South Africa's draft national AI policy explained
South Africa's draft national AI policy was published for comment on 10 April 2026 and withdrawn on 26 April after fictitious references were found in it. A revised draft is expected at Cabinet in November 2026. Meanwhile POPIA applies, and Arke Technologies, in Johannesburg, helps organisations write and apply their own AI policy.
South Africa's draft national AI policy explained
Last reviewed: September 2026, 14 min read
South Africa's draft national AI policy was published for comment on 10 April 2026 and withdrawn on 26 April after fictitious references were found in it. A revised draft is expected at Cabinet in November 2026. Meanwhile POPIA applies, and Arke Technologies, in Johannesburg, helps organisations write and apply their own AI policy.
Last reviewed: September 2026, 14 min read
On this page
What the draft South Africa National Artificial Intelligence (AI) Policy proposed
Although it was withdrawn, the April 2026 draft shows the direction of travel, and much of it is likely to return in some form. It proposed:
Six strategic pillars: capacity and talent development; AI for inclusive growth and job creation; responsible governance; ethical and inclusive AI; cultural preservation and international integration; and human-centred deployment (DLA Piper, May 2026).- Six principles: fairness; reliability and safety; privacy and security; inclusiveness; transparency; and accountability, with meaningful human oversight of AI (DLA Piper, May 2026).
- A risk-based approach, with stricter rules for the uses of AI that can do the most harm.
- Seven new institutions, among them a National AI Commission, an AI Ethics Board, an AI Regulatory Authority, an AI Ombudsperson, an AI Insurance Superfund and a National AI Safety Institute (DLA Piper, May 2026; TechCentral, July 2026).
Nothing in the draft bound an organisation, and its withdrawal changes nothing in the law that already applies. What it shows is where the national AI policy framework is heading: human oversight, transparency, accountability and rules scaled to risk. An organisation that builds those into its own AI policy now will not have to start again when the revised policy arrives.
Why the draft AI policy was withdrawn, and the lesson in it
The draft was withdrawn not for what it proposed but for how it was written. References in its bibliography pointed to academic sources that do not exist, the pattern generative AI produces when it "hallucinates", and the Minister said the failure had compromised the integrity and credibility of the draft (SAnews, April 2026).
The withdrawal of South Africa's AI policy is therefore a governance lesson for every organisation: a national policy on AI reached publication with unchecked AI output in its references. The same failure can happen in a board pack, a tender response, a council report or a school newsletter, which is why every generative AI policy should say who checks AI-assisted work before it leaves the organisation, and how the use of AI is disclosed.
Publishers settled this question early. COPE, the Committee on Publication Ethics, stated in February 2023 that AI tools cannot be listed as authors, that their use must be disclosed and that human authors remain responsible for the content (COPE, February 2023). The COPE AI policy position is a sound model for any organisation that publishes reports, research or official documents.
The rules that already apply to AI in South Africa
South Africa has no AI-specific statute, but AI is not unregulated. These apply today:
- POPIA. It governs personal information in every AI system. Section 71 restricts decisions based solely on automated processing that substantially affect a person; section 72 restricts transfers abroad, including personal information in a prompt sent to a model hosted overseas; sections 19 and 22 require security safeguards and notice of a security compromise; and sections 34 and 35 set stricter rules for children's personal information. See our POPIA compliance checklist.
- King IV. Principle 12 makes the governing body responsible for technology and information governance, and AI falls within it. See King IV and technology governance.
- The PFMA and MFMA. Accounting officers and accounting authorities in departments, public entities and municipalities answer for procurement, records and internal control, including for AI.
- Employment and equality law. AI used in hiring, performance management or discipline must not discriminate unfairly.
- Consumer protection. AI-generated marketing must meet the Consumer Protection Act like any other claim.
- The EU AI Act, for organisations whose AI systems or outputs are used in the European Union.
Sample AI policy for employers
This example AI policy structure suits most employers. Adapt it with your legal counsel: it is a starting point, not legal advice.
- Purpose and scope: who the policy covers, including contractors, and which kinds of AI it covers.
- Approved tools: the business editions staff may use, and how to request a new tool.
- Prohibited uses: for example, entering personal, confidential or client information into unapproved tools, or letting AI make final decisions about people.
- Data rules: what may never go into a prompt, and where processing may take place.
- Human review: a named person checks and owns anything AI-assisted that leaves the organisation.
- Disclosure: when customers, citizens or readers are told that AI was used.
- Decisions about people: hiring, performance, credit and service decisions keep meaningful human review, in line with POPIA section 71.
- Security: approved accounts with multi-factor authentication, and awareness of prompt injection.
- Records: an AI use register listing the owner, purpose, data and provider of each system.
- Incidents: how to report a wrong output, a data leak or misuse, and what happens next.
- Training and review: who is trained on what, and when the policy is next reviewed.
An AI policy for law firms adds client confidentiality and privilege, client consent for AI use on their matters, and a rule that every citation is checked against its source before anything is filed. See IT for law firms.
Sample AI policy for schools
Schools face the same questions with higher stakes, because learners are children and assessment integrity is at issue. A sample AI policy for schools, for principals and school governing bodies to adapt:
- Learner use by phase: which uses are allowed, supervised or banned at each grade, and for which tasks.
- Assessment integrity: learners declare AI use, and teachers design assessments that test understanding rather than polished text.
- Detection tools: do not rely on them. The University of Cape Town (UCT) stopped using Turnitin's AI score from 1 October 2025 because AI detection tools are widely considered unreliable (UCT News, July 2025).
- Teacher use: lesson planning and administration are fine, but learner names, marks and reports stay out of public tools.
- Children's personal information: POPIA sets stricter rules for it (sections 34 and 35), so only approved tools inside your Google Workspace for Education or Microsoft 365 Education tenant should touch learner data.
- Parents: tell them which tools are used and why, and obtain consent where the law requires it.
- Training and review: staff training each year, and an annual review by the governing body.
Universities have moved first. The UCT AI policy for teaching, its AI in Education Framework, was endorsed by the university's Senate Teaching and Learning Committee in June 2025 and rests on three pillars: AI literacy for staff and students, assessment integrity, and AI-enabled innovation in teaching, learning and curriculum design (UCT News, July 2025). See IT for schools and education and IT for universities, TVET colleges and training providers.
How we help, and procurement fit
- Start: an AI readiness session that maps where AI is already used, formally and informally.
- Deliver: an AI use register, risk ratings, a draft policy for board or council approval, controls, training and reporting.
- Governance: a named service lead, regular reporting to your audit and risk committee, and change control as the national policy evolves.
- Procurement: Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor, giving 135% procurement recognition (sworn affidavit available on request); company documents, our CSD supplier number and SARS tax compliance status are available on request, and we complete standard bidding documents when a bid requires them.
- Continuity: you own the policy, the AI use register, the risk assessments and the documentation, in editable formats.