On the Documents We Have Not Read in the Age of AI

On the SA AI Policy withdrawal, the Lesotho cybercrime Bill, and the architectural question we need to answer.

By Lerato Mphaka

May 2026  ·  ~8 minute read

On the 27th of April, the South African Minister of Communications and Digital Technologies, Solly Malatsi, withdrew the country’s Draft National Artificial Intelligence Policy. The reason: the document — gazetted for public comment on the 10th of April, less than three weeks earlier — contained academic citations that did not exist. At least six fictitious references, according to News24’s reporting. Most likely AI-generated and likely never verified.¹

I have been thinking about this story since it broke, and want to introduce something beyond the headlines around the systems surrounding AI today.

The popular framing is that AI embarrassed a government. That is the version the international press picked up: another AI hallucination scandal, another ironic moment of a policy meant to govern AI being undermined by it.

The deeper tension we need to hold, that the Minister himself named in his own statement, is that AI  was allowed free rein. That there was little to no oversight by those responsible to provide it.

Humans drafted that policy. Humans inserted the citations, whether by drafting with AI assistance or by accepting AI output without checking. Humans approved it through Cabinet twice. On the 25th of March and the 1st of April. Humans signed off on the public Gazette.² Every one of those steps was a human checkpoint. Every one of those checkpoints sadly failed. The technology only put the bullet in the chamber. Cabinet pulled the trigger.

"The technology only put the bullet in the chamber. Cabinet pulled the trigger."

Mr Malatsi understood this. In the statement that accompanied the withdrawal, he did not blame AI. He focused on what he called vigilant human oversight — the lapse, he said, proves why that oversight matters.³ That is the line worth quoting. The line  that describes the system that failed.

I am writing this from Lesotho, where the same thing — different scale, same architecture — has not happened yet, but is waiting to.

We do not have an AI policy in Lesotho. We have a Bill: the Computer Crime and Cyber Security Bill, currently in its 2024 incarnation, tabled in the National Assembly in May of that year.⁴ It was previously dismissed in 2021 over procedural concerns and the exclusion of stakeholders. It has been in some draft or other since 2015, when generative AI as we know it did not yet exist in the mainstream outside research papers and proofs of concept.

So when the question is asked — and it is asked with increasing frequency, as it was to me on Ultimate FM this week — whether our legal framework can handle AI-generated harms targeting public officials, the honest answer requires us first to concede that the framework is a draft. And then to concede that the draft was written before the harms it is being asked to address.

The Bill, as it stands, contains broad provisions on “false information” and computer-related forgery that could in theory be stretched to cover synthetic media. It also contains, in Section 66, provisions authorising state agents to install remote surveillance tools on the devices of suspected cybercriminals — provisions that legal commentators have flagged as overboard and lacking the judicial oversight standard that constitutional rights would require.⁵

The Bill, in other words, is simultaneously under-equipped to address the new harms it claims to anticipate, and over-equipped with state powers that would not have been controversial fifteen years ago but should be controversial now.

I should pause here, because there is a serious counter-argument to the position I have been building, and Afternoon Papers is the wrong place to ignore serious counter-arguments.

The argument is that small ministries in resource-constrained governance environments like Lesotho, are expected to produce policy at a pace that has no relationship to their actual drafting capacity.

The South African Department of Communications and Digital Technologies is not a small ministry by African standards, but the argument persists across the continent. That argument is that

"AI tools are being adopted not because civil servants are lazy or careless, but because the volume of policy work expected of them outstrips the human resource available to do it."

The AU’s own Continental AI Strategy⁶ identifies capacity-building as a priority for precisely this reason. On this view, the lesson of the SA policy withdrawal is not that AI is unsafe in policy work. It is that AI is being adopted faster than the workflows around it have been redesigned. The fix is better AI SYSTEMS in my opinion — with reference-checking tools, citation databases integrated into drafting environments, and human-in-the-loop verification specifically designed for civil-service contexts. This is the position taken, in different forms, by researchers at the Future of Privacy Forum⁷ and at the AU High-Level Policy Dialogue on AI in Africa convened in 2025.⁸

I take this counter-argument seriously, and I want to be honest about where it has force and where I think it does not.

It has force on the diagnostic. African civil services are under-resourced, and that under-resourcing is a structural condition that any honest policy analysis must reckon with. It also has force on the prescription, narrowly: yes, better tooling and better workflows would reduce the rate of failures of the kind we have seen. I do not dispute either of these things.

Where I think the counter-argument fails is in what it lets us not talk about. The South African civil service is, by African standards, extraordinarily well-resourced. The Department of Communications and Digital Technologies is not a Lesotho-sized ministry. The policy in question went through Cabinet — not a junior drafting team — twice. If the failure was capacity, the capacity gap exists at the level of ministerial review, not at the level of paragraph drafting.

“Better AI tools” do not solve a Cabinet that approves documents nobody on the bench has read. The South African political opposition was direct on this: pinning the failure on a junior official, as the initial response from the Department came close to doing, was rejected by Parliament’s communications committee chair Ms Khusela Diko herself.⁹ The capacity-deficit framing protects the people who should not be protected.

There is also a deeper objection. The capacity argument treats AI as a productivity tool that has arrived neutrally and that civil services must learn to use better. It does not ask why African governments are being asked to legislate, in this decade, on a technology built by companies they do not regulate, trained on data they do not own, deployed on infrastructure they do not control. The capacity question is real. But it is downstream of the architectural question. We are being asked to govern faster than we can think for Africa as a whole — and the reason we are being asked to govern faster is that the architecting is happening elsewhere, on a clock we did not set.

Which is the point I want to come back to.

I want to set the Bill and the policy withdrawal aside for a moment, because focusing on it would be to make the same mistake of creating the headlines and not the discourse.

The legal text is not the architectural question. The architectural question — the one that runs underneath this entire conversation is 'who is doing the building.'

I have written before in this series about the difference between creating, building, and architecting. To create is to make. To build is to construct on someone else’s plan. To architect is to decide where the foundations go. When I look at the way Lesotho is being invited into the AI conversation — invited, not seated at the head of the table — I see a country being asked to legislate as users, regulate as victims, and ratify as latecomers. Not architect.

Lesotho is being asked to legislate as users, regulate as victims, and ratify as latecomers. Not architect.

Consider what AI is built on. Data. Most of which we do not control, most of which lives on servers we do not own, most of which was harvested from a continent that was not asked. All this computing potential is not sovereign and is rented from companies headquartered elsewhere. Cloud infrastructure is also in the same bracket.

The large language models being deployed across financial services, healthcare, and education in this region were trained on languages that are not ours, on assumptions that are not ours, with priorities that are not ours. We are asked to consent to the outputs. We are not invited to the inputs.

This is the part of the conversation that is missing from every panel I have been on, and it is the part that matters most in my opinion. It is also the part that , I keep returning to because fifteen years of building digital infrastructure inside Lesotho’s financial sector has taught me that the question of who owns the system always, eventually, becomes the only question that matters. You can write a beautiful law. You can convene a regional ethics framework. You can publish a policy. If the underlying computing logic, the underlying data, the underlying models all sit in jurisdictions where you have no leverage, the law is a  suggestion leaflet.

"If the underlying compute, the underlying data, the underlying models all sit in jurisdictions where you have no leverage, your law is a leaflet."

So when I am asked whether Lesotho should adopt a unified SADC AI ethics framework, I push back. Not because I am opposed to regional cooperation. Cooperation on infrastructure — shared compute, shared data centres, shared language model training in Sesotho, isiZulu, Setswana is overdue.

Cooperation on negotiating power, where small economies are stronger together against EU regulators and US export controls, is necessary. But cooperation on ethics, where what counts as fair and what counts as discriminatory must be informed by national constitutional context, is something else. Our Constitution is not South Africa’s. Our political history is not Mozambique’s. A regional ethics framework drafted under conditions where most of us are still building basic governance capacity will end up being an import from the bloc’s largest economy and in this specific context, it is a country that just withdrew its own policy because nobody read it.

There is a final thought I want to leave on the table, briefly, because it deserves its own essay and will get one. The conversation about AI risk in Africa is overwhelmingly framed as a conversation about ministers — political deepfakes, election interference, official disinformation. The peer-reviewed evidence is that around ninety percent of malicious deepfakes globally are non-consensual intimate imagery, and around ninety percent depict women.¹⁰ 

The victims are not, in the main, ministers. They are ordinary women, including in Lesotho. Any AI policy that frames the harm primarily as a threat to public officials has, before it is even drafted, decided whose harm matters. That is its own architectural failure, and I will write about it next.

For now, though, here is what I keep returning to.

A government in our region withdrew a policy on the technology it was supposed to govern, because the technology had been allowed to draft the policy without supervision, by humans who were supposed to be doing the supervising. The lesson is a real tension.

• That AI is dangerous if it is treated as a thing that happens to us, rather than a thing we are responsible for architecting.

• Ironically perhaps, that the future of AI guard railing will be human engineers in all spheres, not just software.

— LM

Afternoon Papers is a monthly essay series on women, ownership, and the digital economy, published at leratomphaka.com.

Notes & sources

1.  News24, “Malatsi withdraws AI policy tainted by fictitious references,” 26 April 2026. The original investigative reporting that surfaced at least six fabricated references in the gazetted draft.

2.  South Africa, Government Gazette, 10 April 2026, publishing the Draft National AI Policy for public comment, with submissions due 10 June 2026. Cabinet approval dates per the official statement issued by the Department of Communications and Digital Technologies.

3.  Malatsi, S. (Minister of Communications and Digital Technologies, South Africa), public statement on the withdrawal of the Draft National Artificial Intelligence Policy, 27 April 2026. Reproduced verbatim by SAnews.gov.za, “Minister announces withdrawal of draft AI Policy.”

4.  National Assembly of Lesotho, Computer Crime and Cyber Security Bill, 2024, tabled May 2024. The 2021 dismissal is documented in MISA Lesotho’s public commentary and in the Civicus Monitor entry on Lesotho civic-space developments, October 2024.

5.  Afriwise legal commentary, “Balancing National Security and Digital Rights: A Critical Appraisal of Section 66 of Lesotho’s Computer Crime and Cyber Security Bill,” 2024. The commentary argues that Section 66 lacks a probable-cause threshold, judicial-warrant requirement, and independent oversight mechanism.

6.  African Union, Continental Artificial Intelligence Strategy, adopted August 2024. Phase One implementation period: 2025–2026. Capacity-building is one of the five strategic pillars.

7.  Future of Privacy Forum, “The African Union’s Continental AI Strategy: Data Protection and Governance Laws Set to Play a Key Role in AI Regulation,” November 2024. The FPF analysis emphasises capacity development as a precondition for effective national AI governance frameworks across AU member states.

8.  African Union, Communiqué of the High-Level Policy Dialogue on the Development and Regulation of AI in Africa, Addis Ababa, May 2025. The Dialogue's published outcome statement identifies tooling and workflow capacity as central to responsible AI adoption in African public administration.

9.  CNBC Africa, “South Africa pulls AI policy after hallucinated citations expose drafting scandal,” April 2026, citing Khusela Diko (Chair, Parliamentary Portfolio Committee on Communications and Digital Technologies) and the wider parliamentary response to the Department’s initial framing of the failure.

10.  The 90% / 90% figures are well-established in the deepfake harms literature. See: “Threat of deepfakes to the criminal justice system: a systematic review,” Crime Science (Springer Nature), 2024. See also Sensity AI’s State of Deepfakes reports (2019–2024) for the underlying time-series data on which the systematic review draws.