AI regulation in South Africa currently consists of no AI-specific law at all. No AI Act, no AI Bill before Parliament, no national AI policy in force. What governs your use of AI is the law of general application: POPIA, the Consumer Protection Act, the Electronic Communications and Transactions Act, and whatever your sector regulator has said. The uncomfortable version is that the document meant to change this was gazetted on 10 April 2026 and withdrawn in its entirety on 12 June 2026, after it emerged that several of its citations did not exist.
A correction first. In POPIA, GDPR, and AI and again in how to choose an AI consulting firm we described the National AI Policy as a draft awaiting gazetting. It was gazetted. Then it was withdrawn. Both posts have been corrected.
The policy that was withdrawn, and why that matters more than the policy would have
The Department of Communications and Digital Technologies published the Draft South Africa National Artificial Intelligence (AI) Policy as Government Notice 3880 of 2026 in Government Gazette 54477 on 10 April 2026, with comment open to 10 June.
Sixteen days later the Minister announced its withdrawal. The draft, he said, "contains various fictitious sources in its reference list", and "this failure is not a mere technical issue but has compromised the integrity and credibility of the draft policy". On cause he was direct: "The most plausible explanation is that AI-generated citations were included without proper verification." Nobody has published a closed count, but reporting is consistent that at least six of the sixty-seven references do not exist, and that an outside researcher found them rather than anyone inside the drafting or quality assurance process.
His next sentence is the one worth keeping: "In fact, this unacceptable lapse proves why vigilant human oversight over the use of artificial intelligence is critical."
The formal withdrawal followed as Government Notice 3978 of 2026 in Government Gazette 54840 on 12 June 2026, withdrawing the draft "in its entirety".
The practical consequence, embarrassment aside, is that the timeline moved by roughly a year. No policy, no framework in force, and the sector strategies meant to follow are further away than they were in March.
What actually governs AI use in South Africa today
POPIA does most of the work, and three sections carry most of the weight.
Section 71 covers automated decision-making. It bites where a decision is based solely on automated processing and is intended to provide a profile of the person. Both qualifiers do real work, and most AI-assisted decisions in a mid-market business fall outside them because a human is genuinely in the loop. The ones that do not are usually credit, screening and eligibility decisions, which is exactly where businesses automate first.
Section 72 covers sending personal information out of the country. Almost every AI service a South African business uses processes prompts outside South Africa, and in most cases nobody decided that it should. Staff adopt tools faster than their employers realise, which is the pattern we set out in employee resistance to AI. Section 72 needs a lawful ground for that transfer, and "we pasted it into a chatbot" is not one.
Section 21 covers operators. If a third party processes personal information on your behalf, you need a written contract obliging them to secure it. Whether a given AI provider relationship is an operator relationship is a question for your lawyer.
Here is the part that surprises people. The Information Regulator has published six guidance notes since 2019, covering direct marketing, elections, special personal information, children's data, COVID-19 and political parties. The most recent is from December 2024. Not one addresses artificial intelligence, automated decision-making or Section 71. There is no South African regulatory guidance on AI. There is only POPIA, read by you.
The Regulator is not idle, and it is asking about the thing you are doing
At its own media briefing on 31 August 2026 the Regulator confirmed it has begun writing to organisations to demonstrate compliance rather than waiting for a complaint. Bowmans reported in February 2026 that these notices are issued under Section 40(1)(b)(i) and require a full compliance report within fourteen business days, with policies, training records, a risk register, an incident response plan and a record of security compromises attached.
Fourteen business days is not long enough to build a data inventory you do not already have. This is the unglamorous data foundations work nobody budgets for until a notice arrives.
The backdrop has hardened. In a media statement on 13 November 2025 the Regulator reported 2,374 security compromise notifications in 2024/25 at an average of 198 a month, and 1,947 from April 2025 to the date of the statement at 284 a month, which it described as a forty percent increase. The maximum administrative fine under POPIA is R10 million.
The case that should worry an owner more than the policy
In Molawa and Others v Matjhabeng Local Municipality and Another (2026/157576) [2026] ZALCD 30, decided in the Labour Court in Durban by Allen-Yaman J on 13 July 2026, four authorities were cited in a ruling and three were defective. Two did not exist at all. The third was real but did not deal with the point it was cited for.
The ruling was not written by a lawyer. It was written by the chairperson of the employer's own internal disciplinary hearing.
The court did not find that AI produced the citations, and that is the part worth noticing. It recorded the source as undetermined and held that it made no difference: "whether the citations were generated by an AI 'assistant' or self-generated by the Chairperson himself, the result is the same: there is prima facie evidence ... that he failed to apply his mind to the law." The hearing was stayed pending review.
Two earlier cases involved practitioners. In Mavundla [2025] ZAKZPHC 2, decided by Bezuidenhout J on 8 January 2025, nine cases were cited in a supplementary notice of appeal and only two existed; the attorneys paid the wasted costs personally and the judgment went to the Legal Practice Council. Bezuidenhout J put it plainly: "In my view, relying on AI technologies when doing legal research is irresponsible and downright unprofessional." In Northbound Processing [2025] ZAGPJHC 661, 30 June 2025, Smit AJ adopted the English Divisional Court's guidance in Ayinde that "save in exceptional circumstances, admonishment alone is unlikely to be a sufficient response", and referred the matter to the Legal Practice Council for investigation.
Molawa is the one to show your managers, because the citations appeared in a ruling written by an internal decision-maker running an ordinary HR process. Your disciplinary hearings, grievance outcomes, supplier evaluations and credit decisions all produce reasons. If those reasons cite something that does not exist, the process is reviewable regardless of whether the outcome was right, and a court will not need to establish how it happened in order to stop it.
Sector regulators moved before the national policy did
The FSCA and the Prudential Authority published a joint study, Artificial Intelligence in the South African Financial Sector, on 24 November 2025. Of roughly 2,100 responses, 220, or 10.6%, reported using AI. Adoption was concentrated: 52% in banking against 8% in insurance. Respondents named data privacy regulation as the most significant regulatory constraint. Read it with its lag in mind, because the fieldwork was late 2024. It is a supervisory signal, not a standard.
The HPCSA announced revised ethical guidelines on 20 November 2025. The copy on its own domain is Booklet 20, Ethical Guidelines on the Use of Artificial Intelligence, cover-dated September 2025, which is how the South African Medical Journal cites it too. Clause 9.1 is the line worth borrowing whatever industry you are in: "The responsibility for decision making on patient care must always remain with the health practitioner, irrespective of the assistance or tool/s employed to support such decision-making process." Clause 6.2 adds that patients who decline the use of AI may not be disadvantaged or refused access to health services.
What to actually do
Four things, none of which require a policy to exist.
- Write down which decisions are automated. Not which tools you use, which decisions. Check each against the two Section 71 qualifiers. Most fall outside. The ones that do not are where your exposure sits.
- Know where the data goes. Per service, record what leaves the country, in what form, and under which Section 72 ground. That is the question the Regulator is already asking, on a fourteen-day clock.
- Get the operator contracts in place. If a provider processes personal information for you, Section 21 wants it in writing.
- Put a named human on the output. Not "the team". A person accountable for the reasons attached to a decision, who has read the citations. That is what Molawa is about, and it is the cheapest control here.
If you want help sequencing that rather than doing all of it at once, that is the conversation we have in AI consulting.
The absence of an AI law is not a holiday. It means the existing law applies without anyone having written you a guide.
FAQ
Is there an AI Act in South Africa? No. There is no AI Act, no AI Bill before Parliament, and no national AI policy in force as of September 2026. The August 2024 National AI Policy Framework remains non-binding guidance. The draft gazetted in April 2026 was withdrawn in June.
Why was the draft National AI Policy withdrawn? Because its reference list contained fictitious sources. Minister Solly Malatsi announced the withdrawal on 26 April 2026, saying the most plausible explanation was AI-generated citations included without verification. The formal withdrawal was gazetted on 12 June 2026, and no new draft date has been confirmed.
Does POPIA stop us using ChatGPT or Claude at work? No, but it constrains what you put into them. The binding questions are whether personal information is leaving South Africa without a Section 72 ground, whether the provider relationship needs a Section 21 operator contract, and whether any resulting decision falls inside Section 71.
Has the Information Regulator issued guidance on AI? No. Its six published guidance notes cover direct marketing, elections, special personal information, children's data, COVID-19 and political parties. None addresses AI or automated decision-making.
What is the maximum POPIA fine? R10 million, and fines issued to date have been far smaller. Both of the largest were challenged: the R5 million against the Department of Basic Education was set aside on 12 December 2025, with leave to appeal refused on 3 June 2026, and the R500,000 against Blouberg Local Municipality was reduced to R250,000, the Regulator's chairperson telling ITWeb the court found it too high for a first offence. The practical exposure is closer to an enforcement notice and a compliance report on a short deadline.
Does the EU AI Act apply to a South African company? It can, if you place an AI system on the EU market or your output is used in the EU. We covered the mechanics in our EU AI Act update, and there is another deadline on 2 December 2026.
References
- Department of Communications and Digital Technologies, "Draft South Africa National Artificial Intelligence (AI) Policy", Government Notice 3880 of 2026, Government Gazette 54477, 10 April 2026. https://www.gov.za/sites/default/files/gcis_document/202604/54477gen3880.pdf
- Department of Communications and Digital Technologies, "Withdrawal of the Draft South Africa National Artificial Intelligence (AI) Policy", Government Notice 3978 of 2026, Government Gazette 54840, 12 June 2026. https://www.gov.za/sites/default/files/gcis_document/202606/54840gen3978.pdf
- South African Government News Agency, "Minister announces withdrawal of draft AI Policy", 26 April 2026. https://www.sanews.gov.za/south-africa/minister-announces-withdrawal-draft-ai-policy
- Information Regulator of South Africa, Guidance Notes index (accessed September 2026). https://inforegulator.org.za/guidance-notes/
- Information Regulator of South Africa, media statement on complaints, enforcement and security compromise notifications, 13 November 2025. https://inforegulator.org.za/wp-content/uploads/2025/11/MEDIA-STATEMENT_INFORMATION-REGULATORS-LATEST-UPDATE-Journalist-ver.pdf
- Bowmans, "South Africa: Information Regulator launches POPIA monitoring exercise", 17 February 2026, the source for the fourteen business day deadline and the contents of the compliance notice. https://bowmanslaw.com/insights/south-africa-information-regulator-launches-popia-monitoring-exercise/
- Werksmans, "The Regulator is watching: new enforcement signals for POPIA and PAIA compliance", 31 August 2026, reporting the Information Regulator's media briefing of that date. https://werksmans.com/the-regulator-is-watching-new-enforcement-signals-for-popia-and-paia-compliance/
- Moonstone, "Draft AI policy scrapped after fake citation findings", 28 April 2026, reporting 67 references in the 86-page draft and at least six fictitious sources. https://www.moonstone.co.za/draft-ai-policy-scrapped-after-fake-citation-findings/
- Molawa and Others v Matjhabeng Local Municipality and Another (2026/157576) [2026] ZALCD 30, Labour Court, Durban, 13 July 2026. https://www.saflii.org/za/cases/ZALCD/2026/30.html
- Mavundla v MEC: Department of Co-Operative Government and Traditional Affairs KwaZulu-Natal and Others [2025] ZAKZPHC 2, High Court, KwaZulu-Natal Division, Pietermaritzburg, 8 January 2025. https://www.saflii.org/za/cases/ZAKZPHC/2025/2.html
- Northbound Processing (Pty) Ltd v South African Diamond and Precious Metals Regulator and Others (2025/072038) [2025] ZAGPJHC 661, Gauteng Division, Johannesburg, 30 June 2025. https://www.saflii.org/za/cases/ZAGPJHC/2025/661.html
- South African Reserve Bank, "Artificial Intelligence in the South African Financial Sector", FSCA and Prudential Authority, 24 November 2025. https://www.resbank.co.za/en/home/publications/publication-detail-pages/media-releases/2025/artificial-intelligence-in-the-south-african-financial-sector
- Health Professions Council of South Africa, "Ethical Guidelines on the Use of Artificial Intelligence", Booklet 20, cover-dated September 2025, announced 20 November 2025. https://hpcsa-blogs.co.za/wp-content/uploads/2025/11/ETHICAL-GUIDELINES-USE-OF-AI.pdf
- Werksmans, "Leave to appeal refused but questions remain: the matric results privacy dispute", 9 June 2026. https://werksmans.com/leave-to-appeal-refused-but-questions-remain-the-matric-results-privacy-dispute-and-the-meaning-of-personal-information-under-popia/
- ITWeb, "POPIA grace period limits Regulator's fines", 2 September 2026, quoting the Information Regulator chairperson on the Blouberg reduction. https://www.itweb.co.za/article/popia-grace-period-limits-regulators-fines/P3gQ2qGAlAk7nRD1
- Protection of Personal Information Act 4 of 2013, sections 21, 71 and 72. https://www.gov.za/documents/protection-personal-information-act
This post is not legal advice. Three questions need your own counsel: whether a specific decision in your business is solely automated and intended to provide a profile within the meaning of Section 71; whether your use of a given AI service constitutes a transborder transfer requiring a Section 72 ground, and which ground; and whether a particular AI provider relationship is an operator relationship requiring a written Section 21 contract. The answers depend on your facts, not on ours.
Written by JP Dippenaar, Sixees Labs. Last reviewed September 2026.