Global Internet Rules Rewritten for the First Time in 25 Years

2026-07-30 companies

New York, Thursday, 30 July 2026.
For the first time in 25 years, internet authorities updated foundational governance rules, establishing landmark powers to evict failing regional address registries and safeguard critical infrastructure.

Governance Overhaul After 25 Years

On July 28, 2026, the Address Supporting Organization Address Council (ASO AC) delivered the Recommended Draft of the RIR Governance Document (version 3) to the NRO Executive Council, concluding a three-year drafting process [4][6]. This update replaces Internet Coordination Policy-2 (ICP-2), which was adopted on June 4, 2001, and had served as the foundational charter for the five Regional Internet Registries (RIRs) for 25 years [4]. The previous framework lacked explicit, enforceable procedures for addressing RIR failure, a structural gap exposed by the institutional capture and governance dysfunction of AFRINIC which began in 2022 [4]. The new document establishes a full lifecycle framework including recognition, operation, and derecognition, mandating Anti-Capture principles and Ecosystem Stability obligations for AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC [4].

Enterprise Continuity Frameworks Emerge

In response to these systemic shifts, the Number Resource Society (NRS) announced an enhanced member support framework on July 29, 2026, designed to assist enterprise network operators in managing governance and continuity risks [1]. This initiative targets organizations that manage internet number resources as business-critical infrastructure capital, encouraging a shift from passive registry dependency to active management [1]. Concurrently, LARUS announced the launch of Continuity Assurance on July 29, 2026, a service framework aligning IPv4 leasing with the operational requirements of enterprise production workloads [2]. LARUS categorizes these offerings into four service levels, ranging from IPv4 Capacity Only to Continuity Critical, which guarantees renewal and P1 support [2].

IPv4 Scarcity Drives Leasing Models

The urgency for such frameworks is underpinned by resource scarcity, as ARIN reported the depletion of its IPv4 free pool on September 24, 2015, and residual pools across all RIRs were effectively depleted by December 31, 2021 [5]. Data center operators utilize IPv4 for critical infrastructure including dedicated servers, APIs, and legacy applications, often employing dual-stack infrastructure to maintain connectivity despite long-term migration strategies toward IPv6 [5]. Leasing IPv4 addresses allows data centers to convert capital expenditures into operating expenses, aligning address capacity costs with actual customer demand [5]. However, operators face operational risks such as routing changes and IP reputation issues, which new continuity frameworks aim to mitigate [2][5].

Legitimacy and Future Governance

Parallel to corporate adjustments, heng.lu released a new policy framework on July 29, 2026, emphasizing thin technical coordination and resource-level portability to ensure network continuity [3]. This framework proposes that registry functions be limited to objective technical requirements while excluding commercial decisions from registry control [3]. Furthermore, a working paper titled The Governance Stress-Test Doctrine for Internet Institutions was released on July 29, 2026, arguing that institutional survival is often mistaken for legitimacy [8]. The doctrine posits that legitimacy is infrastructure that must be designed and tested, distinguishing between continuity of service and the authority by which it functions [8].

Sources

IPv4 Governance Network Infrastructure