I began my session at the Oxford AI and Media Policy Summer Institute (which, in 2026, was organised for the first time in collaboration with Wits University’s SA-UK Chair in Digital Humanities) by asking the room to get on its feet and choose a side.
While the opportunity to stand was taken by some as a useful break from the monotonous nature of conferences, the request was obviously met with a bit of confusion and reluctance which was less a reflection on the participants themselves, but more so, a reflection of suspended curiosity.
Once the cobwebs were shaken off, I asked the participants to picture themselves setting the procurement rules for South Africa’s next biometric verification system, then cross to one side of the floor if their priority was opening the field to local technology firms, and to the other if it was buying from the supplier with the longest track record of delivering systems like it.
It was clear that some realised the trap that was being set as most sought to settle on choosing the local supplier. Then I shifted the line and asked again, build slow and sovereign, or fast and dependent.
The tension was evident in the room despite the mild stakes, as the question began to offer the participants a glimpse into the conundrum that African states are navigating in real time - the nuances of which are largely unaddressed by current policymaking debates.
A second provocation was introducing participants to the idea that the state is becoming a platform, but in two, very different ways.
In the first, government-as-a-platform, the state lays down common digital rails, identity, payments and data exchange, while allowing others to build public and economic value on top. In the second, platform-as-government, the state increasingly runs on infrastructure, software and firms it does not control, until the platform becomes the means through which authority is exercised rather than the ground others stand on. The former is an enabling architecture, while the latter is dependency wrapped in the language of sovereignty.
The rise of “digital public infrastructure”, or DPI, as a catch-all has folded these two into a single hopeful story, which presents troubling questions.
South Africa has adopted the vocabulary of digital sovereignty and public-interest infrastructure while the infrastructure actually going into the ground is largely foreign-owned, demand-driven and governed by laws written for a pre-AI economy.
By the middle of 2025 the country hosted around 56 data centres and the largest share of Africa’s hyperscale capacity, with more than R50 billion (roughly USD 3.08 billion) in further investment committed over three years.
But the number of servers tells us little on its own. If this infrastructure is as critical as electricity, as is often quipped, then questions like who is obliged to serve everyone, who sets the price, who mandates local content, and who can govern, audit and, if it comes to it, replace the people running the grid should lead debate.
To its credit, the state is building. Under Operation Vulindlela II it has set up a Digital Service Unit inside the Presidency, modelled on the United Kingdom’s Government Digital Service and the United States Digital Service, and set itself four foundational DPI builds between 2025 and 2030. These are a digital ID, a data exchange platform, a payments platform and a single public-services platform in the mould of Rwanda’s Irembo.
This initiative represents a level of coordination that the fragmented systems of the past could never manage. Yet choices like how identity is structured, who holds the data and which standards lock in, are effectively proxies for how state power will be organised for future generations.
Some form of central coordination is necessary. However, we should all be concerned by how centralised control impacts the extent to which architecture can be opened, reproduced and moved by the people it is meant to serve, or whether it calcifies into something only the appointed vendor can run.
The language of sovereignty needs to become more sophisticated and demand more. The reflex tends towards simplistic framings of foreign ownership and sovereign control as opposites, so that locally owned reads as sovereign and foreign-owned as captured. In reality, no state, however loudly it claims digital self-sufficiency, truly is. We all depend on chips, cloud, code and expertise sourced globally, and pragmatically, complete autarky is neither realistic nor desirable.
A foreign firm can, in fact, build a data centre or run a cloud network while the state keeps architectural control, governs the data, holds interoperability and retains the ability to change suppliers. That might correctly be defined as a partnership. It is also evident that what might appear to be a sovereign system will stay mired in dependency if its software is proprietary, its expertise sits offshore, its architecture cannot be rebuilt at home and replacing the vendor will lead to ruin.
Now, South Africa’s stack of written rules for the game is fairly thin, due in part to political dynamics. Technology governance here is rhetorically urgent, while decidedly not electorally consequential. So DPI matters tend to be handled as technical issues that will find their own level rather than be closely monitored and hotly contested political choices.
Meanwhile, it is largely two external influences that fill the gap by setting up the game and shaping terms of engagement. First, harmonisation in the form of Europeanisation – where African data-protection laws end up drawing overwhelmingly from the European Union’s (EU) GDPR lineage. This is largely in service of acquiring the “adequacy” standard that unlocks foreign investment. And second, China’s Digital Silk Road diligently shapes procurement, even as that country supplies much of the underlying hardware.
Our own instruments remain a dense, incohesive stack. There is the Malabo Convention, which took from 2014 to 2023 to travel from adoption to entry into force, and 21 African nations still have no domestic law on digital or data governance to speak of. Those countries lack even the basic legal mechanisms to assert a right to inspect a cloud provider’s systems, migrate an identity platform, or read their own data without the vendor’s assistance. This state of affairs underlines the importance of pinning down emerging distinctions between data, compute and algorithmic sovereignty, as increasingly, holding one is no guarantee of holding the others.
So as South Africa and the continent move towards the African Union’s 2063 horizon, I would be gratified to see an end to gauging digital transformation progress by empty, vanity metrics like servers counted, citizens connected, skills trained or localisation mandated, as though those things somehow settle the sovereignty question.
Better connection does not equal better government. The harder question is whether the state can learn to govern differently enough that this infrastructure becomes part of its own capacity rather than a lever held by someone else.
I left the room in Oxford with more questions for further shared reflection than answers, and one question in particular which I want to end with. When the state looks at data, what does it think it’s peering at: an economic asset, a public good, a national strategic resource or a human right?
I sense that we have never quite decided, and as we stand paralysed by indecision or preoccupied with more pressing matters that sway electoral outcomes in the short to medium term, the architecture we are absent-mindedly investing in as the digital backbone of African futures will almost certainly decide for us.
And, in the digital state, whoever gets to define what constitutes public value, what good looks like as far as delivering said value, or both, will in the end, define the state itself.
Government-as-a-platform versus platform-as-government is a distinction I'll be borrowing. What makes it hard is that procurement rarely sees the shift happen: each contract looks like a sensible buy, and only the sum becomes dependency. Would requiring an exit path and key-custody assessment before each major award be a realistic first step for South Africa, or does the capacity to do that assessment also sit with the vendors?