South Africa's effort to build a national artificial intelligence (AI) framework slid into a credibility crisis in April 2026, when the government withdrew its draft policy after fabricated academic references were discovered in the document. The episode laid bare the shortcomings in preparing a framework meant to guide the responsible adoption of a technology already reshaping business and public life.

Five months on, Communications and Digital Technologies Minister Solly Malatsi confirmed that disciplinary proceedings were under way against one suspended official, following the resignation of another over the scandal. “Having such a major stain on an important policy is something that cannot just be allowed to slide,” Malatsi told TechCabal on October 15.

Holding officials accountable, however, is only one part of the problem. South Africa's more fundamental AI governance test is whether its existing institutions can enforce the rules and protect people from harm. Strengthening current regulators rather than creating a dedicated AI authority could spare the country unnecessary bureaucracy, but it would also place a heavier burden on those institutions to investigate AI-related harms, coordinate enforcement and deliver redress. That choice mirrors a wider global debate: the European Union enacted a dedicated, cross-cutting AI law in 2024, while other governments continue to route AI oversight through existing sector regulators. Absent clear responsibilities, adequate resources and effective enforcement, a replacement policy risks amounting to a statement of intent rather than a framework that changes how AI is actually used.

Flexibility brings an AI enforcement challenge

The government expects Cabinet to finalise the replacement policy by the end of March 2027, with public consultation to follow.

Malatsi acknowledged the delay while speaking at CollectiveXChange 2026, South Africa's youth employment and digital skills summit, held in Johannesburg on October 15, describing the process as a “false start”. “Yes, it is very late, and that is the consequence of having a false start,” he said.

The regulatory approach itself is also evolving. Speaking at X Tech 2026, an event series hosted by law firm Bowmans on 21 October, Department of Communications and Digital Technologies Deputy Director-General Jeanette Morwane said the government was reviewing legislation affected by AI, including the Films and Publications Act and the Electronic Communications Act. The former governs the classification of films, games and certain online content, while the latter regulates communications networks and services.

Morwane indicated that the government favoured empowering existing regulators over establishing new institutions dedicated to AI oversight. Such an approach could build on regulators' sector-specific expertise in areas including financial services, communications and consumer protection. Yet distributing oversight across multiple institutions creates coordination problems whenever AI-related harm cuts across regulatory boundaries.

The replacement policy will need to specify which institution leads investigations, how regulators share information and how enforcement gaps will be closed. Existing mandates alone will not add up to a coherent system.

Consumers need more than ethical AI principles

The consequences of weak oversight reach directly into consumer protection, shaping how people access essential services and interact with automated business platforms.

At the Bowmans event, Heather Irvine, a partner at the firm, noted that banks and insurers routinely deploy machine learning to assess creditworthiness, detect fraud and price risk, while retailers and e-commerce platforms rely on automated personalisation to determine product visibility and pricing.

These applications can deliver efficiency gains, but they also raise questions about accountability when automated decisions produce harmful outcomes.

The risks are already visible in South Africa's financial sector. The South African Banking Risk Information Centre (SABRIC) recorded R2.4 billion ($143.8 million) in losses from digital banking crime in 2025, up from R1.9 billion ($113.8 million) the previous year. Separately, research from consumer credit agency TransUnion highlights how deepfake impersonation — synthetic audio, video or imagery generated with AI to mimic real people — and AI-enabled techniques are driving higher fraud sophistication across Africa.

Crucially, these figures do not isolate AI-enabled offences, exposing a key analytical gap: without dedicated data tracking AI-driven crimes, policymakers will struggle to evaluate the true scale of the threat or determine whether existing regulators are equipped to respond.

Can consumers challenge credit decisions influenced by AI? What recourse exists when personalised pricing disadvantages certain customers? Where can someone turn when AI-generated content causes harm?

Malatsi has argued that ethical AI adoption must include avenues for redress. “When we create a regime for the ethical use and ethical adoption of AI, where the use is not ethical, there's got to be an avenue for recourse,” he told TechCabal. The practical question is how the proposed framework will convert that commitment into remedies people can actually access.

National Consumer Commission acting commissioner Hardin Ratshisusu said existing legislation could potentially address AI-related fraud, misinformation and disinformation. But laws that may apply to AI-related harm do not automatically guarantee that regulators can identify violations, investigate complaints and deliver effective remedies.

The AI capacity question cannot be ignored

Morwane pointed to the operational strain facing existing bodies, citing one regulator where just two staff members were tasked with handling over 200 cases involving child sexual abuse material (CSAM).

That example does not establish that every South African regulator lacks the capacity to oversee AI. It does, however, illustrate why the government's chosen approach requires scrutiny.

Effective oversight demands technical expertise, investigative capacity and the ability to assess rapidly evolving systems. Regulators must also judge when existing laws are sufficient and when amendments or new enforcement mechanisms are needed.

The replacement policy should set out whether regulators will receive additional funding and technical support, how their responsibilities will be defined and how disputes over jurisdiction will be resolved. These are not minor implementation details — they will help determine whether the policy actually changes how AI is developed and deployed.

March is an AI milestone, not the finish line

The March 2027 target offers a milestone after the original draft's withdrawal, but publication alone will not restore confidence in South Africa's AI governance.

The replacement must combine principles for ethical adoption and the protection of human rights and dignity with a credible implementation framework — one that spells out clear institutional responsibilities, timelines, adequate resources and procedures for handling complaints and enforcing rules.

Public consultation will give businesses, researchers, civil society and consumers an opportunity to judge whether the framework addresses practical risks. An early signal to watch is whether the review of the Films and Publications Act and the Electronic Communications Act produces amendment legislation, which would show the government's AI oversight direction being written into enforceable rules.

South Africa has good reason to avoid unnecessary regulatory bureaucracy. But flexibility is no substitute for accountability, resources or enforcement.

The true test will be whether consumers can challenge harmful AI decisions, whether businesses understand their compliance obligations, and whether regulators possess the legal backing to penalise abuse.

South Africa's revised AI policy must go beyond repairing a flawed drafting process. It must demonstrate that when automated systems cause real-world harm, accountability extends past ethical pledges to institutions with the power, resources and legal mandate to intervene.