Guarding the gate: Human responsibility in algorithmic liability

• South African law holds human actors, not AI systems, accountable for errors arising from automated decisions.
• Existing legal principles like contract, delict, POPIA, and King V apply directly to AI outcomes, placing responsibility on humans.
• POPIA Section 71 specifically regulates decisions based solely on automated processing with legal or substantial effects.
• The `Mavundla v MEC` case demonstrated human professional consequences for AI-generated legal errors, including personal cost orders.
• Robust human oversight, clear accountability frameworks, and diligent risk management are essential, as contractual indemnities do not negate negligence.

South African law unequivocally assigns liability for AI-driven errors to human actors, not the technology.

When artificial intelligence systems make significant financial errors, potentially costing hundreds of millions of Rands, the technology itself cannot be held legally responsible. An AI system, despite its sophisticated outputs, is incapable of appearing in court, owing a fiduciary duty, facing regulatory scrutiny, losing a professional license, or providing an explanation under cross-examination. The notion that accountability can be automated is a dangerous misconception, often fueled by persuasive vendor presentations highlighting speed and cost savings without fully addressing the potential for catastrophic outcomes.

Ultimately, legal and business accountability cannot be transferred to a mere probability engine. Every consequential automated decision is the result of a series of human choices, encompassing the initial acquisition of the system, its training, rigorous testing, ongoing monitoring, and the critical decision of when to intervene or cease its operation. When errors occur, such as mispricing risks, rejecting incorrect customers, generating false legal authorities, or approving fraudulent transactions, the ensuing blame game often sees engineers faulting data, businesses blaming vendors, and vendors pointing to obscure contractual clauses that attempt to absolve liability. However, the silent algorithm provides no defense, underscoring the fundamental truth that human responsibility algorithmic liability South Africa remains firmly with human actors.

South African law does not require the personification of a machine to assign blame for its erroneous outputs. Instead, existing legal principles are robust enough to address the legal consequences of AI. These include established frameworks such as contract law, delictual liability AI South Africa, company law, consumer protection, data protection, and professional negligence. These principles consistently pose "stubbornly analogue questions" regarding who owed a duty, who authorized specific conduct, who could have foreseen potential harm, and who failed to act reasonably in the circumstances.

The Protection of Personal Information Act (POPIA) is particularly relevant, placing clear responsibility on the "responsible party" for data processing activities. POPIA took effect on July 1, 2020, with full enforcement from July 1, 2021. Section 71 of POPIA specifically regulates decisions based solely on automated processing, especially when these decisions have legal or similarly substantial effects on individuals. Even where exceptions to this rule apply, robust safeguards are mandated. Furthermore, the King V Report on Corporate Governance reinforces this by integrating technology and information governance directly into the broader corporate governance framework. This means that while directors may delegate the implementation of AI systems, they cannot delegate their overarching obligation to oversee risk, performance, and ethical conduct, thereby emphasizing King V AI governance principles. Claiming "the model decided" is not a valid governance strategy; it is an admission that the organization operated without a responsible adult overseeing its decision-making processes.

The principle of human responsibility in algorithmic liability South Africa has already been starkly illustrated in local courts. A notable example is the case of `Mavundla v MEC: Department of Co-Operative Government and Traditional Affairs KwaZulu-Natal`. In this matter, the Pietermaritzburg High Court was confronted with a legal filing where a significant portion – specifically seven out of nine cited cases – simply did not exist. This highly unusual occurrence strongly suggested the use of an AI tool that generated fictional legal authorities.

The court responded decisively, criticizing the conduct of the legal professionals involved. It issued a personal cost order against them for the additional appearances necessitated by the error and referred the matter to the Legal Practice Council for further investigation. The Legal Practice Council is a national, statutory body established in terms of the Legal Practice Act, No 28 of 2014, and regulates the professional conduct of legal practitioners. This case serves as a powerful demonstration of South Africa AI professional negligence, highlighting that while the errors may have been "machine-shaped," the professional consequences were entirely human. The `Mavundla v MEC AI legal consequences` underscore that supervision of AI-generated work cannot be a retrospective exercise, particularly not after a judge has been forced to assume the role of a quality assurance department.

The practical chain of liability for AI-driven errors can extend broadly, encompassing the system's developer, provider, deployer, professional advisers, executive committee members, and the board of directors. While contractual indemnities can serve to redistribute financial exposure among these parties, they do not transform negligence into innocence, nor do they impress regulators, courts, or customers who have suffered harm. These indemnities offer no shield against the fundamental principle of AI accountability South Africa.

The concept of a "human in the loop," often touted as a safeguard, frequently falls short in practice. It can amount to little more than an exhausted junior employee, lacking sufficient authority, attempting to manage hundreds of alerts generated by an AI system. Therefore, lawyers and compliance officers must recognize that South African law unequivocally assigns liability for AI-driven errors to human actors, not the technology. This mandates robust human oversight, clear accountability frameworks, and diligent risk management in AI deployment, as existing legal principles will consistently hold individuals and entities responsible for the outcomes of automated systems.

Lawyers and compliance officers must recognize that South African law unequivocally assigns liability for AI-driven errors to human actors, not the technology. This mandates robust human oversight, clear accountability frameworks, and diligent risk management in AI deployment, as existing legal principles (POPIA, King IV, delict, contract) will hold individuals and entities responsible for AI outcomes.

Source: Analysis based on original reporting by AJS.