Artificial Intelligence · South Africa
AI regulation in South Africa (2026)
South Africa shaded by its artificial intelligence status
South Africa has no comprehensive AI-specific law in force; AI is currently governed indirectly through general legislation such as the Protection of Personal Information Act (POPIA), the Cybercrimes Act, the Consumer Protection Act and the Electronic Communications and Transactions Act. The Department of Communications and Digital Technologies (DCDT) advanced a Draft National AI Policy through Cabinet and gazetted it for 60 days of public comment in April 2026, but the Minister withdrew it later that month after at least six of its academic citations were found to be AI-fabricated. A revised draft is expected, leaving the country in a pre-legislative, policy-development phase.
Key points
There is no codified, standalone AI law in South Africa; AI is regulated indirectly via existing technology-neutral and sectoral legislation rather than a dedicated AI Act.
Cabinet approved publication (25 March / 1 April 2026) and the Draft National AI Policy was gazetted on 10 April 2026 for a 60-day comment period (closing 10 June 2026), proposing a risk-based, human-centred framework.
Minister Solly Malatsi withdrew the draft on 26/27 April 2026 after reporting revealed at least six of 67 academic citations were non-existent (apparently AI-hallucinated); he called it an 'unacceptable lapse' and promised a revised draft with stricter oversight.
The Protection of Personal Information Act governs AI processing of personal data—including profiling, automated decision-making, transparency, accuracy and cross-border transfers—and is enforced by the Information Regulator.
The Cybercrimes Act (data/system interference), the Consumer Protection Act (fairness/safety of products), and the Electronic Communications and Transactions Act (automated processes) apply to AI use, alongside sectoral rules in finance, health and telecoms.
The DCDT published an AI Policy Framework / discussion material in 2024 emphasising responsible adoption, data governance, infrastructure and skills, providing the conceptual basis the later draft policy built upon.
Timeline - major decisions & events
Minister Solly Malatsi withdrew the Draft National AI Policy just 17 days after gazette publication after journalists found at least six of its 67 academic citations were fabricated — the drafters had used a generative AI tool without verifying a single reference. The scandal triggered parliamentary censure and reset South Africa's formal AI policy process.
The Next Web ↗The DCDT published a risk-based Draft National AI Policy in the Government Gazette (Notice 3880), establishing principles, governance priorities, and a phased road map toward binding legislation, with public submissions due 10 June 2026. Cabinet had approved the text on 25 March and 1 April 2026, but the document was subsequently withdrawn owing to fictitious citations.
South African Government Gazette (gov.za) ↗The Information Regulator gazetted updated Regulations under POPIA (Government Notice 6126, Gazette No. 52523), expanding data-subject rights including enhanced protections against automated decision-making under section 71, clarifying definitions, and strengthening enforcement procedures — the first binding regulatory update directly addressing AI-driven data processing.
Information Regulator of South Africa ↗The Department of Communications and Digital Technologies published a comprehensive AI Policy Framework articulating a human-centred, risk-based vision across twelve strategic pillars — talent, infrastructure, research, ethics, public-sector deployment, and standards — benchmarked against the EU AI Act and peer national strategies. Stakeholder comments were requested by 29 November 2024.
DCDT (dcdt.gov.za) ↗At the government-hosted National AI Summit, Minister Gungubele unveiled the National AI Plan — the first concrete government road map committing to an AI coordination mechanism and a phased legislative development process targeted for completion by the 2027/28 financial year.
DCDT (dcdt.gov.za) ↗The Department of Communications and Digital Technologies circulated its foundational 'Adoption of AI by Government' discussion document, surveying the global AI landscape, diagnosing South Africa's readiness gaps, and initiating the multi-stakeholder consultation that would feed the April 2024 National AI Plan.
DCDT (dcdt.gov.za) ↗The Presidential Commission on the Fourth Industrial Revolution officially published its report, recommending the creation of a national AI Institute for R&D, training, and social-impact oversight; an Industry 4.0 coordination council within the Presidency; and major reskilling investment — laying the strategic foundation for all subsequent national AI policy work.
South African Government Gazette (gov.za) ↗President Zuma assented to POPIA (Act 4 of 2013), published in Government Gazette No. 37067 on 26 November 2013. Although commencement was deferred, the Act's requirements on automated decision-making, profiling, consent, and data-subject rights became the de-facto legal framework for AI data processing once activated.
South African Government Gazette (gov.za) ↗South Africa - other topics
Last verified 5/23/2026 · Orientation, not legal advice - verify against the primary sources linked above. Explore the full world map →