South Africa is accustomed to leading the continent on technology. We host cloud regions from Google, Microsoft and Amazon Web Services. Our largest banks are among Africa's most advanced adopters of artificial intelligence (AI).
So the finding of a new continental index, published in July, deserves more attention than it has had: South Africa ranks eleventh in Africa on its capacity to govern any of it, behind Rwanda, Nigeria, Benin, Kenya, Morocco, Egypt, Ethiopia, Ghana, Mauritius and Tunisia, and level with Zimbabwe.
A ranking we helped produce
The Africa AI Governance Index, published by the Nairobi-based Lawyers Hub, scores all 54 African states across eight weighted pillars, running from strategy and regulation through infrastructure, human capital and ethics to implementation and impact.
It rests on 80 indicators per country, compiled by 97 policy fellows into more than 4 000 evidence-linked observations, and every country workbook is published openly for scrutiny.
This is not a scorecard imposed from outside. It is grounded in the African Union's Continental AI Strategy, and it was launched in Geneva at the inaugural UN Global Dialogue on AI Governance, in a collaboration that included South Africa's own Human Sciences Research Council.
Governance capacity matters in proportion to what there is to govern, and SA carries more exposure than any country above it.
Rwanda leads with 3.25 points out of four, followed by Nigeria on 2.81 and Benin on 2.58. Those three are the only states the index classifies as having established AI governance. South Africa scores 2.10.
Infrastructure widens gap rather than closing it
It is tempting to dismiss such a ranking as a measure of paperwork rather than capability. That has it backwards. Governance capacity matters in proportion to what there is to govern, and South Africa carries more exposure than any country above it.
Africa holds under 1% of global data centre capacity, while housing 18% of the world's population, and the index notes that what capacity exists is concentrated in South Africa, Egypt, Kenya, Nigeria and Morocco.
In July, Google announced at its Africa Cloud Summit in Johannesburg that it had exceeded its $1 billion African investment commitment, while our banks and retailers push AI into credit, pricing and customer decisions at national scale.
Rwanda governs a smaller AI economy more capably than we govern a larger one. That is not a compliment to Rwanda's modesty. It is a statement about where the unmanaged risk on this continent actually sits.
How the vacuum opened
The cause is documented and recent. On 10 April 2026, the Department of Communications and Digital Technologies published the Draft South Africa National AI Policy for public comment. Within a fortnight, News24 established that several of the academic sources cited in the document did not exist.
Minister Solly Malatsi withdrew the policy on 26 April, and the withdrawal was gazetted on 12 June, with as many as six AI-hallucinated references at issue and two officials placed on precautionary suspension.
The department has set out a recovery path: revised documents to Cabinet by November 2026, with publication for comment targeted for January 2027. The minister has cited the need to minimise a prolonged policy vacuum, which is the right instinct and also a concession. For now, we have no dedicated AI policy at all.
There is an uncomfortable symmetry here that should not be hurried past. A policy intended to govern the responsible use of AI was undone by the unverified use of AI. The failure was not technological. Nobody checked.
The gap is implementation, not intention
Here the index offers something more useful than a league table. Every African sub-region scores highest on strategy and lowest on implementation.
Around 15 states have adopted national AI frameworks and 24 more are drafting them, yet few have ring-fenced budgets, independent oversight bodies, or any means of monitoring whether their commitments are met.
South Africa sits in that second group. Our difficulty has never been a shortage of ambition or of capable people, but a habit of treating the writing of a document as the completion of the work. An AI policy without a funded regulator, without staff able to assess a high-risk system, and without a means of measuring compliance is a statement of intent, not a governance framework.
President Cyril Ramaphosa has himself argued that there is "a need for guardrails to prevent abuse and other risks". Guardrails are institutions. They are not paragraphs.
What this means for boards, not just government
It would be convenient to file this as somebody else's problem. It is not. Where the state is absent, private governance becomes the operative regime, and every organisation deploying AI at scale is writing its own rules with no external standard to write them against.
Two things follow for boards. Deferred regulation is not absent regulation: it arrives later, applies to systems already in production, and costs far more to retrofit than to design for.
And meanwhile, AI here is governed through existing, pre-AI law, chiefly the Protection of Personal Information Act, alongside consumer protection, copyright and cyber crime legislation. Those obligations are live today.
Eleventh place is not a verdict on South African capability. It is a mirror held up to a country that built the infrastructure first and has still not decided who will govern it.
The revised policy goes to Cabinet in November. The question worth asking between now and then is whether we intend to arrive with a document, or with the funded institutions that would make one mean something.
Further reading on ITWeb:
SA's draft AI policy officially retracted
Malatsi withdraws SA's draft national AI policy
Two officials suspended over botched draft AI policy
Government sets target for 'revised' AI policy
MPs question minister's handling of revised AI policy
Sovereignty AI: The real test of SA's AI strategy
The CIO's case for South Africa's AI governance model
Parly chairperson touts 'adaptive' regulatory regime
AI adoption exposes governance gaps as organisations race to keep up
Share
