South Africa's Government Gazette formally retracted the Draft National AI Policy on June 12, 2026 — not on principled grounds, but because the officials who wrote it apparently used a generative AI tool to produce academic citations without verifying a single one. At least 6 of the document's 67 cited references were confirmed fabrications: articles attributed to the South African Journal of Philosophy, AI & Society, and the Journal of Ethics and Social Philosophy that the journals themselves confirmed had never existed. Two officials are now on precautionary suspension. Communications Minister Solly Malatsi called it "a failure of integrity." The ANC's parliamentary caucus was blunter still: "We cannot have an AI policy drafted by AI to regulate AI. It's a cycle of doom."
This is tragicomedy. It is also a serious governance failure with concrete implications for how South Africa — and, by extension, the continent — approaches the regulation of open source AI.
What the Retracted Policy Actually Proposed
Before writing the draft off entirely, it is worth understanding its substance. The document was ambitious: five strategic pillars covering responsible governance, ethical AI, cultural preservation, human-centred deployment, and capacity development. It proposed six new oversight structures — a National AI Commission, AI Ethics Board, AI Regulatory Authority, AI Ombudsperson, National AI Safety Institute, and an AI Insurance Superfund designed to compensate citizens harmed by AI in cases of uncertain liability. It aligned AI governance with South Africa's Protection of Personal Information Act (POPIA), requiring automated decision-making systems to comply with data protection obligations from the outset.
The strongest argument for this level of institutional ambition is that AI risks are real and evolving faster than existing regulatory bodies can track. A proactive multi-body framework offers flexibility to respond across sectors before harm accumulates.
But the draft also proposed mandatory watermarking of training data for large language models and cross-border data flow protocols to protect data sovereignty. These provisions had not been publicly debated. Their implications for open source AI developers — who release model weights and training datasets without necessarily being able to track every downstream use — went entirely unaddressed.
The Hallucination Problem Is Bigger Than One Government
The immediate scandal is the irony: a document governing AI was undone by the same failure mode it was meant to regulate. But the phenomenon is systemic. A Lancet study published in May 2026 — analysing more than 2 million academic papers and 97 million citations — found the rate of papers containing AI-hallucinated references rose from 1 in 2,828 in 2023 to 1 in 277 in just the first seven weeks of 2026. Fabricated citations are not primarily a government problem; they are a professional accountability problem that institutions everywhere have been slow to confront.
What is indefensible is that no one caught the fabrications before publication. The draft had cleared Cabinet approval on March 25, 2026 and been gazetted for public comment on April 10. Multiple layers of departmental review failed. Malatsi acknowledged that "AI-generated citations were included without proper verification," and promised consequence management for those responsible. The parliamentary portfolio committee suggested the department "skip using ChatGPT this time" when redrafting. That instinct is right. It is insufficient as a quality-assurance regime.
The Open Source Gap the Revised Draft Must Fill
Here is where the retraction carries forward-looking consequences beyond the embarrassment narrative.
South Africa's draft proposed a sector-specific, multi-regulator model — coordinating ICASA, the Information Regulator, the Competition Commission, and the CSIR through a National AI Regulatory Forum. That architecture is defensible: it builds on existing institutional capacity rather than creating a new superbody from scratch, mirroring approaches taken by the UK and Singapore. It avoids duplicating regulatory infrastructure that South Africa does not yet have the fiscal space to build.
But neither the retracted draft nor the public debate around it meaningfully addressed open source AI models. This matters for three reasons.
First, open source AI is not peripheral to South Africa's AI landscape — it is central to it. Models from Meta's Llama series and Mistral's open-weight releases are already deployed by local developers and researchers who cannot sustain API costs for proprietary models. African-language AI in particular depends on open source foundations that can be fine-tuned locally without commercial licensing.
Second, open source AI creates liability chains that closed-source governance frameworks don't address. When a proprietary model produces harmful outputs, a corporate entity bears accountability. When an open source model is downloaded, fine-tuned on local data, and re-deployed without a commercial intermediary, the accountability question becomes genuinely hard. The EU's AI Act has begun grappling with this through its treatment of open-weight models under the general-purpose AI provisions — drawing an explicit distinction that South Africa's framework entirely skipped.
Third, the proposed watermarking requirements for LLM training data raise specific questions for open source AI that need explicit policy attention: how is provenance tracked when a model is fine-tuned, merged with another open-weight model, and redistributed by a third party? A policy that mandates watermarking without specifying what that means for open source ecosystems creates compliance ambiguity that will chill local AI development rather than govern it.
The Stakes of a Nine-Month Delay
South Africa is not working in a policy vacuum. Google's first Cloud Summit on African soil, held in Johannesburg on July 1, 2026, brought together President Cyril Ramaphosa and senior Google executives to announce Africa's first applied AI lab, a new startup accelerator, expanded university AI education, and confirmation that Google surpassed its $1 billion Africa digital transformation commitment ahead of schedule. The investment thesis for South Africa as Africa's AI infrastructure hub is already being acted on.
A nine-month regulatory gap — the revised draft targets Cabinet by November 2026, with public comment pushed to January 2027 — is not fatal to that thesis. But it creates real uncertainty for developers, investors, and international partners who need to know how South Africa will treat open source AI models: whether they fall under proposed licensing tiers, how liability flows when fine-tuning introduces errors, and whether watermarking requirements apply to community releases or only to commercial deployments.
The November draft is an opportunity, not just a corrective exercise. A government that failed to verify AI outputs before publishing them is now, rightly, being held to a higher standard. The revised policy should commission independent expert review, draw a clear regulatory line between open source and proprietary AI, and build an institutional framework that is ambitious enough to protect citizens but realistic enough to survive contact with a constrained public sector. South Africa can still set the continental standard on AI governance. It just has to write it this time.