oecd-ilibrary.org/science-and-technology/scoping-the-oecd-ai-principles_d62f618a-en (accessed 2024-03-28) 5.
30 UNESCO Recommendation on the Ethics of Artificial Intelligence (2021) https://en.unesco.org/about-us/legal-affairs/recommendation-ethics-artificial-intelligence (accessed 2023-06-09).
31 UNESCO https://en.unesco.org/about-us/legal-affairs/recommendation-ethics-artificial-intelligence par 2.
32 UNESCO https://en.unesco.org/about-us/legal-affairs/recommendation-ethics-artificial-intelligence Preamble.
33 UNESCO https://en.unesco.org/about-us/legal-affairs/recommendation-ethics-artificial-intelligence par 2.
34 UNESCO https://en.unesco.org/about-us/legal-affairs/recommendation-ethics-artificial-intelligence par 9.
35 UNESCO Recommendation on the Ethics of Artificial Intelligence https://en.unesco.org/about-us/legal-affairs/recommendation-ethics-artificial-intelligence.
36 UNESCO https://en.unesco.org/about-us/legal-affairs/recommendation-ethics-artificial-intelligence par 12.
37 UNESCO https://en.unesco.org/about-us/legal-affairs/recommendation-ethics-artificial-intelligence par 49.
38 UN "The Right to Privacy in the Digital Age" (13 September 2021) A/HRC/48/31 https://www.ohchr.org/en/hr-bodies/hrc/regular-sessions/session48/res-dec-stat (accessed 2023-04-15).
39 Adams South African Company Law in the Fourth Industrial Revolution: Does Artificial Intelligence Create a Need for Legal Reform? (LLM thesis, Wits University) 2021 13. Also see Brand "Responsible Artificial Intelligence in Government: Development of a Legal Framework for South Africa" 2022 14(1) JeDEM 142.
40 Adams South African Company Law in the Fourth Industrial Revolution 13. [ Links ]
41 Turing "Mind" 1950 59(236) Computing Machinery and Intelligence (CMI) 4337.
42 Shubhendu and Vijay ("Applicability of Artificial Intelligence in Different Fields of Life" 2013 1(1) International Journal of Scientific Engineering and Research (IJSER) 1 7) state: "Artificial intelligence is the study of ideas to bring into being machines that respond to stimulation consistent with traditional responses from humans, given the human capacity for contemplation, judgment and intention. Each such machine should engage in critical appraisal and selection of differing opinions within itself. Produced by human skill and labor, these machines should conduct themselves in agreement with life, spirit and sensitivity, though in reality, they are imitations."
43 Gravett "Is the Dawn of the Robot Lawyer Upon Us? The Fourth Industrial Revolution and the Future of Lawyers" 2020 23(1) pEr/pElJ http://www.scielo.org.za/scielo.php?script=sci_arttext&pid=S1727-37812020000100024&lng=en&nrm=iso (accessed 2023-02-27) 7.
44 Ibid.
45 Brand 2022 JeDEM 142.
46 Brand 2022 JeDEM 143.
47 Ibid.
48 Department of Telecommunications and Postal Services "Terms of Reference for the Presidential Commission on the Fourth Industrial Revolution" GN 209 in GG 42388 of 201904-09 https://www.gov.za/sites/default/files/gcis_document/201904/42388gen209.pdf (accessed 2023-02-27).
49 Commission on the Fourth Industrial Revolution "Summary Report & Recommendations" GN 591 in GG 43834 of 2020-10-23 https://www.gov.za/sites/default/files/gcis_document/202010/43834gen591.pdf (accessed 2024-03-28).
50 Commission on the Fourth Industrial Revolution "Summary Report & Recommendations" GN 591 in GG 43834 of 2020-10-23 https://www.gov.za/sites/default/files/gcis_document/202010/43834gen591.pdf; PC4IR Report.
51 Ormond "Global to Local: South African Perspectives on AI Ethics Risks" (1 September 2022) https://ssrn.com/abstract=4240356 (accessed 2023-04-15) 10.
52 25 of 2022.
53 Papadopoulos and Snail (eds) Cyberlaw @ SA: The Law of the Internet in South Africa 4ed (2022) 59. See also s 20(a) of the ECT Act.
54 Papadopoulos and Snail (eds) Cyberlaw @ SA: The Law of the Internet in South Africa 60.
55 4 of 2013.
56 De Stadler, Hattingh, Esselaar and Boast Over-Thinking the Protection of Personal Information Act: The Last POPIA Book You Will Ever Need (2021 ) 578.
57 Burns and Burger-Smidt Protection of Personal Information: Law and Practice 2ed (2023) 641.
58 Adams South African Company Law in the Fourth Industrial Revolution 71.
59 De Stadler et al Over-thinking the Protection of Personal Information Act 455.
60 S 38 of Board Notice 194 of 2017, Determination of Fit and Proper Requirement of Financial Services Providers (2017), GG 41321 of 2017-12-15.
61 19 of 2020.
62 [2023] ZAGPRD 1 par 85-86.
63 Parker v Forsyth supra par 86.
64 Parker v Forsyth supra par 89-90.
65 Parker v Forsyth supra (case 1585/20) par 93.4.
66 Department of Communications and Digital Technologies "PC4IR Strategic Implementation Plan (PC4IR SIP): National Departments Consultation Presentation" (March 2021) https://www.dpme.gov.za/keyfocusareas/Provincial%20Performance%20Publication/Documents/PC4IR%20SIP%20PresentationNational%20Departments%20Consultation%202021.pdf (accessed 2023-03-14) 4-5.
67 Donnelly "First Do No Harm: Legal Principles Regulating the Future of Artificial Intelligence in Health Care in South Africa" 2022 25 PER/PELJ http://dx.doi.org/10.17159/1727-3781/2022/v25i0a11118 3/21.
68 Snyders "Unpacking the Legal Side of Artificial Intelligence" (2021) https://www.golegal.co.za/legal-artificial-intelligence/ (accessed 2023-03-14) 1.
69 Oxford Insights & IDRC "Government Artificial Intelligence Readiness Index" (2019) https://www.oxfordinsights.com/ai-readiness20192019 (accessed 2023-02-16) 5.
70 Gwagwa, Kraemer-Mbula, Rizk, Rutenberg, and De Beer "Artificial Intelligence (AI) Deployments in Africa: Benefits, Challenges and Policy Dimensions" 2020 26 The African Journal of Information and Communication (AJIC) http://dx.doi.org/10.23962/10539/30361 (accessed 2023-02-19) 3-4.
71 Teleanun and Kurbalija "Artificial Intelligence in Africa: Continental Policies and Initiatives" (2022) https://www.diplomacy.edu/resource/report-stronger-digital-voices-from-africa/ai-africa-continental-policies/ (accessed 2023-06-02) 1.
72 African Union Convention on Cyber Security and Personal Data Protection (also known as the "Malabo Convention") (2020) https://au.int/en/treaties/african-union-convention-cyber-security-and-personal-data-protection (accessed 2023-06-02) 3.
73 ALT Advisory "AI Governance in Africa" (2022) www.ai.altadvisory.africa (accessed 202306-03) 7.
74 Orji Cyber Security Law and Regulation (2012) 375; [Assembly/AU/11(XIV)], Addis Ababa, Ethiopia, 31 January 2010-2 February 2010.
75 Yankey The AU Draft Convention on Cyber Security and e-Transactions: Cooperation Against Cyber Crime Presented at Cyber Crime Octopus, Strasbourg, France (6-8 June 2012); CITMC-3 ([AU/CITMC/MIN/Decl.(III)], Abuja (Nigeria), 3-7 August 2010.
76 ALT Advisory www.ai.altadvisory.africa 7.
77 Gwagwa et al 2020 AJIC 5.
78 ACHPR Declaration of Principles on Freedom of Expression and Access to Information in Africa (2019) https://www.achpr.org/public/Document/file/English/Declaration%20of%20Principles%20on%20Freedom%20of%20Expression_ENG_2019.pdf (accessed 2023-0219) 9.
79 African Commission Publishes Revised Declaration of Principles of Freedom of Expression and Access to Information in Africa amid Covid-19 Crisis (2020) https://www.chr.up.ac.za/expression-information-and-digital-rights-news/2056-africancommission-publishes-revised-declaration-of-principles-of-freedom-of-expression-and-access-to-information-in-africa-amid-covid-19crisis#:~:text=The%20Declaration%20is%20being%20released,of%20the%20right%20to%20health (accessed 2024-03-28).
80 Ibid.
81 ACHPR Resolution on the Need to Undertake a Study on Human and Peoples' Rights and Artificial Intelligence (AI), Robotics and Other New and Emerging Technologies in Africa ACHPR/Res. 473 (EXT.OS/ XXXI) (2021) https://www.achpr.org/sessions/resolutions?id=504 (accessed 2023-03-15) 2.
82 Ibid.
83 Ibid.
84 Ibid.
85 Ncube, Oriakhogba, Rutenberg and Schonwetter "Artificial Intelligence and the Law in Africa" (2023) 69. [ Links ]
86 Centre for Human Rights: University of Pretoria "The Digital Rights Landscape in South Africa" (2022) https://www.chr.up.ac.za/images/researchunits/dgdr/documents/reports/Digital_Rights_Landscape_in_SADC_Report.pdf (accessed 2023-03-30) 30.
87 International Telecommunication Union (ITU) "Data Protection: SADC Model Law" (2013) chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.itu.int/en/ITU-D/Projects/ITU-EC-ACP/HIPSSA/Documents/FINAL%20DOCUMENTS/FINAL%20DOCS%20ENGLISH/sadc_model_law_data_protection.pdf (accessed 2024-03-28).
88 AUDA-NEPAD "Taking A Continental Leap Towards A Technologically Empowered Africa at the AUDA-NEPAD AI Dialogue" (2024) https://www.nepad.org/blog/taking-continental-leap-towards-technologically-empowered-africa-auda-nepad-ai-dialogue.
89 Belli, Venturini, Frati, Mariscal and Benussi Regulations in AI (2022), Online Webinar organised by Latin American Initiative on Open Data (ILDA) https://cyberbrics.info/regulacion-e-ia.
90 Belli Good and Bad Practices in AI Regulation: Examples from LatAm and BRICS Countries Paper presented at international conference on Current and Future Challenges of Coordinated Polices on AI Regulation (2021) 14-15.
91 Cyman, Gromova and Juchnevicius "Regulation of Artificial Intelligence in BRICS and the European Union 2021 8(1) BRICS Law Journal https://doi.org/10.21684/2412-2343-2021-8-1-86-115 (accessed 2023-06-06) 1.
92 Moyo "BRICS Bloc Commits to Secure, Equitable Artificial Intelligence" (25 August 2023) https://www.itweb.co.za/content/mQwkoq6YpLzM3r9A#:~:text=The%20BRICS%20bloc%20of,South%20Africa%20(BRICS%20Summit (accessed 2023-08-30) 2.
93 Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI Systems "G7 Hiroshima Summit" (2023) https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-guiding-principles-advanced-ai-system (accessed 2023-11 -29) 1.
94 Ibid.
95 Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI Systems https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-guiding-principles-advanced-ai-system.
96 Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI Systems https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-guiding-principles-advanced-ai-system.
97 Hiroshima Process International Guiding Principles for Organisations Developing Advanced AI Systems https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-guiding-principles-advanced-ai-system.
98 World Economic Forum "The European Union's Artificial Intelligence Act, Explained" (2023) https://www.weforum.org/agenda/2023/03/the-european-union-s-ai-act-explained/ (accessed 2023-07-10) 1
99 Roberts et al 2021 SEE 68.
100 Ibid.
101 Von der Leyen "Political Guidelines for the Next European Commission 2019-2024" (2019) https://ec.europa.eu/commission/sites/beta-political/files/political-guidelines-next-commission_en.pdf (accessed 2023-06-18) 9.
102 European Commission White Paper on Artificial Intelligence: A European Approach to Excellence and Trust COM(2020) 65 final (19 February 2020).
103 European Commission Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts Proposal for a Regulation of the European Parliament and of the Council COM(2021) 206 final 2021/0106 (COD) (21 April 2021) https://eur-lex.europa.eu/resource.html?uri=cellar:e0649735-a372-11eb-9585-01aa75ed71a1.0001.02/DOC1&format=PDF (accessed 2023-03-13) 2.
104 Brand 2022 JeDEM 134.
105 OECD Digital Economy Papers "Scoping the OECD AI Principles, Deliberations of the Expert Group on Artificial Intelligence at the OECD (AIGO)" (November 2019 291) 7.
106 Ibid.
107 Brand 2022 JeDEM 134.
108 Ibid.
109 European Commission https://eur-lex.europa.eu/resource.html?uri=cellar:e0649735-a372-11eb-9585-01aa75ed71a1.0001.02/DOC_1&format=PDF 1-4.
110 Hersey "EU AI Act Definition of AI Aligns with OECD Definition, Biometric Risk Updated" 8 March 2023 https://www.biometricupdate.com/202303/eu-ai-act-definition-of-ai-aligns-with-oecd-definition-biometric-risk-updated (accessed 2023-07-10) 1.
111 Roberts et al 2021 SEE 68.
112 Ibid.
113 Ibid.
114 European Union Artificial Intelligence Act.
115 Borges "The European AI Act 'A milestone in AI Regulation?'" (2024) University of Johannesburg, Online Webinar.