What is AI regulation in Vanuatu?
AI regulation: countries and regions
Vanuatu has no specific AI law. It regulates artificial intelligence through general digital and data laws. In 2025 it passed a Digital Transformation Act requiring all ICT service providers - including those using AI - to obtain annual permits. In 2024 it enacted a Data Protection and Privacy Act granting citizens rights over automated decision-making. In practice, AI use must comply with existing ICT, privacy and cybersecurity rules and international ethical standards.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
Vanuatu does not yet have a dedicated AI statute or national AI strategy. Instead, AI-driven tools and services are treated like other digital technologies. The government's focus has been on broad digital transformation and privacy. In 2025 it created a Digital Transformation Department and passed a law requiring tech companies (including AI firms) to register and follow digital rules. In 2024 it also passed a data protection law that, among other things, gives people the right not to be subject to major decisions made solely by algorithms.
Because there is no standalone AI law, organizations must follow existing regulations when using AI. This means any AI system handling personal data is covered by privacy rules, and any AI service provider must meet ICT licensing requirements. Vanuatu is also part of international and regional digital forums. For example, it worked with the Council of Europe to draft its first privacy law, and as a UNESCO member it has committed to the global AI ethics principles set out in the 2021 UNESCO Recommendation. These frameworks guide how AI should be used responsibly, even if there is no local law called an "AI law."
Why it matters
For businesses, governments and citizens, understanding Vanuatu's approach to AI is crucial. Without a specific AI law, companies cannot assume AI is unregulated; instead they must comply with general tech rules. A domestic AI or tech firm needs an ICT Service Permit and must follow the Digital Transformation Act's conditions. Anyone using AI must obey the Data Protection Act - for example, individuals denied a benefit by an AI must be offered human review. Policymakers should note Vanuatu aligns with international AI ethics and privacy standards, meaning AI deployments will be held to global human rights and fairness norms. Compliance with these rules avoids penalties (the Digital Act allows fines up to 20 million Vatu) and builds trust in AI solutions across the islands.
How it works
No Dedicated AI Law (Horizontal Regulation)
Vanuatu has not passed any AI-specific legislation. Instead AI systems are governed under its general ICT, cybercrime and privacy laws. For example, the Cybercrime Act (2021) targets illegal online behavior broadly, and the e-commerce strategy and Digital Government Roadmap encourage digital business, but none mention AI explicitly. AI deployments fall under these existing frameworks. A recent survey of Pacific Island states noted that as of 2024 Vanuatu had "no active AI strategy or policy". In other words, AI governance is horizontal: covered by broader tech rules, not a standalone regime.
Digital Transformation Act (2025) and ICT Permits
In December 2025, Vanuatu enacted the Digital Transformation Act (No. 42 of 2025). This law places the Department of Communications and Digital Transformation at the centre of digital policy and requires all ICT service providers to hold annual permits. Crucially, one class of permit is specifically for "artificial intelligence (AI) and AI-related data services". Any company offering AI-powered tools to Ni-Vanuatu businesses or citizens must apply for that permit. The Act also creates a National Digital Steering Committee to oversee tech strategies, including AI initiatives. Enforcement powers include inspections and fines: officers can search premises and penalize non-compliance (up to Vt20 million). In practice, this means an AI startup in Port Vila must register under the Act and adhere to its conditions and oversight.
Data Protection and Privacy (2024)
Vanuatu's first Data Protection and Privacy Act (No. 13 of 2024) came into force as part of its digital modernization push. It applies broadly to all processing of personal data in both public and private sectors, inside or outside Vanuatu. The law gives individuals rights to access, correct or delete their data, and specifically includes a right "not to be subject to automated decision making" that significantly affects them. This means any AI system that makes important decisions about people (such as loan approvals or insurance quotes) must allow human review if requested. The Act also controls cross-border data transfers: personal data "generated or collected in Vanuatu" is covered even if processed abroad. Together, these rules implicitly regulate AI by protecting personal data and requiring transparency in automated systems.
Digital Safety Authority and Regulators
To oversee these new laws, Vanuatu created a Digital Safety Authority in 2024 (Digital Safety Authority Act No. 15 of 2024). The Authority is led by a Commissioner with deputies responsible for different domains. Notably, one Deputy Commissioner is dedicated to Data Protection and Privacy, meaning that a new regulator enforces the privacy law. Another Deputy Commissioner handles harmful digital communications (misinformation, harassment, etc.). While not AI-specific, these roles provide a structure for oversight of AI use (through data protection) and potential AI-related abuse (under harmful communications). Additionally, the Telecommunications & Broadcasting Regulator continues to manage telecom spectrum and internet infrastructure, which indirectly affects any AI service that relies on internet connectivity.
International and Regional Commitments
Vanuatu aligns with international AI ethics and digital norms. As a UNESCO member state, it is bound by UNESCO's 2021 Recommendation on the Ethics of Artificial Intelligence, a global standard emphasizing human rights, transparency, fairness and human oversight. Though not a domestic law, this Recommendation guides policy and was explicitly endorsed by Vanuatu. The country also engaged the Council of Europe for help drafting its data law, aiming to harmonize with global best practice. Regionally, Vanuatu participates in Pacific tech forums and connectivity initiatives (e.g. Smart Islands with the ITU) which stress digital inclusion and security. While no Pacific-wide AI regulation exists yet, Vanuatu's digital strategy is informed by these cooperative efforts, suggesting future AI governance will be shaped by both national law and shared regional principles.
Examples
- A local fintech startup offering AI-driven credit scoring would fall under the ICT permitting system. Under the Digital Transformation Act it must apply for an "AI and AI-related data services" permit and renew it annually. The company would pay fees, demonstrate compliance, and submit to audits. If the startup's AI decisions impact borrowers, it must also comply with the privacy law's requirement to allow human appeal on decisions. Failing to get a permit or breaching data rules could lead to fines or shutdown by the regulator.
- A government health agency deploying an AI diagnostic tool would navigate multiple rules. While there is no specific health AI law, the Digital Health Strategy (2025-2030) explicitly calls for expanding data protection rules to health data. In practice, patient data used by the AI must comply with the Data Protection Act (secure processing, patient consent, etc.). The agency would coordinate with the Digital Transformation Department for any public sector ICT compliance and follow health data guidelines once issued. This example shows how sectoral applications of AI in Vanuatu rely on general data laws and future regulations tailored by sector (as the health strategy suggests).
- An overseas AI cloud service accessing Vanuatu user data must pay attention to the Data Protection Act's scope. If Vanuatu citizens' personal data is stored or processed abroad as part of the AI service, those activities are subject to Vanuatu law. The service provider must ensure adequate data safeguards and possibly register with Vanuatu's data authorities. This means even foreign AI companies must follow Vanuatu's privacy rules for Vanuatu data, similar to GDPR-type extraterritorial requirements.
Common misunderstandings
- **"Vanuatu already has an AI law."** In fact, Vanuatu has no stand-alone AI legislation. The government has focused on broad digital laws; any AI system falls under those general rules, not a separate AI statute.
- **"If it's not called 'AI', it doesn't apply."** Wrong. Technologies like machine learning are covered by existing ICT and privacy laws. For example, the Data Protection Act explicitly covers any automated decision that affects people, so AI-driven decisions are regulated even without an "AI law."
- **"Companies can ignore ethics because there's no AI law."** No, Vanuatu is signatory to international ethics frameworks. It adopts UNESCO's AI ethics recommendation principles and follows global norms on data privacy and cybercrime. Businesses should treat AI ethics as part of compliance, not optional.
- **"AI activities are completely unregulated here."** Not true. An AI service provider must comply with the Digital Transformation Act's permit system. Failing to register or adhere to conditions can lead to enforcement. So AI is not a free-for-all.
- **"Data protection only matters for foreign firms."** No, the new Data Protection Act applies to all processing in Vanuatu, and even foreign companies processing data of people in Vanuatu. It isn't limited to big tech; any organization using personal data in AI must abide by it.
Risks and boundaries
Vanuatu's AI regulation framework is minimal and evolving. Currently, there is no concept like the EU AI Act or ASEAN AI guidelines. Policy uncertainty means organisations may underestimate compliance needs. For instance, local startups might not realise they need a digital permit, or foreign services might ignore Vanuatu's privacy law until enforcement actions begin. Also, rules like the data law apply to any algorithmic processing of personal data, but there's no explicit framework for AI safety, bias or standards yet. People must not confuse the Digital Transformation Act's scope - it governs ICT operations (like licenses and infrastructure) but does not certify the quality or fairness of AI systems. Similarly, the Harmful Digital Communications Act could potentially apply to AI-generated misinformation, but this has not been tested.
Where the law is unclear, international norms help fill gaps. Vanuatu follows human-rights based AI principles, which limit misuse (for example, no AI should violate privacy or due process). Still, a risk is that organisations assume "no law = no rules," potentially leading to privacy breaches or unethical AI. In summary: AI projects must stay within the boundaries of Vanuatu's digital permits, privacy protections and anti-cybercrime laws. Any new AI-specific policies would likely arise from these foundations.
What to do next
Organisations should treat Vanuatu's general tech laws as encompassing AI. They should ensure any AI-driven product or service complies with the Data Protection Act (obtaining user consent, enabling data subject rights, especially for automated decisions) and secure the required ICT permit from the Digital Transformation Department. Leaders should engage early with regulators: for example, consult with the Digital Safety Authority on privacy plans, and with the Communications department on licensing.
Policymakers and business executives should monitor ongoing developments. The government is building digital capacity and may update regulations (especially sectorally, as in healthcare). It is wise to build internal AI governance aligned with UNESCO's ethical principles - e.g. by adopting fairness and transparency reviews - since these are already expected. Joining Pacific ICT forums or working with tech partners (like the Kazakhstan MOU suggests) can provide expertise. Finally, leaders should invest in staff training on data and AI ethics, so that even in a light-regulation environment, their AI systems respect local norms and anticipate future rules.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
**Is there a specific law for AI in Vanuatu?**
No. Vanuatu does not have a dedicated AI law or strategy. AI use is governed by general technology and privacy laws (see Digital Transformation Act and Data Protection Act).
**Who oversees AI and digital technologies in Vanuatu?**
The Department of Communications and Digital Transformation leads technology policy. A new Digital Safety Authority handles data privacy and online safety. The Telecommunications Regulator oversees networks. They work together to apply the existing digital laws to AI services.
**Do companies need a licence to offer AI services?**
Yes. Under the Digital Transformation Act (2025), any ICT provider (including AI tool providers) must hold an annual permit. There is a specific "AI and AI-related data services" permit category. Operating without a permit risks penalties.
**Are there rules on personal data used by AI?**
Yes. The Data Protection and Privacy Act (2024) covers all personal data processing. It gives individuals rights (access, correction, deletion) and bars automated decisions that significantly affect them without recourse to a human. AI systems using personal data must comply with these privacy rules.
**What if an international AI service uses Vanuatu user data?**
Vanuatu's privacy law applies even to foreign companies processing data of people in Vanuatu. Cross-border transfers need safeguards. Foreign AI firms must respect Vanuatu's data protections if they serve Ni-Vanuatu users.
**Does UNESCO or international law affect Vanuatu's AI?**
Yes. Vanuatu has signed onto UNESCO's 2021 AI ethics Recommendation, which emphasizes human rights, transparency and oversight in AI. While not a domestic law, these principles influence Vanuatu's approach. The country also follows global standards like those in its new data law (based on Council of Europe guidance).
**What happens if an AI system breaks the rules?**
If an AI service is offered without the required permit or violates data/privacy laws, regulators can enforce penalties. The Digital Transformation Act allows enforcement officers to inspect systems and fine offenders (up to 20 million Vatu). Data breaches or illegal AI-driven acts could trigger enforcement under the privacy or cybercrime laws.
**Will Vanuatu update its AI laws soon?**
No AI-specific bills have been announced yet. However, Vanuatu is actively modernizing its digital laws and policies. Stakeholders should watch the new regulators and digital strategy for any guidance or standards related to AI in the future.