South Africa - National AI Policy Framework

Overview

Status note (27 September 2026): this record is the August 2024 Framework. It was superseded by the Draft South Africa National AI Policy (2026), which was withdrawn on 26 April 2026. Earlier versions of this page applied that withdrawal to the 2024 Framework; it did not apply to it. Where sections below describe 2026 events, they concern the later draft.

The draft South Africa National Artificial Intelligence Policy Framework, released by the Department of Communications and Digital Technologies (DCDT) in 2024, set out a national roadmap aimed at harnessing AI for economic growth while protecting constitutional rights. Following public consultations on the 2024 framework, the DCDT published an expanded Draft National AI Policy in Government Gazette No. 54477 on 10 April 2026. However, on 26 April 2026, Minister Solly Malatsi announced the withdrawal of the draft policy after an internal review revealed that its reference list contained fabricated, AI-generated citations. An independent expert review panel was subsequently appointed to rebuild the national policy.

Definitions

The Framework defines foundational terms to align policy and implementation. Core definitions include: "Artificial Intelligence" as systems that perform tasks that normally require human intelligence, including machine learning and related statistical techniques; "AI system" as the combination of models, data, compute and deployment context; "developer" and "provider" as entities creating or offering AI models; "deployers" or "operators" as those placing systems into production; and "high-impact/high-risk systems" as those likely to affect fundamental rights, health, safety, economic inclusion, or national security. The draft also distinguishes general-purpose AI (broadly-capable models) from narrower application-specific systems and signals that obligations should be proportional to risk and impact.

Governance and Institutional Framework

The Framework proposes an institutional architecture with a lead policy authority in DCDT supported by an inter‑departmental coordinating forum (including the Department of Science and Innovation and Treasury), an advisory scientific panel, and a national AI coordination office to guide standards, procurement policy and monitoring. It recommends statutory alignment with the Information Regulator (POPIA enforcement) and the Cybersecurity Hub (for model and infrastructure security). The Framework encourages a multi-stakeholder governance model — combining government, regulators, industry, academia and civil society — and suggests a national AI stakeholder forum to manage consultations and technical working groups. For implementation sequencing the DCDT recommends setting up an AI coordination office and stakeholder forum early, followed by technical standards development and piloting in public-sector use-cases (DCDT Framework).

Key Focus Areas

The draft frames priority areas that will shape later regulation and programmes: (1) Rights, ethics and inclusivity — explicit protection of constitutional rights and measures against bias and discrimination; (2) Data governance and privacy — alignment with POPIA and better public sector data stewardship; (3) Risk management — tiering obligations according to system impact and mandatory AI impact assessments for high-risk use-cases; (4) Transparency and explainability — documentation requirements, model cards and provenance records; (5) Safety, security and robustness — testing, red-teaming and cybersecurity controls for models and infrastructure; (6) Public sector adoption — procurement safeguards and pilots for public-service efficiency, consistent with privacy and fairness safeguards; (7) Research, skills and localisation — investments in AI research, university hubs and workforce training; and (8) Standards, conformity and market oversight — development of technical standards and a roadmap for conformity assessment and registration where warranted. These pillars are designed to balance innovation with safeguards and to prioritise locally-relevant outcomes (jobs, inclusion, language diversity).

Implementation Framework

Implementation is envisaged as phased and coordinated: (A) institution‑building (AI coordination office and stakeholder forum); (B) standards and guidance (technical norms, model documentation templates and AI impact assessment templates); (C) piloting and public-sector adoption (targeted pilot projects with monitoring and open evaluation); (D) capacity building (education, reskilling and AI institutes); and (E) legal and regulatory design (drafting of enabling regulation or an AI Act for high-risk domains). The Framework recommends integrating procurement conditionalities (data access, transparency, rights protection) and establishing minimum documentation (model cards, data lineage records) for systems used by government and large-scale private platforms. Where existing laws apply (e.g., POPIA), the Framework directs agencies to ensure clarity and interoperability rather than duplication (DCDT).

Monitoring and Evaluation

Monitoring is proposed through a national M&E architecture led by the AI coordination office and informed by a set of core indicators: incidence of high‑risk deployments, compliance with AI impact assessments, documented harms and corrective measures, skills and capacity metrics, and public uptake of trustworthy AI services. The Framework recommends periodic public reporting, open repositories of impact assessments (with privacy-protecting redaction), independent audits for selected high-risk systems and a learning loop to refine policy instruments. It also suggests leveraging academic partnerships to undertake independent evaluations and commissioning public impact reviews for major public-sector AI deployments (UNESCO case study).

Penalties, Liability, and Appeals

Because the document is a draft, it outlines principles for liability and enforcement rather than fixed penalties. It proposes that high-risk deployments carry stricter accountability — including mandatory impact assessments, documentation and potential administrative sanctions — and that liability and redress pathways be clarified in subsequent legal instruments. The Framework recommends administrative fines, corrective orders, temporary suspension of deployments and procurement sanctions for non-compliance, while advising that criminal sanctions be reserved for wilful, malicious or reckless conduct. It also recommends accessible appeals and redress channels for affected individuals and an oversight role for existing institutions (e.g., the Information Regulator) for data-protection breaches (DCDT).

Relationship to Other Instruments

The Framework explicitly situates itself within South Africa’s constitutional order and the National Development Plan, and coordinates with laws such as the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA). It also notes interactions with competition policy, procurement law and sectoral regulators (for example communications and broadcasting regulators where platform/content issues arise). The Framework recommends that any future AI Act or secondary regulations be drafted to avoid conflict with POPIA and other sectoral statutes and that international standards and multilateral instruments inform domestic rule-making (Information Regulator (POPIA)).

International Alignment

South Africa’s draft Framework signals strong intent to align with international norms and standards — including the OECD Principles, the EU’s approach and regional initiatives like the African Union’s AI strategy — while retaining policy space to reflect local priorities (developmental, language and inclusion concerns). The document recommends participation in international standards bodies, adoption of interoperability-friendly technical standards and selective benchmarking against the EU AI Act for tiering high-risk systems. International cooperation is framed both as regulatory learning and as a route to secure access to research partnerships, capacity building and responsible investment (European Commission: AI policy).

Implementation Timeline

2024-08-14: Initial public release of draft Policy Framework.
2024-10-25: DCDT site listing and framework posting.
2024-11-29: Public consultation submission deadline on 2024 framework.
2026-03-25: Draft National AI Policy approved by Cabinet for public consultation.
2026-04-10: Draft National AI Policy published in Government Gazette No. 54477.
2026-04-26: Draft National AI Policy withdrawn by Minister Solly Malatsi following discovery of hallucinated citations.
2026-05: Independent National AI Expert Review Panel appointed to redraft the policy framework.

Sources and References