South Africa's AI Policy Was Pulled Over Fake AI Citations. What Now?

What happened to South Africa's draft AI policy?

South Africa's draft National Artificial Intelligence Policy was withdrawn on 26 April 2026, sixteen days after it was published, because its reference list contained sources that do not exist. Cabinet had approved the draft for public comment and it was gazetted on 10 April, with comments due by 10 June.

A News24 investigation then found that several of the academic journals cited in the document were fictitious. Communications and Digital Technologies Minister Solly Malatsi withdrew the draft, saying the failure "is not a mere technical issue but has compromised the integrity and credibility of the draft policy". At least six of the 67 references were invented, according to TechCentral. Two officials were placed on precautionary suspension pending an investigation, ITWeb reported.

How did fake references end up in a government policy?

The fake references were most likely written by an AI tool and never checked. In the minister's words, "the most plausible explanation is that AI-generated citations were included without proper verification". The department's director-general, Nonkqubela Jordan-Dyani, said that "the irresponsible use of AI tools compromised the integrity of the policy document".

This failure has a name: hallucination. A language model does not look facts up unless it has been connected to a source. It produces the words most likely to follow the words before them, and a citation is a very predictable shape: an author, a year, a plausible journal, a title that sounds right. The result reads exactly like a real reference. The only way to tell is to go and find the paper.

Government is not alone. In January 2025 the KwaZulu-Natal High Court referred a law firm to the Legal Practice Council after its court papers cited cases that do not exist, in Mavundla v MEC. The pattern in both stories is identical: a capable person, a deadline, a tool that sounded sure of itself, and nobody assigned to check.

Where does the AI policy stand now?

The policy is being rewritten and will not be published again before March 2027. Jeanette Morwane, the acting deputy director-general managing the project, said in late October 2026 that the drafting team must submit to the minister by 30 November and aims to reach Cabinet by March 2027, as iAfrica reported. That Cabinet step only approves publication for public comment. Final approval comes later and has no date.

The dates have moved three times this year, so treat March 2027 as a target and not a promise.

What is the new AI policy likely to say?

The new policy is likely to set national guidelines and leave each sector to write its own AI rules, without creating a single AI regulator. Morwane told a symposium in July that "we don't want to prescribe to sectors because they understand the architecture of their sectors".

The withdrawn draft proposed seven new institutions, including a National AI Commission, an AI Ethics Board and an AI Insurance Superfund. Those are being reconsidered, and the chair of Parliament's communications committee has argued for strengthening existing bodies such as Icasa and the Information Regulator instead. Morwane has said the policy's principles and vision remain intact. None of this is final, and a business should not build a compliance programme on a document nobody has seen.

Which laws already apply to AI in South Africa?

POPIA already applies to any AI tool that processes personal information, and it does not wait for an AI policy. Three parts of it matter most when staff use AI.

• Lawful processing. Pasting a client's details into an AI tool is processing. It needs a lawful basis and appropriate security, the same as any other system.
• Transfers outside South Africa. Most AI services run in data centres abroad, and section 72 sets conditions for sending personal information out of the country.
• Automated decisions. Section 71 limits decisions with legal or similarly serious consequences that are made solely by automated processing, such as declining a credit or job application by algorithm alone.

Professional duties apply too, as the Mavundla judgment showed, and so do the rules of your sector. The POPIA compliance checklist is the place to start if any of this is new.

What should a business take from this?

A business should treat every AI answer as a draft that a named person must verify before it leaves the building. A national department lost a policy, months of work and public credibility because that one step was missing. Five rules close the gap.

1. Every fact gets a source you have opened. If an AI tool gives you a statistic, a quotation, a case or a reference, someone clicks through and reads the original. No link, no fact.
2. One person signs. Each document that goes to a client, a regulator, a funder or a court has a named reviewer. "The team" is not a name.
3. Use tools that cite. Prefer assistants that show where each claim came from, and check the links, because a citation that exists can still say something different.
4. Say when AI was used. Internally at least. Reviewers check harder when they know.
5. Write it down. A one-page AI policy that covers approved tools, banned data and the review step is worth more than a long one nobody reads.

The minister made the same move after the withdrawal, telling Parliament that the department would enforce "an internal responsible AI use policy". If the department writing the national AI policy needed one, so does a 30-person company.

How can AMEA help with AI governance?

AMEA Technologies writes AI acceptable use policies around how each organisation actually works, and deploys AI tools with data controls in place so the rules are not left to memory. IT policy and documentation covers the AI policy alongside your POPIA and incident response documents, and the AI adoption service covers readiness, secure deployment and staff training. For the tools themselves, see AI Tools for South African SMEs.

What are the sources for this article?

• ITWeb, 26 April 2026: the withdrawal and the minister's statement.
• ITWeb, 12 May 2026: the expert panel, the suspensions and the director-general's comment.
• TechCentral, 29 July 2026: the sector-led approach and the institutions under review.
• iAfrica, 31 October 2026: the 30 November and March 2027 dates.
• Michalsons: the Mavundla v MEC judgment on fictitious case citations.