What happened to South Africa's draft national AI policy, which rules already apply to AI, and the governance steps that hold up whatever comes next.
TL;DR
In April 2026, South Africa published its first draft national AI policy. Two weeks later the government withdrew it, because the document's own reference list included sources that did not exist.
This post sets out where the policy stands now, what the draft proposed, which rules already apply to businesses using AI in South Africa, and what I would do this quarter while the revised policy is pending. I am not a lawyer, and nothing here is legal advice. It is the view of someone who helps leadership teams make practical decisions about AI.
The draft was approved by Cabinet on 25 March 2026 and gazetted on 10 April 2026, with public comment open until 10 June. On 26 April 2026, Communications and Digital Technologies Minister Solly Malatsi withdrew it after confirming that the reference list contained fictitious sources. He gave the most plausible explanation as AI-generated citations included without proper verification, and said the lapse "proves why vigilant human oversight over the use of artificial intelligence is critical."
Cabinet later approved the withdrawal. At least 10% of the references to academic sources were fictitious. At the time of writing, in November 2026, I have not been able to find a revised draft gazetted for comment. If one has appeared by the time you read this, start there.
The draft built on the National AI Policy Framework the Department of Communications and Digital Technologies released in August 2024. It positioned AI as a driver of inclusive economic growth and proposed a set of new institutions, including a National AI Commission, an AI Ethics Board, an AI Regulatory Authority, and an AI Ombudsperson.
For businesses, the practical direction was familiar from other jurisdictions: AI systems that can be audited, decisions that can be explained, human oversight on consequential uses, and sector-specific rules for higher-risk applications. The specific provisions no longer carry weight, because the document has been withdrawn. My view is that the direction will survive into the next draft, since it reflects the 2024 framework and broad international practice.
More than many leaders assume. There is no AI-specific statute, but AI systems process personal information, make or shape decisions, and produce work that people rely on, and existing law covers all of that.
| Area | What applies today | What it means in practice |
|---|---|---|
| Automated decisions about people | POPIA section 71 restricts decisions with legal or substantial effect based solely on automated profiling, including of performance at work or creditworthiness | Keep a human in the decision on hiring, performance, and credit, and be able to explain the logic |
| Personal information in AI tools | POPIA's conditions for lawful processing | Know which tools staff paste customer or employee data into, and on what terms |
| Employment | Existing labour law and fair process | AI-assisted decisions about staff still need fair, explainable process |
| EU customers or staff | The EU AI Act, with AI literacy obligations already in force and high-risk rules for areas such as employment applying from 2 December 2027 | Map which systems touch EU people and check them against the Act's risk categories |
The section 71 point deserves attention from HR teams in particular. Tools that screen or rank candidates are where automated profiling most often slips in unnoticed, which is one reason AI in recruitment needs its own governance.
Build the governance any sensible final policy would expect, and stop there. Waiting for the policy is a decision too, and it usually means AI use grows without anyone seeing it. Restructuring the business around a withdrawn draft is the opposite mistake.
Think of it the way a plant manager prepares for a revised safety standard. You do not rebuild the line to a draft. You make sure every machine is on the asset register, every operator is trained, and every incident is logged, because every version of the standard will ask for those.
None of this depends on the final wording of the national policy, and all of it reduces risk today.
Not currently. A draft National AI Policy was gazetted on 10 April 2026 and withdrawn on 26 April 2026 after fictitious references were found, and Cabinet later approved the withdrawal. At the time of writing in November 2026, I have not found a revised draft published for comment.
The Minister of Communications and Digital Technologies withdrew it after an internal process confirmed that its reference list contained fictitious sources. He said the most plausible explanation was AI-generated citations included without proper verification.
There is no AI-specific law, but existing law applies. POPIA governs personal information used by AI tools, and section 71 restricts decisions based solely on automated profiling that have legal or substantial effects on a person.
It can, depending on how your AI systems reach the EU market or affect people there. Map which systems touch EU customers or staff and take legal advice on those specifically.
Make an inventory of AI use, publish a short usage policy, keep humans in decisions about people, require verification of AI-generated work, and assign one owner for AI governance. These steps hold up whatever the final policy says.
If you want an independent view of where your governance and risk position stands today, our AI readiness and value unlock audit covers governance and risk as one of its core areas.
Ready to move from reading about AI to getting your organisation ready for it? Start with the diagnostic.
Take the AI Readiness Diagnostic