We did not need a new law for agentic AI. We needed to open an old one.
ECTA already decides who is bound when software commits an organisation, and the answer is not comfortable.
Sign up for my Substack daily AI newsletter here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
Boardrooms across Johannesburg and Cape Town are wrestling with the same question. If an autonomous AI agent books a flight, signs a vendor order, or commits to a service level on behalf of the business, is the company bound? Most legal opinions begin by lamenting the absence of a dedicated AI statute. That lament is wrong. South Africa wrote the answer in 2002, in a single clause of the Electronic Communications and Transactions Act (ECTA). The provision was drafted for electronic data interchange and automated procurement systems, and it reaches across comfortably to a 2026 agent built on a foundation model. The problem is not legislative silence. The problem is institutional forgetting, and it is now a board-level exposure.
CONTEXT AND BACKGROUND
Section 25(c) of the ECTA provides that a data message generated by a programmed information system acting on behalf of a person is attributed to that person. There is no requirement that a human reviewed the message before it went. The authority to send flows from the decision to deploy the system, not from any subsequent approval. South African attorneys at Bowmans have reread the clause for the agentic era and reached the obvious conclusion. A separate April 2026 note by Eversheds Sutherland arrives at the same destination through delictual reasoning, concluding that the deploying business is typically the party most likely to be held accountable. The statute was built on the United Nations UNCITRAL Model Law on Electronic Commerce, which several Commonwealth jurisdictions have adopted in near-identical form.
INSIGHT AND ANALYSIS
The implication for a South African board is uncomfortable. Every autonomous agent currently running in a business, from procurement bots and email triage systems to scheduling agents and the newer OpenAI super app layer announced in March 2026, is operating on an implied authority the statute confers by default., is operating on an implied authority the statute confers by default. The company does not need to sign a resolution. The deployment itself is the resolution. When the agent errs, hallucinates a counterparty, or circumvents a guardrail, attribution does not shift to the vendor or to the model. An April 2026 incident in which a coding agent silently deleted a company’s production database in nine seconds has become a case study in exactly this gap.
Under the clause, the question a court will ask is not whether a human reviewed the agent’s output, but whether the system was programmed to act on behalf of the organisation. The internal record of what the agent was tasked with, what thresholds it was given, and what guardrails were installed, becomes the only defence available.
IMPLICATIONS
Boards and executive committees should stop waiting for a dedicated AI statute and audit their current ECTA exposure instead. Three questions matter. Which autonomous agents are operating under the company’s name, and who authorised each deployment? What written delegation of authority governs the thresholds those agents may commit to without a human in the loop? Where is the audit trail that will show a court that the agent operated within the mandate the organisation gave it?
The answer is what I have called cognitive governance. Deployment is a legal act, not a technical one. A procurement agent authorised to spend fifty thousand rand without approval is a signed delegation to that effect, whatever the engineering team names the project. South African companies that treat their agents as experiments are, in law, treating them as officers.
CLOSING TAKEAWAY
South Africa did not need to legislate for agentic AI. The country already did, twenty-four years ago, when nobody imagined a system that could draft its own purchase order. Section 25(c) is quiet, elegant, and already in force. The task now is not to lobby for new law but to open the law we have, read it to the board, and update the delegation-of-authority matrix accordingly. The era in which the computer did it was a plausible defence ended before most of us realised it had begun. The question for every executive is simple. What has your deployment already committed you to?
Author Bio: Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net
Comments