A copper engraved seal stamped into cream vellum, the impression reading 'VERIFIED • MATHEMATICALLY PROVEN', warm afternoon light.

The end of AI hallucination in legal tech is here.

The payroll is wrong.
The compiler can prove it.

Every South African system that touches PAYE, VAT, UIF or BCEA re-states the statute in its own code, and gets a corner of it wrong. Tinman-Engine makes the wording of the Act the source of the calculation — and stamps every result with the subsection it came from.

See it run on PAYE Read the story

Chartered Accountant certified Vetted by 2 Advocates of the High Court Compiles offline • air-gap installable

Four hands meeting over a polished oak conference table between leather-bound Act volumes, fountain pen, brass magnifier and a closed laptop showing a dark-mode terminal.

South Africa's laws are public. The mapping isn't.

Every payroll vendor, tax engine and HR system has a private translation of the Act inside it. Eight years ago, BCEA severance alone needed three such translations. Today there are four. None of them agree on the rounding.

Tinman-Engine is the first compilation of those Acts written by South African senior counsel and a Chartered Accountant, in a language that produces mathematically verified outputs instead of "the spreadsheet says so". Every change to the Act gets replayed against the existing code the moment the gazette drops.

If your number is wrong, who pays?

A payroll that under-pays PAYE costs you a Section 210 penalty and ten-percent interest. A payroll that over-pays costs you a refund request your people will file against you. A benefit calculation that misses the BCEA one-week-per-year rule costs you CCMA. A VAT fraction rounded banker's way instead of half-up loses you the half-cent on every transaction, audited.

3 amendments

to s12C alone in two years.

The manufacturing allowance rates and the 40:20:20:20 apportionment migrate between subsections each Taxation Laws Amendment Act. A spreadsheet pinned to last year's gazette is now incorrect in three places — and the auditor cannot see which three.

1 rule

s66 of the VAT Act.

The tax fraction is capped at five decimal places and rounded half a cent up. Python's round() rounds half to even. Two engines, two answers, one of them wrong on every line.

1 missing proviso

silent zero.

If a tax calculation has no rule that fires in the current state, the compiler aborts loudly. A spreadsheet defaults to R0. Six months later the practice note arrives.

Watch

Three minutes, end to end.

Why computing the law needs more than legacy code or a language model, how Tinman-Engine writes each rule beside the paragraph it comes from, and what that changes for audits and amendments.

3 min. Sound on. Captions available.

The long explainer

South African law as deterministic code

0:00 / 20:11

A polished brass cogwheel engraved with '§§' on dark slate, a thin line of golden light wrapping the rim, a small engraved nameplate reading 'v1.0 • signed' beside it.

A wheel, not a service.

The compiled artefact is a cryptographically signed, offline-installable Python wheel (PEP 427). Your CI runs it. Your auditor reads it. Your customer's data never leaves South Africa. The compiler runs inside your infrastructure, with no API call back to anyone.

It compiles down to OCaml — no Python runtime, no JIT, no garbage collector on the hot path. A ream of paper weighs more than the engine.

What it looks like, side by side.

	Traditional tooling	Tinman-Engine
Source of the rule	Engineer's re-statement of the subsection	The subsection itself, in the same doc as the code
When the gazette drops	Vendor patch window, weeks to months	Replay wheel against the new Act; diff shows every change
Rounding	Whatever the language's `round()` does	The statutory rule, declared in the code, mechanically enforced
Audit trail	Git log of the spreadsheet	Trace from result back to the paragraph, subsection and proviso that fired
Silent zeros	Slip through, surface at year-end	Compile-time error, build fails red
Topology	Spreadsheet emailed to the auditor	Compiler aborts on circular definition, conflict or impossible state
Data residency	Vendor cloud, wherever that is	Runs offline — air-gap installable, no API call ever

A long hallway lined with identical closed glass doors with brass nameplates, the nearest door slightly ajar spilling warm light across polished concrete.

From "the spreadsheet says so" to "the Act says so".

When the tax authority or the labour inspector asks where a number came from, the answer can no longer be an intern's pivot table. It is a one-page printout from the literate compiler: the subsection in the left margin, the code in the right, the inputs in the middle, the cent-exact output at the bottom.

That same printout is what your tender response, your SAICA file, and your Section 7B dispute look like — three audiences, one source of truth.

On the record.

We were instructed to verify that the wording of the Income Tax Act and the output of the compiler match, subsection for subsection, including every proviso and every amending Act since 2008. They do. Two Advocates of the High Court and a Chartered Accountant (SA) have signed the certificates — Annexure A to D.

Senior Counsel Independent Legal Opinion, 2026

34+ modules, one engine.

Each wheel is a self-contained literate-programming document. The statute in the left margin, the formalisation in the right. The compiler is the same for every Act in the catalogue; only the document changes.

ITA 58/1962

Employees' tax (PAYE)

Fourth Schedule paragraphs 9, 2 and 10. The annual equivalent, the prescribed tables, the 25% flat rate, the ETI set-off.

VAT Act 89/1991

Value-added tax

Output tax, input tax, the tax fraction, apportionment, notional input tax, registration and time of supply, with the s17(2) input-tax denials.

BCEA 75/1997

Severance and notice

s37 notice periods, s41 severance pay — at least one week's remuneration for each completed year of service, both from the gazetted text.

UICA 4/2002

UIF s6 contributions

1% employee, 1% employer, contribution ceiling, the monthly remittance cadence.

ETI Act 26/2013

Employment Tax Incentive

ss3, 6, 7. Eligibility, the monthly amount, the 24-month cap, the set-off against PAYE.

And more

29 more modules, and growing

Companies and dividends tax, capital gains, trusts, retirement benefits, transfer duty and the rest of the catalogue. Run every one of them in the playground.

Foundation stones being laid in soft dawn light, a row of identical pale limestone blocks aligned on a perfect concrete base, a surveyor's theodolite on a tripod in the foreground.

Built before the gazette, not after it.

The same compiler that drives every commercial product on this page is also the fastest way to preview a draft Taxation Laws Amendment. Feed it the proposed wording; the compiler either accepts the new wording into the existing rules or it refuses — citing the circular definition, the conflicting exception, or the silent zero — before the gazette has been printed.

For teams modelling a draft rule, what used to be a six-week consultant engagement is now a single overnight CI job.

For product teams

If your product pays a salary, settles a tax, files an EMP201, processes a refund, or runs a CCMA, you have a legal dependency. That dependency now installs as a wheel. Your release cadence stops being gated by your tax consultant's retainer.

For audit and risk

Every result is a one-page printout: the paragraph in the left margin, the code in the right, the inputs in the middle, the cent-exact output at the bottom. SAICA, IRBA, the Auditor-General and SARS ITaCDS can all read it. You sign one column: which paragraph you relied on.

For Treasury and revenue authority teams

Take a draft Taxation Laws Amendment to a working build overnight. The compiler will tell you, in seconds, whether the new wording has the same collisions, or new ones. Cycles, conflicts and silent zeros show up before the gazette, not in a press release.

For procurement and RFPs

If a vendor's PAYE math lives in a closed spreadsheet, you cannot audit it. If it lives in a verified Tinman-Engine module, you can. The source is open, the test vectors are public, the seal is the Chartered Accountant's.

An opened leather-bound ledger with handwritten entries in deep blue ink in perfectly ruled columns, a modern fountain pen across the right page, warm tungsten desk-lamp light on marble.

The compiler is the source of truth.

The website you are reading runs every calculation by calling Tinman-Engine as a subprocess. The browser never computes a legal amount — it formats the string the compiler returns. Money stays a string end to end, so no cent is lost to floating point.

Try the PAYE module on the running playground at lawlanguage.vcb-ai.online/playground — pre-filled with the 2024 Act and every worked example. Every intermediate value prints with the rule that produced it.