The conventional wisdom says AI regulation is tightening everywhere and a dedicated rulebook is coming for every serious economy. Australia spent two years building exactly that rulebook, then quietly decided not to use it. That decision is the signal South Africa is not pricing in.
“A mature, rule-loving economy looked at a ready-made AI rulebook and decided the bigger risk was regulating itself out of the productivity race.”
What Australia Actually Did
In December 2025, Australia's National AI Plan confirmed the government would not proceed with the mandatory guardrails it had proposed in 2024 for high-risk AI systems. More than 300 submissions during consultation warned that AI-specific mandatory rules would slow adoption without a proportionate reduction in risk. The government chose a lighter structure instead: rely on existing, technology-neutral law, add voluntary guidance, and stand up a new AI Safety Institute to monitor the landscape.
That guidance arrived in October 2025, replacing the earlier Voluntary AI Safety Standard and consolidating its original ten guardrails into six responsible AI practices: governance and accountability, impact assessment, risk management, transparency, testing and monitoring, and human oversight. None of it is mandatory. All of it is a signal for where enforcement will land if voluntary compliance does not hold.
The Gap Nobody Is Pricing In
Voluntary does not mean unenforced. It means the enforcement sits somewhere else. The AI Safety Institute was funded with $29.9 million to monitor AI development, test systems, and advise government on where the regulatory gaps are, but it has no enforcement authority of its own. That power stays with the regulators that already existed: the Privacy Commissioner, the ACCC, and sector-specific bodies, applying the powers they already had before AI became the subject.
That is the model South Africa should actually be studying, not whether Australia wrote an AI Act, but how it is enforcing AI risk without one. Existing regulators, applying existing law, to AI-specific facts.
Why Australia Made This Bet
The instinct across most South African legal and business commentary is that the work ahead is compliance: wait for the rules, then help clients follow them. Australia bet the opposite, that the advantage in this decade goes to whoever governs themselves well by choice, not whoever waits for a statute to say how. Australia did not go light because it stopped caring about AI risk. It went light because it decided speed was the bigger competitive question.
What This Means for South Africa
South Africa has no dedicated AI legislation yet, but businesses already carry governance obligations under POPIA and existing sector law, the same technology-neutral structure Australia is now formalising on purpose. The difference is that Australia built a named monitoring body and a defined set of practices before deciding whether to legislate further. South Africa's equivalent has not been named yet.
For SA firms advising clients on AI risk, the opportunity will not be in interpreting a rulebook that may never arrive in the form everyone expects. It will be in helping clients build defensible AI governance now, under the law that already exists, while South Africa's regulators decide whether they need anything new at all.
Holkam Advisory tracks how AU and SA regulatory paths diverge and converge on AI governance. If you want to know what a defensible governance posture looks like under current SA law, contact us here.