Signal Desk
Five briefs, rewritten for today
Drafts prepared for editorial review. Every factual claim cites a source below the piece. Opinion is limited to the “Why it matters” line.
DraftPolicy DeskReplaces “South Africa’s AI Policy Draft: What It Actually Says”
South Africa’s AI policy was withdrawn over fake citations. The redo is due by March 2027.
Cabinet approved the draft National AI Policy for publication on 25 March 2026, and it was gazetted on 10 April for public comment until 10 June. On 26 April, Communications Minister Solly Malatsi withdrew it. His department found “various fictitious sources” in the reference list. He called the most plausible explanation “AI-generated citations” included without proper verification.
Cabinet approved the withdrawal (announced 5 June) to allow a rework. In a reply to Parliament recorded by PMG, the minister said an Expert Review Panel is assessing the withdrawn policy and its research, with the aim of submitting a revised policy to Cabinet by March 2027. Consequence management against implicated officials has begun. In May, Reuters had reported a target of January 2027; the later reply gives March 2027.
Why it matters: the country now has no national AI policy in draft, and the lapse became an argument for human review of AI-assisted work.
DraftPolicy DeskUpdates “Rwanda’s AI Push Is Real”
Rwanda gives AI its own agency
On 8 June 2026 a Cabinet meeting chaired by President Paul Kagame approved a National Artificial Intelligence Agency, which Kigali Daily News describes as Rwanda’s first institution dedicated to AI. It is to speed up AI development, innovation, adoption, investment and governance. According to iAfrica, it takes over responsibilities held by the AI Office inside the Ministry of ICT and Innovation, and its mandate covers research, skills, ethics, industry growth and international partnerships.
It builds on the 2023 National AI Policy, which rests on five principles: beneficence, non-maleficence, autonomy, justice, and explicability. UNESCO’s country profile (September 2026) still lists limited labelled data, talent shortages and regulatory gaps as constraints.
Why it matters: Rwanda is moving from policy to an institution that can be held to delivery. The test is whether the agency is funded and staffed to match its mandate.
DraftCompute DeskUpdates “The Compute Sovereignty Gap”
Africa’s compute problem is power, not announcements
Kilwa Research’s first Atlas (30 August 2026) puts Africa’s operating data-centre capacity at roughly 360 MW, about 0.6% of the global total (it cites ADCA, March 2026), and finds power has replaced connectivity as the binding constraint. It notes Morocco alone carries close to 2 GW of announced projects against that 360 MW operating base.
Deals keep coming. On 27 August Bloomberg reported that MTN and Dubai investor Tarek Al Ashram will develop AI data centres through Africa Data Hub Holding Ltd. In April BusinessDay reported that ODC, an AI networking start-up backed by Nvidia, Cisco and MTN, had raised $45 million in Series A funding. A 19 October analysis argues the continent is building capacity faster than it is creating demand. Demand forecasts are large: McKinsey expects four- to six-fold growth to 1.5-2.2 GW by 2030, as cited by HSF Kramer.
We have removed our earlier claim that more than 90% of Africa’s compute is controlled by foreign hyperscalers. We could not source it.
Why it matters: “Sovereign compute” is in practice a negotiation over contract terms, data residency and skills, as Kilwa puts it, rather than independence.
DraftMarkets DeskUpdates “Nigerian Fintech’s Quiet AI Revolution”
Nigeria’s central bank now expects banks to automate anti-money-laundering with AI
On 10 March 2026 the Central Bank of Nigeria issued Baseline Standards for Automated AML/CFT/CPF Solutions. KPMG reads them as mandating automated solutions supported by AI, machine learning and advanced analytics. Institutions had to submit implementation roadmaps by 10 June 2026. Deposit money banks must finish deployment, integration and testing by 10 September 2027, and other financial institutions by 10 March 2028.
Law firm Allen & Brooks argued on 29 September that responsibility for AI-driven decisions stays with the institution that deploys the system, not the algorithm. A Fintech Regulatory Commission Bill, proposed in 2025, would create a single licensing gateway, according to the Chambers practice guide.
Why it matters: regulation here is pushing AI into compliance first, with accountability left with the deploying bank or fintech.
DraftPolicy DeskUpdates “Kenya’s Data Protection Act: Three Years On”
Kenya’s data regulator is getting teeth
On 14 April 2026 the Office of the Data Protection Commissioner held LOLC Kenya Microfinance Bank liable for publishing a former employee’s images and personal details in public notices without consent or a lawful basis. Law Lab Africa reports the ruling recommends action tied to named directors for obstruction, and sets a 14-day deletion deadline. In February the High Court registered an ODPC compensation award as a court order (Muthoni v Africa International University), giving complainants a way to enforce awards.
Fines continue: the ODPC ordered Brainstorm Insurance Brokers to pay KES 1.01 million (April report). On 4 June it warned eligible entities to register as data handlers or processors or face fines up to KSh5 million. On AI regulation, Africa AI News reported on 16 October that a Kenyan Senate committee rejected a controversial AI regulation Bill.
Why it matters: enforcement is now backed by collection and personal exposure for directors. The enforcement record is no longer just paper.
DraftData & Sovereignty DeskNew
FNB fined R1 million: an app glitch exposed 88 home-loan applicants
South Africa’s Information Regulator issued an enforcement notice and an infringement notice against FNB, dated 21 October 2026 and published on 23 October, with an administrative fine of R1 million. ITWeb reports the notice found the personal information of 88 data subjects, including nine account numbers, was exposed to 696 unauthorised individuals through a mobile-app glitch.
Why it matters: POPIA enforcement is reaching large banks and carrying fines, not just notices. Earlier in 2026 the Regulator also issued enforcement notices to Central Johannesburg TVET College (May) and SABS (August).