South Africa’s AI regulation problem is bigger than its delayed policy

South Africa’s attempt to establish a national framework for artificial intelligence (AI) suffered a credibility crisis in April 2026, when the government withdrew its draft policy after fabricated academic references were discovered in the document.

The incident exposed failures in preparing a framework intended to guide the responsible adoption of a technology already reshaping business and public life.

Five months later, Communications and Digital Technologies Minister Solly Malatsi confirmed that disciplinary proceedings were ongoing against one suspended official, following the resignation of another over the scandal.

“Having such a major stain on an important policy is something that cannot just be allowed to slide,” Malatsi told TechCabal on October 15.

But holding officials accountable is only part of the challenge.

South Africa’s bigger AI governance test is whether its existing institutions can enforce the rules and protect people from harm. Strengthening existing regulators rather than creating a dedicated AI authority could avoid unnecessary bureaucracy, but it would place greater responsibility on institutions to investigate AI-related harms, coordinate enforcement, and provide redress. Without clear responsibilities, adequate resources and effective enforcement, a replacement policy risks becoming a statement of intent rather than a framework that changes how AI is used.

Flexibility brings an AI enforcement challenge

The government expects Cabinet to finalise the replacement policy by the end of March 2027, with public consultation to follow.

Malatsi acknowledged the delay at the CollectiveXChange 2026 summit, South Africa’s youth employment and digital skills event, in Johannesburg on October 15, describing the process as a “false start”.

“Yes, it is very late, and that is the consequence of having a false start,” he said.

The regulatory approach is also evolving. At the X Tech 2026 event series hosted by law firm Bowmans on 21 October, Department of Communications and Digital Technologies Deputy Director-General Jeanette Morwane said the government was reviewing legislation affected by AI, including the Films and Publications Act and the Electronic Communications Act.

Morwane indicated that the government favoured empowering existing regulators over establishing new institutions specifically to oversee AI.

That approach could build on regulators’ sector-specific expertise in areas such as financial services, communications and consumer protection. But distributing oversight across institutions creates coordination challenges when AI-related harm crosses regulatory boundaries.

The replacement policy must clarify which institution leads investigations, how regulators share information and how enforcement gaps will be addressed. Existing mandates alone will not guarantee a coherent system.

Consumers need more than ethical AI principles

The consequences of weak oversight extend directly to consumer protection, influencing how individuals access essential services and interact with automated business platforms.

At the Bowmans event, Heather Irvine, a partner at the firm, noted that banks and insurers routinely use machine learning to assess creditworthiness, detect fraud, and price risk, while retailers and e-commerce platforms rely on automated personalisation to determine product visibility and pricing.

These applications can improve efficiency, but they also raise questions about accountability when automated decisions produce harmful outcomes.

The risks are already visible in South Africa’s financial sector. The South African Banking Risk Information Centre (SABRIC) recorded R2.4 billion ($143.8 million) in losses from digital banking crime in 2025, up from R1.9 billion ($113.8 million) the previous year. Furthermore, research from consumer credit agency TransUnion highlights how deepfake impersonation and AI-enabled techniques are driving higher fraud sophistication across Africa.

However, these figures do not isolate AI-enabled offences, pointing to a key analytical gap: without dedicated data tracking AI-driven crimes, policymakers will struggle to evaluate the true scale of the threat or determine whether existing regulators are equipped to respond.

Can consumers challenge credit decisions influenced by AI? What happens when personalised pricing disadvantages certain customers? Where can someone turn when AI-generated content causes harm?

Malatsi has argued that ethical AI adoption must include avenues for redress.

“When we create a regime for the ethical use and ethical adoption of AI, where the use is not ethical, there’s got to be an avenue for recourse,” he told TechCabal.

The practical question is how the proposed framework will turn that commitment into accessible remedies.

National Consumer Commission acting commissioner Hardin Ratshisusu said existing legislation could potentially address AI-related fraud, misinformation and disinformation. But laws that may apply to AI-related harm do not automatically ensure regulators can identify violations, investigate complaints and deliver effective remedies.

The AI capacity question cannot be ignored

Morwane highlighted the operational pressure facing existing bodies, citing one regulator where just two staff members were tasked with handling over 200 cases involving child sexual abuse material (CSAM).

That example does not establish that every South African regulator lacks the capacity to oversee AI. It does, however, illustrate why the government’s approach requires scrutiny.

***Digital banking fraud highlights the challenge of protecting consumers as AI-enabled scams become more sophisticated. Photo: Unsplash***

Effective oversight demands technical expertise, investigative capacity and the ability to assess rapidly evolving systems. Regulators must also determine when existing laws are sufficient and when amendments or new enforcement mechanisms are needed.

The replacement policy should clarify whether regulators will receive additional funding and technical support, how their responsibilities will be defined, and how disputes over jurisdiction will be resolved. These are not minor implementation details: they will help determine whether the policy changes how AI is developed and deployed.

March is an AI milestone, not the finish line

The March 2027 target offers a milestone after the original draft’s withdrawal, but publication alone will not restore confidence in AI governance.

The replacement must combine principles for ethical adoption and the protection of human rights and dignity with a credible implementation framework. That means clear institutional responsibilities, timelines, adequate resources and procedures for handling complaints and enforcing rules.

Public consultation will give businesses, researchers, civil society and consumers an opportunity to assess whether the framework addresses practical risks.

South Africa has a reason to avoid unnecessary regulatory bureaucracy. But flexibility cannot substitute for accountability, resources or enforcement.

The true test will be whether consumers can challenge harmful AI decisions, businesses understand their compliance obligations, and regulators possess the legal backing to penalise abuse.

South Africa’s revised AI policy must do more than repair a flawed drafting process. It must demonstrate that when automated systems cause real-world harm, accountability extends beyond ethical pledges to institutions with the power, resources, and legal mandate to intervene.

AI-generated photographs in Nigeria’s preliminary voter register raise a question that goes beyond the technology used to create them: how did suspicious entries get into a database meant to establish who can vote? Ahead of the 2027 general election, the controversy puts the Independent National Electoral Commission’s (INEC) verification procedures, access controls, and accountability under scrutiny—not simply its ability to detect synthetic images.

The preliminary register lists more than 103 million voters, up from approximately 93 million in 2023. While INEC attributes this surge to new registrations, persistent questions surrounding anomalous records have intensified demands for a clearer accounting of how raw records are checked—and who bears responsibility when systemic irregularities slip through.

Speaking on ARISE News, Clement Nwankwo, director of the Policy and Legal Advocacy Centre (PLAC), challenged the register’s credibility, pointing to alleged AI-generated photographs and unexplained statistical surges in registered voters. His concerns underscore a broader institutional test for INEC: removing dubious entries is only a starting point; the commission must demonstrate that its entire pipeline for collecting, verifying, and auditing electoral data is robust and trustworthy.

Responding to these criticisms on 30 October, Lawrence Bayode, INEC’s director of information and communication technology (ICT), stated that the commission was working to address irregularities ahead of releasing the final register on 15 December 2026.

However, Bayode’s explanation exposed a deeper operational vulnerability: some suspicious entries were inserted directly by registration officers holding authorised access to INEC’s core database.

Bayode acknowledged that registration officers across multiple states introduced irregularities into the system, encompassing both AI-generated imagery and flawed registration conduct.

“They have access to register people,” Bayode said, noting that the commission flagged these discrepancies during automated biometric identification system (ABIS) checks.

This admission complicates the narrative that generative technology is the primary culprit behind vulnerabilities in voter lists. While generative AI simplifies the creation of synthetic visuals, the core issue identified by INEC stems from insider privileges—the individuals authorised to operate registration terminals and the governance controls surrounding their access.

This breakdown raises critical questions regarding internal oversight: how are registration officers monitored in real time, what validation rules are run before data is committed to the master database, and why were suspicious records not quarantined before reaching the public preliminary register?

The incident also highlights the boundaries of automated safeguards. While biometric algorithms can detect duplicate prints or abnormal features, their efficacy depends on the integrity of the submitted data, effective workflow design, and rigorous follow-through on flagged anomalies.

INEC has yet to specify how many AI-generated photos or invalid entries were detected, how many officers were implicated, or what disciplinary or legal actions have been initiated. Without these details, public stakeholders cannot accurately gauge the scale of the compromise or evaluate whether existing safeguards are sufficient to restore trust.

A bigger register and a transparency problem

INEC reported registering over 11 million individuals during its Continuous Voter Registration (CVR) drive for the 2027 polls. Automated biometric checks subsequently purged roughly 1.2 million invalid entries, thereby adding over 9 million voters to the 93 million recorded in 2023.

*A sample of the voter register containing multiple duplicate entries. Image source: INEC website*

According to Bayode, the automated filtering yielded the preliminary total of more than 103 million voters.

Yet the significant expansion has fueled public concern, particularly because observers and electors continue to identify glaring errors within the published rolls.

The issue extends beyond numerical growth to whether citizens can independently scrutinise data updates and verify INEC’s methodologies. Public transparency is paramount given statutory publishing mandates and the discrepancies already uncovered.

Under Section 19(1) of the Electoral Act, INEC is required to publish and display the preliminary voter register on its website and at every registration ward and local government office at least 90 days prior to an election. With Presidential and National Assembly elections set for 16 January 2027, the statutory deadline fell on 18 October 2026. Section 20 further obligates the commission to publish the final register at least 30 days before polling, following the claims, objections, and de-duplication process—establishing a mid-December 2026 deadline.

INEC missed the 18 October digital publishing deadline, making the preliminary register available online on 26 October—just 81 days before the election. While the commission argued that physical displays at ward centres from 9 to 15 October satisfied its obligations, physical displays alone fail to fulfil Section 19(1), which explicitly mandates both physical and online availability. This delay compressed the window for public audit and raised valid questions regarding statutory compliance.

The public review phase has further highlighted system discrepancies. Bayode acknowledged receiving complaints concerning missing voter records, clerical errors, and unreflected address transfers. While INEC assured the public that these issues are under review prior to the final publication, resolving individual claims solves only part of the problem. Voters also require transparency around investigation workflows, verification standards, and audit trails.

This scenario illustrates a fundamental principle of digital election management: external crowdsourcing can surface defects, but it cannot replace institutional internal controls. Nor can public scrutiny restore faith without clear visibility into how errors are rectified and prevented.

INEC’s AI ambitions face a governance test

These developments unfold as INEC expands its technological footprint and formulates policies to govern artificial intelligence across its operations.

Bayode stated that the commission currently limits AI deployment to low-risk functions, such as public-query chatbots and logistics planning for election materials, emphasising that these tools do not affect core electoral results.

INEC is also finalising a formal AI governance framework ahead of the 2027 polls to establish operational boundaries for automated tools and ensure human oversight over sensitive decisions.

Additionally, the commission established a specialised AI division within its ICT department and engaged with regional initiatives focused on the responsible deployment of AI in elections.

While these steps indicate awareness of technical risks, the voter register controversy highlights why governance cannot focus exclusively on software tools. Governance must address how human operators interact with systems, how user privileges are audited, and how accountability is enforced when internal controls fail.

Bayode pledged to release the AI policy guidelines publicly. Publishing these rules would enable political parties, civil society organisations, and voters to independently evaluate INEC’s operational safeguards.

Trust will depend on what INEC fixes

INEC’s commitment to purge synthetic imagery and resolve data discrepancies before 15 December represents a critical test of its operational responsiveness ahead of 2027.

Yet cleansing the register addresses only the symptom. To rebuild lasting trust, the commission must disclose how rogue data bypassed system checks, identify the institutional vulnerabilities, and detail the technical mechanisms implemented to prevent recurring compromises.

The ongoing dispute reinforces a key reality of digital governance: digitising processes does not inherently guarantee credibility. While technology can streamline administration and flag anomalies, weak access governance and inadequate oversight risk replicating—and amplifying—the very flaws digital tools were deployed to solve.

For INEC, the imperative ahead of 2027 is not merely deploying sophisticated software but proving that the human and technical systems safeguarding Nigeria’s elections are secure, transparent, and fully accountable.

Ultimately, electoral integrity rests not just on the volume of corrupt entries removed, but on whether citizens can trust the pipeline through which their data is collected, verified, and secured.