Vodacom has urged African governments not to transplant the EU’s AI Act wholesale, warning that European-scale compliance burdens could “stifle innovation, price out emerging African developers and delay equitable access to locally relevant AI”.
The argument is central to Governing Artificial Intelligence in Africa: A Principles-based Framework for Responsible Regulation, a policy paper Vodacom developed with law firm Bowmans and released on Wednesday. Its publication comes as South Africa rewrites its national AI policy. Communications minister Solly Malatsi withdrew the draft in April after fictitious references were found. His department now aims to publish a revised version in the first quarter of next year, Malatsi said in a presentation in Randburg last week.
“Africa must have a meaningful voice in shaping the rules that will govern its AI future,” Ayman Essam, group chief officer: external affairs at Vodacom, said at the launch.
What the paper proposes
The paper identifies four African realities that should shape regulation: infrastructure constraints, fragmented data governance, uneven digital literacy and deep inequality, with about 86% of Africa’s workforce in the informal sector.
Its framework rests on six principles (transparency, accountability, fairness, safety, privacy and proportionality) that it says appear in virtually every national framework it reviewed. The paper adapts them to African conditions:
- Plain-language disclosures in local languages;
- Non-digital routes to challenge AI decisions where connectivity or literacy is limited; and
- Fairness measures that account for people outside formal data systems.
Risk should also be judged locally. An AI credit-scoring system in an economy where most of the workforce is informal, it argues, should be classified differently from the same system in Europe “because the potential for exclusionary harm is materially higher”.
Why not Europe
The paper’s preferred model is a horizontal baseline “drawing on elements of the EU AI Act”, and it endorses the act’s risk-based logic. But it says the act presupposes conformity assessment bodies, market surveillance authorities and specialist regulators that many African countries lack.
It also cites a European Commission estimate of €6 000 to €7 000 in compliance costs per AI application. According to the commission, that figure applies to an average high-risk system; others would “only have minimal obligations of information”.
The UK model depends on mature sector regulators, the paper says. Singapore’s guidance-led approach is “particularly relevant” to Africa but relies on private-sector sophistication that is inconsistent across the continent.
Lessons for Pretoria
The paper does not mention South Africa’s withdrawn draft, which proposed seven new institutions, including a National AI Commission, an AI Ethics Board and a National AI Safety Institute. A standalone AI agency, Vodacom says, “requires substantial resources that most African jurisdictions cannot currently commit to”.
It recommends a hybrid instead: a lead coordination body, ideally housed in an existing ministry or regulator; sector regulators enforcing AI rules in their own domains; and a multi-stakeholder advisory council. In many countries, strengthening existing laws on data protection, competition and telecoms “may provide more immediate governance benefits than developing standalone AI legislation”, it adds.
On sectors, the department appears to be heading the same way. In July, acting deputy director-general Jeanette Morwane told TechCentral the redraft would leave individual sectors to write their own AI strategies off a set of national guidelines. Khusela Diko, chair of parliament’s communications portfolio committee, said at the time: “We don’t necessarily need to create a plethora of new institutions.” But she added: “It needs to go beyond principles; we understand the principles.”
The paper’s three-phase roadmap starts with a national AI strategy, a lead body and basic transparency rules for high-risk systems, such as those deciding access to credit, healthcare or jobs. Mandatory impact assessments and incident reporting follow once triggers are met, including a data protection authority with enforcement capacity and a budgeted AI strategy. Independent audits and national and regional registries of high-risk systems come last.
Vodacom has an interest in the outcome. As both a deployer of AI and an advocate of reform, it acknowledges, it “occupies a dual role that warrants transparency”. It urges governments to favour principles-based guidance and “regulatory experimentation over highly prescriptive technical requirements”, a lighter touch than the EU’s.
Under its hybrid model, AI in telecoms would fall to the telecoms regulators Vodacom already deals with, not to a new agency. And Bowmans’ Heather Irvine sits on the independent expert panel Malatsi appointed in May to help rebuild South Africa’s policy, a role the firm has publicised.
Across borders
The paper sees regional economic communities such as the Southern African Development Community as a potentially more realistic route than binding continental treaties. It notes that the African Union’s Malabo Convention on cybersecurity and data protection has been ratified by only 20 of its 55 member states.
“Africa has an opportunity to develop regulatory approaches that draw on global best practice while remaining firmly rooted in local legal, economic and social realities,” said Bowmans partner Kate Paterson. – © 2026 NewsCentral Media
