LexLint.ioBeta

Know the law your code answers to.

Law / Vanuatu

Digital Transformation Act 2025, ICT service permit for AI and AI-related data services

Digital Transformation Act No. 42 of 2025 (Vanuatu), s. 13(l)

In force since .

An AI governance rule binding public and private bodies.

Enforcement body
Director of the Department of Communications and Digital Transformation
Obligation class
Licensing, Governance
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • Before carrying on business as a provider of artificial intelligence or AI-related data services in Vanuatu, apply to the Director of the Department of Communications and Digital Transformation for an ICT service permit in that class, and pay the prescribed annual permit fee.
  • Comply with any condition the Director imposes on the permit, and cooperate with an enforcement officer's inspection, information request, or search warrant, since a serious breach can suspend the permit and stop all operations, and providing the service without a valid permit is a criminal offence.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
NIST AI 600-1
NIST AI 200-2 Draft
  • 2.3Apply & Measure
  • 4.3Composing a TEVV Toolbox
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI09Human-Agent Trust Exploitation
MIT mitigations Draft
  • 1.1Board Structure & Oversight
  • 1.2Risk Management
  • 3.5Post-deployment Monitoring
  • 4.1System Documentation
  • 4.2Risk Disclosure
  • 4.4Governance Disclosure
FINOS AIGF
ETSI EN 304 223
  • 5.1.4-1Capability for human oversight designed in and maintained.
  • 5.2.1-1Full inventory of assets, including their dependencies and connections.
  • 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
  • 5.4.2-1Operators log system and user actions.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Section 31(1) makes carrying out an ICT activity, including providing AI or AI-related data services, without a valid permit an offence punishable on conviction by a fine of up to VT3,000,000 or up to 3 years' imprisonment for an individual, or a fine of up to VT20,000,000 for a body corporate; section 31(2) applies the same penalty to any other contravention of the Act.

Penalty structure

Section 31(1) (carrying out an ICT activity without a valid permit) and section 31(2) (any other contravention of the Act) each cap an individual's fine at VT3,000,000, with up to 3 years' imprisonment, or both, and a body corporate's fine at VT20,000,000. Lesser offences in section 31 (obstructing the Director, giving false information, obstructing a search warrant) cap an individual's fine at VT3,000,000 or 3 years' imprisonment. The Act states these amounts in Vanuatu vatu (VT).

Rule
Fixed only
As of
Currency
VUV
Fixed cap
20,000,000

What it makes you log

Logging duty

Section 13(l) names the AI and AI-related data services permit class, and the surrounding permit, inspection, and offence provisions (sections 14 to 20, 25, 26 and 31) do not require a permit holder to create or keep any log or record. Section 26's enforcement-officer powers let an officer inspect and copy a document already on the premises, which presupposes records the Act does not itself require a permit holder to create, rather than imposing a record-keeping duty of its own.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 13 lists an "artificial intelligence (AI) and AI-related data services permit" as one of thirteen classes of ICT service permit, alongside classes such as cloud and data services, e-commerce, and cybersecurity governance.

Section 14 requires a person who intends to carry on business as an ICT service provider, including one offering AI or AI-related data services, to apply to the Director for the corresponding permit, which section 17 makes valid for one year and renewable, and section 18 requires an annual permit fee.

The Director may impose, vary, suspend, or cancel a permit's conditions under sections 16, 19, and 20 for breach of a condition or of the Act or its Regulations, and section 31(1) makes carrying out an ICT activity, including providing AI or AI-related data services, without a valid permit an offence punishable on conviction by a fine of up to VT3,000,000 or up to 3 years' imprisonment for an individual, or a fine of up to VT20,000,000 for a body corporate.

When LexLint raises it

When your app profile says your app generates content with AI, trains models or deploys a chatbot.

Back to the example  ·  Lint your app

Page updated .