South Africa’s Draft National Artificial Intelligence (AI) Policy (“the Draft National AI Policy”) was published for public comment earlier today. It is much more comprehensive than the AI Policy Framework that preceded it. Financial services regulators will need to make interim plans for AI risks while the Draft AI Policy goes through the legislative process.
How long will it take?
The Draft National AI Policy proposes that the AI-related interventions it proposes, be implemented under the mandates of various government departments and entities. This likely means that each sector will have to develop its own approach to regulating AI. The policy envisages a phased approach over three years, that will focus on publishing National AI Policy Guidelines and implementing key regulatory requirements for high-risk use cases in 2026/2027.
Three years is a long time considering the pace at which more powerful and impressive AI models are being developed. It may be, that while South Africa’s Draft AI Policy follows its legislative process, interim interventions in high-risk sectors will be necessary.
What are the risks in the meantime?
For example, we have seen, in the past two days, that financial services regulators in other jurisdictions regard the rapid pace at which AI tools are being developed as a sign that they consider “the possibility of a new breed of cyber-attacks as one of the biggest risks” facing the financial services industry. As Bloomberg reports today, the US’ Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell yesterday “summoned Wall Street leaders to an urgent meeting on concerns that the latest artificial intelligence model from Anthropic PBC will usher in an era of greater cyber risk.”
In referring to Anthropic, the regulators were focusing on Anthropic’s Mythos, a highly powerful model released earlier this week. Anthropic regards the model as so advanced, that it has refused to release it to the public. It has, instead, released it to a small number of major technology companies. This is to give them a head start in testing it and assisting them to identify vulnerabilities, before hackers and bad actors get access to it and use it for criminal purposes.
All the banks that were summoned to the urgent meeting are classified as systemically important by those top regulators. The implication being, according to Bloomberg, that “their stability is a priority for the global financial system.”
What’s the interim solution?
Whilst South Africa’s Draft AI Policy may only just have been published, it may be prudent for South Africa’s financial services regulators, working with financial services institutions, to take a leaf out of the books of regulators in other jurisdictions and how they have addressed AI governance and risks. For example, they could, in the meantime, develop sector specific AI governance and risk management guidelines, standards, directives, or handbooks like the MindForge AI Risk Management Handbook developed by the Monetary Authority of Singapore.
The Draft AI Policy is open for public comment for 60 days from today. It is a comprehensive and lengthy document and the final product is likely to influence every aspect of our lives for years to come. In the meantime, critical sectors need to be proactive and must work together to produce guidelines and handbooks to reduce the enormous AI – enabled risks that are definitely on the horizon.
