2026-07-13 · Article
How a National AI Policy Was Withdrawn
An incident report on the process failure that sank South Africa's draft National AI Policy, and the one-page checklist that would have caught it.
For the Record: AI Governance Tools for SA Boards, Article 1 of 4
About this series. Every article in For the Record ends with a document you can file: a checklist, a questionnaire, a template, a memo format. Not commentary about governance, but the instruments of it. One deadline note before we start, because every law firm in the country is about to write the same client alert: parts of the EU AI Act become enforceable on 2 August 2026, including chatbot disclosure and AI-content labelling, and the much-reported postponement of high-risk obligations to December 2027 did not defer them. If your output reaches EU users, read that alert when it arrives. This series is about the four things that will still matter long after this fortnight's headlines have moved on.
On 10 April 2026, South Africa's draft National AI Policy was published in the Government Gazette for a sixty-day public comment period. It proposed a new AI governance ecosystem: a regulatory authority, an ethics board, an ombudsperson. Sixteen days later, with the comment period barely begun, the policy was withdrawn.
Not amended. Not extended. Withdrawn, less than three weeks into the sixty-day window it had just opened.
The reason had surfaced days earlier, while the comment period was still running: reviewers checked the draft's reference list and found citations that did not exist. At least six of the sixty-seven references were fictitious, attributed to real journals whose editors confirmed, independently, that those articles had never been published. The minister called it "an unacceptable lapse" that "compromised the integrity and credibility of the draft policy," and said the most plausible explanation was that AI-generated citations had been included without verification. The document will be revised and reissued for comment; at the time of writing, no timeline has been announced.
This article is not about who was at fault, and it names nobody. It is an incident report, in the way aviation treats incidents: what failed, where the process gap was, and what control would have caught it. Because the uncomfortable part for every board reading this is that the same gap is open, right now, in most organisations' own document flow.
What actually failed
Strip the story of its politics and a clean sequence remains.
A document was drafted. Somewhere in that drafting, a tool or a person produced citations with the surface features of real scholarship: plausible authors, plausible journals, plausible years. Nobody at any subsequent stage independently verified that the cited works existed. The document then passed every remaining checkpoint on its way into the Government Gazette: internal review, legal review, sign-off, publication. Each checkpoint evidently assumed a prior checkpoint had done the verification. None had.
That is the entire failure. Not a technology failure, a verification failure. Fabricated citations are what a large language model produces routinely and confidently when asked for references; the behaviour is so well documented it has its own name. The moment machine-generated text can enter a document pipeline, an unverified reference list stops being a quality issue and becomes a structural risk. The draft policy's own subject matter makes the point better than any consultant could: the document proposing algorithmic accountability for the country was itself an unaudited algorithmic output, at least in part, and academics reviewing the withdrawal asked publicly whether the literature review had been machine-drafted at all. No answer was required. The gap is the same either way.
Why this is a board story, not a government story
It is tempting to file this under government embarrassment and move on. That would be a mistake, for three reasons.
First, the exposure is universal. Every organisation now has staff using generative tools to draft board packs, tender responses, credit memos, legal summaries, marketing claims and policy documents. Ask yourself the incident-report question: in your document flow, at which named step does a human verify that AI-assisted content is factually grounded before the document leaves the building? If the answer is "our people check their own work," you have the same control the policy had.
Second, the accountability has moved to you. King V, effective for financial years beginning on or after 1 January 2026, places data, information and technology governance, explicitly including the ethical and risk-managed use of AI, on the governing body. Not on IT. A fabricated-content incident in a published prospectus, a regulatory filing or a client deliverable is now a question directors answer, under a duty of care and skill that the Companies Act has always imposed and King V has now made unmistakably AI-shaped.
Third, the reputational mechanics are asymmetric. The draft policy took months of framework-building to reach the Gazette and about two days of citation-checking to fall out of it. Verification is cheap. Its absence is not.
The control that catches it
The discipline is not "use AI less." The policy's failure would have been caught by one page of process, applied at the last checkpoint before publication: treat every machine-assisted claim and every reference as untrusted until a named human has verified it against a source, and record who verified what.
That is the same principle we apply to AI agents in our governance work: content is untrusted by default, and verification is somebody's name in a log, not a culture statement. Below is the checklist version, sized for a board pack, a tender, a filing or a published policy. It takes fifteen minutes on most documents. It would have taken less than that to save this one.
The artefact: the AI-Output Vetting Checklist
File this. Apply to any document leaving the organisation where AI assisted the drafting. One named owner per document; the checklist is complete when every row carries initials.
| # | Check | How | Done by |
|---|---|---|---|
| 1 | AI involvement declared | The drafter has stated where machine assistance was used (drafting, summarising, references, data tables) | |
| 2 | Every citation exists | Each reference resolved to the actual source: DOI, journal page or document, opened and sighted, not searched-and-assumed | |
| 3 | Every citation says what we claim | The source actually supports the sentence citing it, checked against the source text | |
| 4 | Quoted figures traced | Each number traced to its origin document; no figure inherited from the AI draft unverified | |
| 5 | Names, titles and entities verified | People, organisations, laws and case names confirmed real and correctly attributed | |
| 6 | Claims of law checked by a qualified reader | Any statement of legal obligation reviewed by someone competent to check it, with POPIA interaction considered where personal information is processed | |
| 7 | Adverse-scenario read | One reviewer has read the document asking "if this is wrong, who is harmed and who answers for it" | |
| 8 | King V accountability named | The director or delegated executive accountable for this document's integrity is identified by name before release | |
| 9 | Verification recorded | This completed checklist is filed with the document version it certifies | |
| 10 | Escalation honoured | Any row that cannot be initialled stops release until resolved; nobody waives a row under deadline pressure |
Rows 6 and 8 are the South African rows. Row 10 is the one that separates organisations that have a checklist from organisations that have a control.
For the record
A national policy document failed at the exact discipline it was written to promote, and the correction was swift, public and expensive. The revised policy will arrive within months and will be better for the scrutiny. The question this incident leaves on every boardroom table is narrower and more useful than the headlines suggested: when machine-drafted text enters your pipeline, whose name is on the step that catches what the machine made up?
If nobody's is, you now have the page to fix that.
Sources: Draft South Africa National AI Policy, published in the Government Gazette 10 April 2026 for a sixty-day comment period; withdrawal and ministerial statement, 26 April 2026, via SAnews, TechCentral and CNBC Africa reporting; News24 investigation into fabricated and misattributed citations (at least six of sixty-seven references), April 2026, with independent confirmations from the editors of the cited journals; University of the Witwatersrand academic commentary on the withdrawal; King V Code on Corporate Governance, Institute of Directors South Africa, October 2025, Principle 10 (data, information and technology governance), effective for financial years beginning on or after 1 January 2026; Companies Act 71 of 2008, section 76; Tech Sight, TechSight TAG framework (Guardrails pillar: untrusted-by-default content verification), techsight.co.za.
Book the two-hour diagnostic