AI Regulation Tracker / Draft policy

South Africa gazettes draft AI policy built on POPIA and existing regulators, not a single AI Act

The Department of Communications and Digital Technologies gazetted a Draft National Artificial Intelligence Policy, signaling sector-embedded oversight coordinated across the Information Regulator, ICASA, the Competition Commission, SARB, and the FSCA rather than one standalone statute. The comment window has since closed and the draft was reportedly withdrawn for revision.

By Anthony Guerriero · Reviewed by The Leveraged Years Editorial Desk · Published July 7, 2026 · Last updated July 7, 2026

South Africa gazettes draft AI policy built on POPIA and existing regulators, not a single AI Act regulation briefing

The Leveraged Years AI Regulation Tracker

Regulatory Briefing

Bindingness: Non-Binding Framework
Scope: South Africa. Cross-sector, with named emphasis on finance, telecommunications, competition, and data protection.
What Changed: The Department of Communications and Digital Technologies published the Draft National Artificial Intelligence Policy in Government Gazette No. 54477, General Notice 3880, dated April 10, 2026, for public comment. The draft proposes a sector-embedded governance model coordinated through a national regulatory forum, anchored on the Protection of Personal Information Act. It does not create binding obligations.
Who This Affects: Firms operating in South Africa that build or deploy AI, POPIA compliance officers, and regulated entities in financial services, telecommunications, and other sectors already supervised by a statutory regulator.
Current Status: Proposed. Draft for public comment; reported to have been withdrawn for revision after publication.
Effective Date: Comment closed June 10, 2026. Finalization targeted for financial year 2026/27.
Primary Source: Department of Communications and Digital Technologies, Draft National Artificial Intelligence Policy, Government Gazette No. 54477, General Notice 3880, https://www.gov.za/sites/default/files/gcis_document/202604/54477gen3880.pdf
Secondary Analysis: Michalsons, DLA Piper, and ITWeb commentary on the draft and its status.
Workflow Impact: Compliance teams should treat POPIA and their sector regulator, not a hypothetical AI Act, as the near-term source of AI obligations in South Africa.
Operational Next Step: Inventory AI systems by data type and supervising regulator, and prepare a submission for the revised draft when the department republishes it.
Last Verified: July 7, 2026

South Africa has set out how it intends to govern artificial intelligence, and the answer is not a single AI Act. On April 10, 2026, the Department of Communications and Digital Technologies published its Draft National Artificial Intelligence Policy in Government Gazette No. 54477, General Notice 3880, opening the text for public comment. The draft describes a model that runs AI oversight through laws and regulators the country already has, coordinated centrally rather than replaced by one new statute.

A draft, not a law

This is a policy document for consultation, not an enforceable instrument. It creates no offences, no penalties, and no filing duties. Its function is to state the government's intended direction and to invite submissions before that direction is fixed. The department set the comment window to close on June 10, 2026, and targeted finalization for the 2026/27 financial year. Firms should read the draft as a signal of where obligations will come from, not as a rulebook that binds them today.

POPIA as the anchor

The clearest structural choice in the draft is its reliance on the Protection of Personal Information Act. Because most consequential AI systems process personal data, POPIA already reaches a large share of AI activity in South Africa through its rules on lawful processing, purpose limitation, and automated decision-making. The policy builds outward from that existing law rather than starting from a blank sheet. For a compliance officer, that means the first AI governance question in South Africa is a POPIA question: what personal data does the system use, on what lawful basis, and with what safeguards.

Many regulators, coordinated

Rather than a dedicated AI regulator, the draft proposes coordinating the bodies that already supervise their sectors. It names the Information Regulator for data protection, the Independent Communications Authority of South Africa for telecommunications and broadcasting, the Competition Commission for market conduct, the South African Reserve Bank for financial stability, and the Financial Sector Conduct Authority for financial-services conduct. The draft envisions a national forum to align these regulators so that AI oversight is consistent across sectors. A bank deploying a credit model would answer to financial supervisors and to the Information Regulator, not to a single new agency. The design keeps expertise close to each sector, but it also means a firm may face more than one regulator for the same system, and the forum is meant to reduce the friction that overlap creates.

What it does not do

The policy does not import the European Union's risk-tier structure, and it does not create a licensing regime for AI systems. It does not, in draft form, impose conformity assessments or registration. Professionals should avoid reading obligations into it that the text does not contain. Its weight is directional. It tells the market which regulators to expect and which existing statutes will carry the load. That restraint is deliberate, and it gives firms time to build governance around laws that are already in force.

Read the status carefully

The procedural history matters. This April 2026 gazette is the version the department put forward for comment, distinct from earlier iterations. Legal commentators, including Michalsons and DLA Piper, have reported that the department subsequently withdrew the draft for revision after publication, with a reworked version expected to return for comment. That reporting should be treated as attributed rather than confirmed here. Either way, the strategic content stands: the government has shown its preferred architecture, and stakeholders who engage the revised text can still influence how it is written.

For a United States firm operating in South Africa, the takeaway is practical. There is no South African AI Act to comply with, and the near-term compliance surface is POPIA plus the sector regulator that already governs the relevant activity. The draft previews a coordinated, sector-embedded approach that many jurisdictions are testing as an alternative to a single horizontal law.

Frequently Asked Questions

What did South Africa actually publish?

The Department of Communications and Digital Technologies published a Draft National Artificial Intelligence Policy in Government Gazette No. 54477, General Notice 3880, on April 10, 2026, for public comment. It is a proposed policy framework, not a binding law, and it proposes governing AI through existing statutes and regulators.

Who is affected by this?

Firms operating in South Africa that build or use AI, POPIA compliance officers, and entities already regulated in sectors such as finance and telecommunications. Because the model relies on existing regulators, most affected organizations already fall under at least one of the named authorities.

Is this the same as the EU AI Act or a South African AI Act?

No. The draft deliberately avoids a single standalone AI statute. It anchors AI governance in the Protection of Personal Information Act and coordinates sector regulators, including the Information Regulator, ICASA, the Competition Commission, SARB, and the FSCA, through a national forum.

Can firms still shape the rules?

The initial comment window closed on June 10, 2026. Reports indicate the department withdrew the draft for revision, so a further consultation on a revised version is expected. Organizations that prepare submissions now will be positioned to comment when the department republishes.

What should a compliance team do first?

Inventory AI systems by the personal data they process and by the sector regulator that already supervises the activity, then assess each against current POPIA obligations. That work is useful regardless of the draft's final wording.