South Africa Has No National AI Policy Right Now. Your Organisation Still Has Decisions to Make.
The Draft National AI Policy was withdrawn in April 2026 after fictitious citations were discovered. This guide explains what happened and the five steps any South African organisation can take now, no legislation required.
FAIR SA
Foundation for AI Responsibility South Africa · fairsa.org
In April 2026, the Department of Communications and Digital Technologies published the Draft National Artificial Intelligence Policy for public comment. Two weeks later, it was withdrawn — after it emerged that at least 10% of the academic citations were fictitious: references generated by an AI system and never verified by a human.
KEY TAKEAWAYS
The Draft National AI Policy was withdrawn on 26 April 2026 after at least 10% of its academic citations were found to be AI-generated and nonexistent
The failure was not using AI. The failure was shipping an AI-assisted document without human verification of its sources
POPIA already creates real compliance obligations for AI use today — automated decision-making provisions, lawful basis requirements, and data processing rules all apply
A five-step checklist lets any South African organisation build AI governance habits now, without waiting for legislation
The five steps: write down what tools may touch what data, require human verification for anything leaving the building, check POPIA basics, name one accountable person, and train the 10-minute version
The Withdrawal, in Brief
The timeline matters because it is a lesson in itself.
10 April 2026: The DCDT publishes the Draft National AI Policy 2026 for public comment. The draft proposed a National AI Commission, an AI Ethics Board, an AI Regulatory Authority, an AI Ombudsperson, a National AI Safety Institute, and an AI Insurance Superfund.
Between 10–26 April: Reviewers — academics and legal commentators — checked the reference list. At least 10% of the cited academic sources did not exist.
26 April 2026: Minister Solly Malatsi withdraws the draft, confirming fictitious sources, and commits to a redraft with stricter oversight.
“The failure was not using AI. The failure was shipping without checking.”
What the Draft Policy Was Proposing
Understanding the draft helps you anticipate the redraft. The withdrawn version proposed:
New governance bodies: a National AI Commission, Ethics Board, Regulatory Authority, Ombudsperson, and Safety Institute — a full ecosystem, not a single regulator.
POPIA alignment: explicit reference to automated decision-making and data protection by design as a baseline.
Watermarking: mandatory watermarking of training data for large language models.
Data sovereignty: cross-border data flow protocols.
An AI Insurance Superfund to compensate people harmed where liability is unclear.
The direction of travel is clear even if the details change: more accountability for organisations that deploy AI, tighter alignment with POPIA, and probably some form of oversight for higher-risk uses. Organisations that build governance habits now will find a future law a formality.
What To Do Now: A Five-Step Checklist
Step 1 — Write down what AI tools are allowed to touch what data
A one-page matrix is enough: rows are data types (personal information, client records, financials, internal drafts, public info); columns are tools (public chatbots, enterprise AI accounts, internal automations). Every cell is Allowed / Allowed-with-care / Prohibited. This single page resolves 80% of day-to-day questions.
Step 2 — Require human verification for anything that leaves the building
The DCDT withdrawal is your case study. Any AI-assisted document going to a client, regulator, or the public gets a named human checker — especially citations, figures, and quotes. Write it into your document procedures.
Step 3 — Check POPIA basics for AI use
If personal information touches an AI tool: confirm the lawful basis, check whether the tool retains or trains on your data, and consider an enterprise tier with data controls if the use is material. POPIA already applies — the new AI policy would only add to it.
Step 4 — Name an accountable person
Not a committee. One person owns AI governance: answers staff questions, reviews the matrix quarterly, and is the contact if something goes wrong. In a small organisation this is usually the owner or office manager. Ownership is the control.
Step 5 — Train the 10-minute version
Every staff member needs three sentences they actually remember: what not to paste into public AI tools, the rule about verifying anything that goes out, and who to ask. Ten minutes, repeated at onboarding. This is the literacy work FAIR SA exists to support — and it costs almost nothing.
Access to clear AI information should not depend on being in the rooms where the rules are written. That is the gap FAIR SA exists to close.
FREQUENTLY ASKED QUESTIONS
Will the redrafted AI policy affect small businesses?
Almost certainly yes, at least indirectly — the draft proposed alignment across all sectors, and POPIA already binds organisations of every size. Expect the redraft to focus on high-risk uses rather than banning ordinary productivity use.
When will the new draft be published?
No confirmed date has been announced. The Department has committed to a redraft with stricter oversight. Watch the DCDT and gov.za for the next call for public comment — the comment window is the moment to submit.
Is our staff using ChatGPT illegal right now?
Not inherently. It becomes a compliance problem when personal information or confidential data is processed without a lawful basis and controls. The matrix in Step 1 is how you find out what is actually happening.
What about international AI laws like the EU AI Act?
They reach South African organisations indirectly, through customers and partners who are bound by them. If you serve EU clients, expect contractual obligations to arrive before any South African law does.
FREE RESOURCE
Access is Power — Free AI Literacy Guide
Practical AI literacy for South African individuals, schools, and small businesses. Free download, no subscription required.
REFERENCES & SOURCES
- SAnews (Government) — Minister announces withdrawal of draft AI Policy
- DLA Piper — The Withdrawal of South Africa’s Draft AI Policy: An Opportunity?
- Wikipedia — Draft South Africa National Artificial Intelligence Policy 2026
- CNBC Africa — South Africa pulls AI policy after hallucinated citations
- Michalsons — South African AI Policy: guidance and overview
- ANC Parliament — Statement on the use of AI in drafting the National AI Policy
Access is power. Share it.
fairsa.org