by I AM

Policy Without a Rulebook: What South Africa's Withdrawn AI Policy Means for Business Across Africa

In April 2026, South Africa's Minister of Communications and Digital Technologies, Solly Malatsi, withdrew the country's draft National AI Policy after it emerged that its reference list contained fictitious sources. Cabinet formally approved the withdrawal on 5 June 2026. The irony was hard to miss: a document meant to set national standards for the ethical use of artificial intelligence had itself apparently fallen foul of unchecked AI output. But beyond the embarrassment sits a more consequential question for every business building with AI in Africa: what do you do when the rulebook does not exist yet?

What actually happened in Pretoria

The draft policy was approved for publication for public comment in early April 2026. Within weeks, internal checks confirmed what Malatsi described as "various fictitious sources" in its references. The draft was pulled, and at a post-Cabinet briefing in June, Minister in the Presidency Khumbudzo Ntshavheni said the withdrawal would "allow a rework" so the policy could meet its goals and set national standards for the ethical use of AI.

Speaking at GovTech 2026 in Durban in September, Malatsi told Daily Maverick that a new draft should reach Cabinet by March 2027, the end of the financial year. His framing was notable. He argued for an "agile" policy that enables growth rather than regulating out of panic, and said that using AI in research is only unethical when it is not declared. For businesses, the signal is that South Africa is leaning towards enablement rather than heavy restriction, but with transparency and accountability as non-negotiables.

A continent of strategies, not statutes

South Africa is not unusual in lacking binding AI law; it is typical. According to a 2026 country-by-country review that draws on OECD research, only 16 of Africa's 54 countries had adopted a national AI strategy or policy framework by April 2026, and most carry no legal force. The African Union published a Continental AI Strategy in July 2024, and ministers from 49 countries signed the Africa Declaration on AI at the Kigali summit in April 2025. Smart Africa launched a Model AI Policy Framework in July 2025 as a template for countries without a strategy, though it has no enforcement mechanism.

Individual countries are moving at different speeds. Rwanda's 2022 national AI policy, with ethical oversight committees and risk assessment, is described as the most structured governance environment among the countries reviewed. Ghana published a ten-year AI strategy running to 2033. Kenya's 2025 strategy carries no binding obligations, but an AI Bill, drafted since 2024, is expected to move through parliament in 2026 and to introduce risk-tiered obligations similar in structure to the EU's approach. Nigeria has a national strategy, and a Senate bill proposing a National AI Commission with registration and enforcement powers has passed first reading but is not yet law. Egypt updated its strategy in 2025, with emphasis on government use of AI.

In the absence of AI-specific statutes, the laws that actually bite today are data protection laws. Nigeria's data protection regulator is reported to have more than 1,300 organisations under investigation under the 2023 Data Protection Act. In South Africa, AI-related data governance currently runs through the Protection of Personal Information Act (POPIA), enforced by the Information Regulator.

The global contrast: Brussels blinks

The EU AI Act, the world's most comprehensive AI law, is itself in flux. A provisional political agreement reached on 6 May 2026, and confirmed by member state representatives on 13 May, would postpone the obligations for stand-alone high-risk AI systems from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products from August 2027 to 2 August 2028. Law firm Gibson Dunn notes that the new dates apply only once the changes are formally adopted and published in the Official Journal. Some transparency obligations still apply from August 2026, and the deal adds a new ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material.

The lesson is that even jurisdictions with comprehensive frameworks are struggling to calibrate. Africa's gap is therefore less a case of being behind than of being early in a global process of trial and correction. That matters because the EU often exports its rules in practice: African companies selling into European markets, or processing European residents' data, may find Brussels' requirements arrive in their contracts long before any local statute does.

Why this matters commercially

The adoption data shows that regulation is not what is holding business back. Microsoft's AI Economy Institute reports that 23.1% of working-age South Africans had used a generative AI tool by Q1 2026, up from 19.3% in the first half of 2025, making South Africa Africa's leading adopter. Nigeria and Ghana sat at 10.1% and Kenya at 8.7%, against a global average of 17.8%. Usage is growing faster than governance.

That creates a specific risk for organisations in professional services, trades and finance, where AI outputs increasingly feed into advice, quotes and documents. The withdrawn policy is a vivid reminder that unverified AI-generated content, whether fabricated citations, invented case law or wrong figures, is a liability that sits with the human who signed off, not the tool. No policy needs to be finalised for that to be true.

What businesses should do now

First, treat existing law as your AI regulation. POPIA already governs how personal information is processed, including when it is fed into AI tools. Know what data your staff paste into public models.

Second, build verification into workflows. Require a named human to check facts, citations and calculations in anything AI-assisted that leaves the building, and keep a record of it. Malatsi's own standard of declaring AI use and taking responsibility for errors is a sensible internal baseline.

Third, design for the strictest likely regime. If you serve clients across borders, aligning with risk-based principles such as transparency, human oversight and documentation puts you ahead of both the likely Kenyan and South African frameworks and the EU's requirements.

Fourth, engage in the process. South Africa's new draft will be shaped by public comment, and businesses with practical experience of deploying AI are exactly the voices a pro-growth, "agile" policy needs.

Conclusion

The collapse of South Africa's first draft AI policy is a setback on the calendar, but not a strategic disaster. It offers Africa something useful: a public, low-cost lesson in why AI needs human verification. With a revised draft targeted for March 2027, the businesses that will be best placed are those that do not wait for it, and instead build accountable, transparent AI practice today.

Sources: SAnews (Cabinet approves withdrawal of AI policy); Daily Maverick, 21 September 2026; TechAfrica News on Microsoft AI Economy Institute, Global AI Diffusion Q1 2026; Techmoonshot, Africa AI Regulation 2026; Gibson Dunn, EU AI Act Omnibus Agreement.