South Africa’s national AI policy is getting a second draft, and the reason it needs one is the most practical AI governance lesson any South African board will receive this year. Business Day reported on 3 October 2026 that Deputy Minister of Communications and Digital Technologies Mondli Gungubele expects the revised final draft to go for ministerial input before the end of November, ahead of Cabinet. The first draft, published for comment on 10 April 2026, was withdrawn on 27 April after fictitious academic citations were found in its reference list. The Minister’s explanation was that “AI-generated citations were included without proper verification”.
Firms waiting for the national policy before acting on AI are waiting for the wrong thing. The control that failed in April is one most organisations have not yet put in place.
What happened to the first draft?
According to TimesLive’s report of 27 April 2026, Minister Solly Malatsi withdrew the draft after an internal investigation confirmed that the document published for comment contained fictitious sources. His statement was direct: “I am withdrawing the draft national artificial intelligence policy. South Africans deserve better.” He added that “this unacceptable lapse proves why vigilant human oversight over the use of artificial intelligence is critical”, and that there would be consequences for those responsible for drafting and quality assurance.
A hallucination is output from a generative AI model that is fluent and plausible but factually wrong or invented, such as a citation to an article that does not exist. Hallucinations are a known property of these models, not a malfunction. The governance failure is not that a model produced one. It is that the output reached a published document without anyone checking it.
Where is the revised policy now?
Business Day quoted the Deputy Minister: “My understanding is it’s at an advanced stage … I was briefed three weeks ago.” The revised draft is expected to pass through the relevant ministerial clusters before going to Cabinet. Until a revised draft is published, its content is unknown, and organisations should be cautious of commentary that claims otherwise.
Meanwhile, regulators are not waiting. The FSCA’s integrated report for the year ended 31 March 2026, presented to Parliament’s standing committee on finance and reported by ITWeb on 30 September, states that “an AI framework is being developed to provide the guidelines and approach for the development and deployment of AI responsibly” within the FSCA itself. In April, the Prudential Authority told supervised institutions that AI use across development and operational environments should be “visible, governed, and monitored”. If the conduct regulator is formalising governance of its own AI use, the firms it supervises should expect to be asked about theirs.
Why does the withdrawal matter for private firms?
Because the same failure happens inside firms every week, usually with less visibility. A due diligence memo summarised by a chatbot, a client letter drafted with an AI assistant, a court filing with a case reference nobody looked up, a board paper whose statistics came from a prompt. South African courts have already criticised legal submissions citing non-existent authorities, in matters including Parker v Forsyth and Mavundla v MEC, which our article on shadow AI lists among the principles legal practices must account for.
Human-in-the-loop verification means that a named, competent person checks AI-generated content against primary sources before it is relied on or released, and that the check is recorded. It is the specific control that was missing in April. It costs little to introduce and is easy to evidence.
What should an AI governance framework include today?
AI governance is the set of policies, roles and controls that determine which AI tools an organisation uses, for what purposes, with what data, and under whose oversight. A proportionate framework for a regulated SME or mid-market firm does not need to wait for national policy. It needs:
- An inventory. Which AI tools are in use, by whom, on which devices and with what data. The list is usually longer than management expects.
- A usage policy that distinguishes sanctioned tools, restricted uses and prohibited data, written for staff rather than lawyers.
- Verification rules that require human review of AI output before it is sent to clients, filed with a court or regulator, or presented to the board.
- POPIA alignment. Section 19 safeguards for personal information entered into AI tools, section 72 conditions for cross-border transfers, and section 71 safeguards for automated decisions, which we cover in our section 71 guide.
- Vendor terms review, covering data retention, model training on your content and where data is processed.
- Board reporting, so that AI risk is owned at the level where the Prudential Authority, among others, expects it to sit.
What to do this quarter
- Commission an AI usage audit to establish what is actually in use before writing rules for it.
- Adopt a verification rule for any AI-assisted document that leaves the organisation, with a named reviewer.
- Publish a short staff usage policy covering sanctioned tools and prohibited data.
- Review vendor terms for every AI tool that touches client or personal information.
- Map AI-supported decisions against POPIA section 71 and document the human review step.
- Put AI risk on the board agenda, with an owner and a quarterly report.
- Track the revised national policy when it is published, and adjust rather than start again.
Frequently asked questions
What is the status of South Africa’s national AI policy?
The first draft, published on 10 April 2026, was withdrawn on 27 April 2026. On 3 October 2026 Business Day reported that the revised final draft was due for ministerial input before the end of November, ahead of Cabinet.
Why was the first draft withdrawn?
The Minister said fictitious sources were found in its reference list and that the most plausible explanation was AI-generated citations included without proper verification.
Do South African firms need to wait for the national AI policy before governing AI?
No. POPIA already applies to personal information processed through AI tools, and sector regulators are already asking about AI. Inventory, policy and verification controls can be put in place now.
What is an AI usage audit?
A structured review that discovers which AI tools are in use, what data flows into them, what vendor terms permit and where output is relied on without review, producing a risk-ranked register and remediation plan.
How Rhentech can help
Rhentech’s AI usage audit establishes the facts, and our AI governance engagement turns them into a proportionate framework with verification rules, POPIA alignment and board reporting that will hold whatever the final national policy says.
To discuss where your organisation stands, book a free initial consultation with a senior consultant. The consultation costs nothing; audits and governance engagements are paid, scoped to your organisation.
Sources
- TimesLive, “Minister Malatsi withdraws draft AI policy”, 27 April 2026.
- Business Day, “AI policy gets a second chance”, 3 October 2026.
- ITWeb, “FSCA builds AI guardrails as digital regulation expands”, 30 September 2026, reporting the FSCA Integrated Report for the year ended 31 March 2026.
- Prudential Authority, Preparing for Frontier AI and AI-Accelerated Cyber Risk, 24 April 2026.
This article is for informational purposes. It does not constitute legal advice. Consult qualified legal counsel for compliance matters specific to your organisation.
Reviewed 20 October 2026.