Who audits the algorithmic state?

Accountability in government rests on a simple assumption: someone outside the decision can later find out what was decided, by whom, on what basis, and whether it was lawful. Auditors test the spending. Courts test the decision. Regulators test the handling of personal information. Legislatures ask the executive to explain itself.

AI-assisted decisions strain that assumption in a specific way. The decision is still taken by an official, but part of the reasoning now sits in a rule engine, a model, a prompt and a set of retrieved documents, often operated by a supplier. If the department cannot reconstruct what the system contributed to a particular decision, every oversight body arrives at the same dead end.

The question in the title has a straightforward answer: South Africa already has many bodies that can examine an AI-assisted public decision. The harder question is whether departments are building services those bodies can actually examine.

The examiners already exist

No new AI regulator is needed for an AI-assisted licensing decision to be scrutinised. The existing institutions each have a route in. This is a simplified map, and general information rather than legal advice.

• Internal audit and the audit committee examine controls: who can change rules and models, whether overrides are recorded, whether logs are complete.
• The Auditor-General audits public spending and compliance. Since amendments to the Public Audit Act took effect in 2019, the Auditor-General can identify material irregularities, recommend action, issue binding remedial action where recommendations are not implemented and, where a loss results from a failure to implement remedial action, issue a certificate of debt to the responsible accounting officer or authority (SAnews; Public Audit Amendment Act 5 of 2018). An AI contract that delivered nothing verifiable is squarely in that territory.
• The Information Regulator oversees the Protection of Personal Information Act. Most AI-assisted public services process personal information, and section 71 of the Act restricts decisions that have legal consequences for a person, or affect them to a substantial degree, where the decision rests solely on automated processing intended to profile them, subject to exceptions. Whether it applies to a decision an official genuinely takes is a fact-specific legal question, covered in a route to challenge AI-assisted decisions.
• The Public Protector investigates complaints of maladministration and improper conduct in state affairs.
• The courts, under the Promotion of Administrative Justice Act, review whether administrative action was lawful, reasonable and procedurally fair. A person whose rights are materially and adversely affected may request written reasons, generally within 90 days, and the administrator must provide adequate reasons within 90 days of the request. Review proceedings must be brought without unreasonable delay and generally within 180 days, usually after internal remedies have been exhausted, as Part 4, Human-in-the-loop is not administrative justice, sets out.
• Legislatures and their committees call accounting officers to explain spending and performance.

Each of these bodies has its own mandate and procedure, and none of them will accept "the system recommended it" as an answer. They will ask for records.

What every examiner will ask for

The questions differ in emphasis, but they converge on the same evidence. For any AI-assisted decision, a department should be able to produce:

This is the case file described in Every automated recommendation needs a case file. If the case file exists and the department controls it, oversight is routine. If it lives only inside the supplier's platform, or not at all, oversight becomes a dispute.

What an AI audit should actually examine gives auditors a fuller list of areas to examine. The design point for departments is narrower: build the record before go-live, because it cannot be reconstructed afterwards.

Disclosure: an AI register

Oversight bodies can only examine what they know exists. In many organisations, nobody has a complete list of where AI participates in decisions. A department should keep a register of AI-assisted services that records, for each one:

• the decision or decisions the system assists, and the legal authority under which they are taken;
• which role decides, and what the system contributes;
• the rule sets and model versions in use;
• the supplier, the contract and where data is processed;
• known limitations and the date of the last independent evaluation;
• how affected people can ask for reasons, a correction or a review.

Some public bodies elsewhere publish registers of this kind: Amsterdam and Helsinki launched public algorithm registers in 2020, and the Netherlands now runs a national Algorithm Register for government organisations. South African departments do not need to wait for a mandate to keep one internally, and publishing a summary is a practical way to build trust. It also answers the accounting officer's question from Part 8 in AI-native government needs AI-confident officials: which of our services use AI, and who answers for them?

Recourse: designing for the error that will happen

Every administrative system makes mistakes. The test of an accountable service is what happens next. For an AI-assisted service, one error is often a symptom of many, because the same faulty rule version or model behaviour affected every case it touched.

The Thukela Provincial Licensing Authority, the fictional licensing authority in this series, designs its recourse loop before go-live:

1. Find. Errors surface through appeals, internal audit sampling, scenario regression tests or complaints.
2. Log. Each error is recorded in the incident log and against the service's entry in the AI register.
3. Tell. Affected applicants are told what went wrong and what will happen, with reasons.
4. Fix. The faulty rule or model version is corrected and the change is approved through the normal process.
5. Re-run. Every other decision made under the faulty version is identified and reassessed by an official, not only the case that complained.
6. Report. The incident and its resolution are reported to the relevant oversight bodies and reflected in the register.

Step five is the one most often missing, and it is only possible if each decision recorded the version it relied on. Appeals are part of the architecture covers the individual citizen's route in more detail. Governance after an AI failure covers the organisational response.

Independent assurance before, not only after

Audits after the fact catch problems late. For services that affect rights, departments should also commission independent assurance before go-live and at major changes: someone who did not build the system runs the scenario library, reviews the rule translations against their source instruments, samples case files and tests the recourse loop. The government AI evaluation harness provides the scenarios and regression evidence that assurance relies on.

Independence matters. A supplier evaluating its own system, or a project team signing off its own go-live, is useful as a first check but is not assurance.

The answer to the question

So who audits the algorithmic state? The same institutions that audit the rest of it, using the same legal tests, with the same right to records. AI does not create an accountability gap by itself. Departments create one when they buy and operate systems whose contribution to a decision cannot be reconstructed.

The remedy is not a new regulator. It is a service designed from the start to be examined: complete case files, a register of AI-assisted services, a recourse loop that finds every affected decision, and assurance by people who did not build the system.

Next: Part 10, Can South Africa build machine-readable government?. All parts are on the series page.

How CloudNala can help

CloudNala helps public bodies make AI-assisted services auditable before they go live. We define the case-file record for each decision, set up a register of AI-assisted services, design and test the recourse loop, and provide independent pre-go-live assurance against your scenario library. We work alongside your internal audit function, legal advisers and information officer, and we do not provide assurance on systems we have built.

Work with CloudNala

CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.

Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.

Start a Digital Discovery Sprint or write to us at consult@cloudnala.co.za