When the board of the Tankwa Gambling and Betting Board, the fictional provincial gambling regulator in this series, asked for a "regulatory technology strategy", it received three proposals. One was a compliance portal for licensees. One was an analytics platform with dashboards. The third offered an AI assistant that would "review licence applications automatically". The three proposals described different things, and none of them started from what the board is legally required to do.
That confusion is common, because the terms are used loosely. Regtech, suptech, digital regulation and AI for regulators are often treated as one idea. They are not the same, and the differences decide what a regulator should build, who should own it and where the legal limits sit.
Part 1 described the gap between an online industry and an analogue regulator. This article defines the tool for closing it. As in the rest of the series, legal references are general information, not legal advice.
A working definition
In this series, technology-assisted regulation means a regulator using data, software and, where justified, AI to carry out its own statutory functions more effectively, while the decisions the law assigns to people stay with accountable officials.
Three parts of that definition do most of the work.
- The regulator's own functions. The starting point is the duties in the statute, not the features of a product. For a provincial gambling regulator these come from the National Gambling Act 7 of 2004 and the provincial gambling law.
- More effectively. The test is whether the regulator licenses, supervises and enforces better: sooner, more consistently and with better evidence. Better-looking screens are not the test.
- Decisions stay with officials. Technology prepares, checks, ranks and records. It does not grant, refuse, suspend or revoke.
Regtech, suptech and the regulator's side
The financial-services world draws a useful distinction. A 2018 paper by Dirk Broeders and Jermy Prenio for the Bank for International Settlements' Financial Stability Institute defines supervisory technology, or suptech, as "the use of innovative technology by supervisory agencies to support supervision", and finds its early uses in two areas: data collection and data analytics (FSI Insights No 9, July 2018). Regtech is the mirror image: technology that regulated firms use to meet their obligations.
For a gambling regulator the distinction matters because the two sides meet at the interface.
- A bookmaker's regtech includes its age-verification service, its customer due diligence checks under the FIC Act, its self-exclusion screening and its reporting tools.
- The regulator's suptech includes the systems that receive the bookmaker's returns, validate them, compare them with other evidence and help officials decide where to look.
- The interface between them is the return format, the notification rules and the data standards. When those are only PDF templates, neither side's technology can do much with them.
Technology-assisted regulation is broader than suptech in one respect. It includes licensing and service delivery, not only supervision. A regulator's applicants, licensees and members of the public deal with it as a service, and that service is part of the regulatory system.
Start from the statutory functions
Section 31 of the National Gambling Act (as published in 2004) lists the responsibilities of a provincial licensing authority within its jurisdiction. In summary, these include: ensuring that unlawful gambling is prevented, detected and prosecuted; ensuring that licensees carry out their undertakings; ensuring that industry employees are licensed and gambling machines and devices are registered and certified; ensuring the complete and timely collection and remittance of taxes, levies and fees; inspecting premises and devices; enforcing the Act and provincial law; supervising licensees' compliance with FIC Act obligations; reviewing licensees' activities; and suspending or revoking licences. The National Gambling Board's own mandate page describes its oversight role over these provincial functions.
Each function needs different kinds of help.
The map is the most useful planning document a regulator can produce before it talks to a vendor. It shows that a single "AI platform" cannot serve every function equally well, and that some of the highest-value work involves no AI at all. For example, validating a return on arrival or matching a key employee's licence number against the register is ordinary software.
A ladder, not a leap
Technology-assisted regulation develops in stages, and each stage depends on the one below it.
- Digitised. Forms and files are electronic, but the information is still in documents. This is where many organisations stop, and it is why digitising bureaucracy is not transformation.
- Structured. Applications, returns and notifications arrive as data with a defined schema, and are validated on arrival. A missing field is rejected at submission, not discovered three weeks later.
- Analysed. The structured data is compared over time, across licensees and against other sources, such as tax returns, complaints and inspection findings. Officials see patterns instead of reading every file.
- Assisted. Models, including AI where justified, help officials by summarising an application, drafting an inspection plan, flagging inconsistent figures or ranking cases by risk. Every output is a recommendation with its evidence attached.
- Bounded automation. Low-discretion, reversible steps run automatically under published rules, for example sending a reminder before a return is due or acknowledging a complete submission. Discretionary decisions are never automated.
The common mistake is to start at step 4. An AI assistant that summarises licence applications is only as good as the applications it reads. If they arrive as scanned PDFs with missing annexures, the assistant will produce a fluent summary of an incomplete file. AI projects expose weak data ownership describes the same pattern in other sectors.
What it is not
Three boundaries keep technology-assisted regulation lawful and credible.
It is not automated decision-making. Licensing and enforcement decisions affect the rights of applicants and licensees. Whether, and how, the Promotion of Administrative Justice Act applies to a particular kind of decision is a question a regulator should take legal advice on. A sound design assumes that decisions must be lawful, reasonable and procedurally fair, and that affected persons may ask for reasons. A system can help assemble those reasons. It cannot be the decision-maker. The model should not be the law sets out why the rule has to stay authoritative and the model has to stay subordinate to it.
It is not surveillance without limits. A regulator collects personal information about applicants, key employees, punters who self-exclude and informants. The Protection of Personal Information Act applies to public bodies, and each data collection should have a purpose linked to a statutory function. More data is not automatically better supervision.
It is not outsourcing judgement to a vendor. A risk score that the regulator cannot explain is a liability in a review or a court. If the board cannot say why a licensee was inspected or why an application was flagged, it does not control the process. Part 3 returns to this.
The case file is the unit of work
The most useful single idea in technology-assisted regulation is that every regulatory matter, such as a licence application, an inspection, an incident or an enforcement action, has one case record. That record holds the evidence, the rule versions applied, any system recommendations and the official's decision with reasons.
This is the case file described in Every automated recommendation needs a case file, applied to a regulator. It makes three things possible.
- Consistency. Officials can compare similar cases and see whether the same rule produced the same outcome.
- Defensibility. When a licensee objects or applies for review, the regulator can show what it knew, which rule it applied and why.
- Oversight. The National Gambling Board's oversight evaluations under section 34 of the Act, internal audit and the Auditor-General can examine the process, not only its outcomes.
At the Tankwa board the first concrete step was not a platform. It was agreeing a single case identifier and a minimum case record for licence applications, then attaching every email, document and decision to it.
A test for any proposed tool
Before the board approves any technology proposal, it asks seven questions.
| Question | Why it matters |
|---|---|
| Which statutory function does this serve, and which section? | Ties the tool to a legal purpose and to POPIA purpose limitation |
| What decision does it inform, and who makes that decision? | Keeps administrative action with an accountable official |
| What data does it need, and does that data already arrive as structured data? | Shows whether a lower rung of the ladder must be built first |
| Can an official explain its output to an affected licensee? | Supports reasons, review and fairness |
| What happens when it is wrong? | Defines the fallback, the correction route and the audit trail |
| Who owns it after go-live? | Prevents a vendor-run black box |
| What changes if the law changes? | Tests whether rules are configurable and versioned |
A proposal that cannot answer the first two questions is a product looking for a problem.
Key points
- Technology-assisted regulation is a regulator using data, software and justified AI to carry out its own statutory functions, with decisions staying with accountable officials.
- Suptech serves the supervisor and regtech serves the regulated firm. They meet at the return formats and data standards, which are often the weakest link.
- Start from the statutory functions in section 31 of the National Gambling Act and map what each one needs. Many high-value steps involve no AI.
- Climb the ladder in order: digitised, structured, analysed, assisted, bounded automation. AI on top of unstructured files produces fluent summaries of incomplete evidence.
- The case file is the unit of work. It makes regulation consistent, defensible and open to oversight.
This is part 2 of Regulating a Digital Gambling Economy. Previous: When the industry goes online, the regulator cannot stay analogue. Next: From calendar-based audits to risk-based supervision.
The Machine-Readable Policy series covers the rule and decision layer in more depth.
Background reading: National Gambling Act 7 of 2004; BIS FSI Insights No 9, Innovative technology in financial supervision (suptech); National Gambling Board mandate. Checked on 7 November 2026. This article is general information, not legal advice.
How CloudNala can help
CloudNala helps regulators turn a vague "regtech strategy" into a function map. We work through each statutory function with your officials, identify the decisions it involves and the evidence those decisions need, and show which rung of the ladder each function is on today. The result is a sequenced plan that starts with structured data and case records, where the value is highest, and adds analytics and AI only where they serve a decision an official can explain.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book a Regulatory Technology Review or write to us at consult@cloudnala.co.za