Summary

  • AFRINIC published the recommended third version of the RIR Governance Document on 1 September 2026. It is a final draft for further institutional consideration, not an adopted or operative rule.
  • Article 4.2 creates an Audit at least once every five years and narrower Compliance Reviews between Audits. Member groups, peer RIRs, the subject RIR and ICANN enter through different routes.
  • Two frequency protections then overlap: a successfully resolved issue receives a one-year pause, while each initiating party may initiate no more than two Compliance Reviews against the same RIR between Audits.
  • A privacy-safe public receipt must distinguish request from initiation and bind the initiator, cited provision, audit interval, review ordinal, closing event and rehabilitation clock. Without that record, neither access to review nor protection from repetition is independently testable.

The third request exposes the missing object

Suppose a group of members asks for a Compliance Review of one RIR under a particular obligation in section 4.1. ICANN accepts the materiality case and initiates the review. A later group brings another issue, and that review is also initiated. Before the next regular Audit, a third coalition files a request.

Has the initiating party used its two opportunities? The answer is easy only if “party” means the category “member groups” and every initiated review in that category shares one counter. It becomes harder if a changed coalition is treated as a different party, or if the first request was received but rejected before initiation. The public draft does not decide those implementation questions.

This is not a drafting curiosity. The limit protects an RIR from being tied up in repeated reviews. The review route also protects members and the wider numbering community from waiting as long as five years to test a specific compliance concern. A counter error can therefore close a legitimate route too early or keep an anti-paralysis protection from operating at all.

AFRINIC’s 1 September notice gave this mechanism a current news state by publishing the recommended draft, its redline and the changes-and-rationale report. Publication makes the words inspectable. It does not put AFRINIC under a review, and it does not make the draft binding.

Four paths lead to one initiation decision

The recommended Version 3 separates a regular Audit from an issue-specific Compliance Review. Every RIR would undergo an Audit no less frequently than once every five years. Between those Audits, a review may be requested by a majority of the other RIRs, by an RIR seeking review of itself, or by a group drawn from the subject RIR’s members.

For the member route, the group must contain at least 15 per cent of total members or 1,000 members, whichever is less. Each legal entity counts once even if it has multiple votes for other purposes. The request must identify the specific section 4.1 provision and show that the matter is sufficiently material. At least one member in the group must also demonstrate adequate efforts to address the concern through the RIR’s available processes.

ICANN stands at the conversion point. It reviews a request and determines whether the asserted issue is sufficiently material to warrant initiation. Separately, even without a request, ICANN may initiate a review after notifying all RIRs when it reasonably believes the subject RIR is out of compliance with one or more specific provisions.

Those distinctions create at least five states: a concern exists; a request is received; the required elements are checked; ICANN rejects or initiates; the review later closes. Article 4.2(d) limits reviews that are “initiated,” not every request submitted. A public count that begins at the inbox would consume capacity that the text did not say had been used.

One limit follows the issue

The first frequency rule attaches to what was reviewed. If compliance with a specific section 4.1 provision was assessed within the previous calendar year, and the RIR was found compliant or was verified to have returned to compliance after a Rehabilitation Plan, the same issue cannot immediately be reviewed again.

The endpoint changes with the outcome. Where a Rehabilitation Plan exists, the pause runs until one year after that plan’s timeline closes. Without a plan, it runs until one year after the prior Audit or Compliance Review closes. The rule therefore needs more than a date labelled “review complete.” It needs the provision assessed, the finding, whether cure was required, the plan’s formal end and ICANN’s verification state.

“Same issue” also needs a stable linkage. Two requests can cite the same paragraph while alleging different failures; one request can cite several provisions; a later request can restate an earlier concern with newer evidence. The draft does not say that such matters are automatically identical. A counter should record the relationship and the authority that classified it, rather than silently collapsing similar labels.

The second limit follows the initiator and the audit interval

The next sentence uses a different key. No more than two Compliance Reviews may be initiated by each of the listed initiating parties against the same RIR between any two Audits. This is not the same as a total limit of two reviews. Peer RIRs acting by majority, the subject RIR, a qualifying member group and ICANN are different routes under the text.

The counting interval is bounded by Audits, not calendar years. That makes the opening and closing Audit records material. An early Audit, a delayed Audit or an Audit that overlaps an active review may change the practical ledger unless the implementation rules identify the exact reset event.

Initiator identity is equally important. A self-request by the subject RIR is easy to name. ICANN is easy to name. “The other RIRs, by majority decision” may be a collective category even if the supporting combination changes. A member group is harder: publishing its membership would violate a sensible privacy boundary, while treating every changed coalition as wholly new could make the cap porous.

The text need not publish member names to solve this. It can use a non-reversible coalition fingerprint, record the aggregate count and denominator, and state the rule used to decide whether a later coalition shares the same initiating identity. The important fact is the classification, not a public petition roll.

The summary report comes too late for the gate

Version 3 requires ICANN to publish a summary after an Audit or Compliance Review, after consultation and appropriate redaction. If a Rehabilitation Plan follows, ICANN must later verify remediation and publish its findings. Those are valuable closure records.

But a limit is applied before the next review begins. At that point, the requesting party and the public need to know which audit interval is open, how many initiated reviews are already attributed to the relevant party, whether the cited issue is within a protected year and which previous closing event controls the date. A report produced after completion cannot by itself make a pre-initiation gate reviewable.

The changes-and-rationale report makes the policy purpose clear. It describes Compliance Review as a lighter mechanism for detecting specific problems between Audits, and it says the new frequency language is meant to prevent repeated action and avoid paralysing an RIR through endless reviews. That balance depends on correct accounting.

A bounded counter can protect both sides

The minimum public receipt starts with the subject RIR and the two Audit events that define the interval. It names the initiating class and gives it a stable privacy-safe identifier. It records when a request arrived, which section 4.1 provisions it cited, whether the member-threshold and prior-process conditions applied, and ICANN’s materiality decision.

If the request becomes a review, the receipt assigns an initiation timestamp and an ordinal for that initiator in that audit interval. It links any prior “same issue” determination, records the finding and closing date, and—where relevant—the Rehabilitation Plan end, remediation verification and resulting cooldown expiry. A correction field preserves later changes. A challenge or appeal should change the decision state, not erase the earlier state.

Public evidence can stop there. Confidential submissions, personal identities, signatures and protected audit material remain private. The counter should show why a gate opened or remained closed, not expose the case file.

The NRO process page describes the 1 September text as the ASO Address Council’s recommended draft, delivered for NRO Executive Council consideration and later coordination with ICANN. Approval and adoption remain a later stage. That is the right moment to fix the counter: before a protection against excessive review becomes an unreviewable decision about who has already used it.

Sources