South Africa's Draft National AI Policy is set for a 60-day public consultation in March 2026. The Department of Communications and Digital Technologies has confirmed that the policy will serve as a broad framework, with sector-specific strategies to follow from 2027/2028. Instead of creating a single AI regulator, the government will distribute oversight across existing authorities, such as ICASA for digital infrastructure and communications, embedding AI governance within established supervisory frameworks.
This approach contrasts with the EU AI Act's comprehensive regime. For your regulatory affairs team, AI compliance will integrate with your existing regulatory relationships, such as POPIA for data protection and prudential standards for financial institutions. Your current regulator will also become your AI regulator.
Multi-Regulator Model
South Africa's choice of a multi-regulator model over a centralized AI authority is significant. The Draft AI Policy outlines five core pillars: capacity development, responsible governance, ethical and inclusive AI, cultural preservation, and human-centered deployment. However, it leaves sector-specific implementation to existing regulators within their current mandates.
The policy has cleared the Socio-Economic Impact Assessment System certification and achieved Director-General cluster concurrence, indicating broad inter-departmental support. Finalization is targeted for the 2026/2027 financial year, with sector strategies following in 2027/2028.
Key Implications
Existing regulators will enforce AI obligations within their current scope. Instead of a new AI regulator, authorities like ICASA will incorporate AI oversight into their existing mandates. This means financial services firms will face AI scrutiny from prudential regulators, healthcare providers from health authorities, and telecoms operators from ICASA. Your compliance calendar will expand the remit of the regulator you already report to.
High-impact systems face explainability and accountability requirements. The policy explicitly rejects "black box" deployment in high-impact contexts. Organizations remain responsible for AI-driven outcomes, regardless of automation level. This mirrors principles in King V corporate governance recommendations but extends them to algorithmic decision-making. If your AI system affects credit decisions, insurance underwriting, or service eligibility, expect your regulator to ask how you explain denials and who's accountable when the model produces harm.
Bias mitigation focuses on local dataset representation. The policy highlights "imported bias", discriminatory outcomes when AI models trained on Global North datasets are applied to South African demographics. It calls for training systems on representative local data and holding developers accountable for harmful outcomes. If you're deploying vendor models trained elsewhere, your regulator will likely ask how you validated the model against South African populations and what bias testing you conducted before deployment.
Sector-specific strategies will address distinct risk profiles. AI in healthcare presents different considerations than AI in financial services or public administration. Sector strategies will tailor requirements to regulatory realities and risk exposures in each industry. The overarching policy sets principles; your sector regulator will define what those principles mean for your specific use cases.
Data protection obligations will intersect with AI governance. The policy positions AI oversight as an extension of existing frameworks, including POPIA. Your data processing impact assessments will need to cover algorithmic processing, not just storage and transmission. If your AI system processes personal information to make decisions about individuals, you're already subject to POPIA's lawful processing requirements. The sector strategy will clarify how those requirements apply to model training, inference, and automated decision-making.
Preparing Your Team
You're not starting AI governance from scratch. You're extending your existing compliance program to cover algorithmic systems. The regulator who reviews your risk management framework, conduct obligations, or data protection controls will add AI deployment to their supervisory agenda.
This creates both constraint and opportunity. The constraint: you can't wait for a dedicated AI compliance team or budget. AI governance needs to fit within your current regulatory reporting, internal audit schedule, and board risk committee agendas. The opportunity: you already have relationships with your regulator, established reporting channels, and institutional knowledge of how they interpret obligations. Use that foundation.
If your organization deploys AI in customer-facing decisions, credit assessments, or automated service delivery, those systems likely qualify as high-impact under the policy's human-centered deployment pillar. Start documenting how decisions are made, who reviews model outputs, and what recourse customers have when they dispute an outcome.
Action Items by Priority
Before March 2026: Inventory your AI deployments and classify them by impact level. High-impact systems, those affecting individual rights, access to services, or eligibility for benefits, should receive immediate attention. Document the business purpose, data sources, model type, decision-making role, and human oversight for each system. This inventory will form the basis of your public consultation submission and your internal governance framework.
During the 60-day consultation: Submit comments focused on your sector's specific risk profile and existing regulatory obligations. If you operate under prudential standards, explain how AI risk management should integrate with operational risk frameworks. If you're subject to conduct regulation, address how explainability requirements should apply to customer-facing algorithms. Early engagement may influence how your sector regulator interprets the overarching policy.
By mid-2026: Map AI governance to your existing compliance frameworks. If you maintain a POPIA compliance program, extend your data processing inventory to include model training datasets and inference activities. If you report to a prudential regulator, incorporate AI systems into your operational risk register and model risk management framework. If you're subject to King V, update your board reporting to include AI deployment oversight and accountability structures.
Before 2027/2028 sector strategies: Establish explainability mechanisms for high-impact systems. Document how your models reach decisions, what features drive outcomes, and how you test for bias against South African demographics. If you're using vendor models, obtain documentation on training data, validation testing, and known limitations. Your regulator will likely ask these questions once sector strategies are finalized.
Ongoing: Monitor ICASA and your sector regulator for guidance on AI oversight within their existing mandates. Regulatory expectations will emerge through supervisory letters, industry consultations, and enforcement actions before formal sector strategies are published. Don't wait for final regulations to start aligning your AI governance with regulatory principles.
