Summary

  • APNIC’s end-2026 aim is for every remaining review to be complete or with the relevant NIR for checking and remediation; it does not say that every correction will be finished by then.
  • The October update says the program may conclude in early 2027 when results are shared with the community, and that some remediation may continue after the program concludes.

The calendar has three endpoints

A program can finish its review work without every record question being settled. APNIC’s October 12 update makes that distinction unusually clear: it aims to have all reviews complete or with National Internet Registries (NIRs) for checking and remediation by the end of 2026; it hopes to conclude the program in early 2027 as results are shared with the community; and it expects some remediation to continue beyond that conclusion.

These are three different measures. “Analysis complete” describes APNIC’s examination of data. “With an NIR” marks a handoff for checking and possible corrective work. “Program concluded” describes the institutional timetable for sharing results. None, by itself, means that every questioned delegation has been verified, that a policy violation has been established, or that every resulting correction has been carried out.

The distinction matters because the database entry is the operational record people rely on, while a flag in a review is only a reason to examine that record. A preliminary concern and a verified finding are not interchangeable. A correction can be necessary, but the evidence and the path from finding to change should remain visible.

The September snapshot was a work map, not a verdict

At APNIC 62 on September 10, APNIC’s activity report divided the work into three states. The reviews for JPNIC, TWNIC and KRNIC were listed as complete. Aggregated-data analysis covered CNNIC, IDNIC Part 2 and APNIC. NIR checking and remediation covered IDNIC Part 1, VNNIC and IRINN. The end-2026 target was to move all remaining reviews either to completion or into the NIR checking/remediation stage.

The Q3 update, published on October 12, then moved several items forward without declaring the whole program complete. APNIC said the initial data reviews for IRINN and CNNIC had finished during the quarter. It sent IRINN’s results to IRINN and NIXI in September and expected to share CNNIC’s results with CNNIC in October. The final IDNIC data review remained under way; it covers five years omitted from the first IDNIC review. APNIC also began analysis of its own registry data in September.

That is a change in the location of work, not necessarily its final outcome. APNIC said it was working with VNNIC, IDNIC and now IRINN to evaluate results and eliminate false positives. The published update does not give a total number of records reviewed, a false-positive count, a final remedy count or detailed findings for the current cohort. Those omissions limit what an outside reader can conclude; they do not prove either that the process has failed or that a particular allocation is wrong.

APNIC’s Q4 2025 update separately discussed APJII’s IDNIC investigation. That earlier investigation is not a finding in the current review cohort.

Why the handoff matters

The review program examines IPv4 delegations and transfers by APNIC and the NIRs over an initial period of roughly ten years for compliance with address policies. The program page describes several supporting activities, including spot checks, policy and procedure review, account-accuracy checks, NIR support and agreement review. They are not one common test with one shared completion date.

An analysis can identify a record that merits a closer look. The NIR’s checking can add local context or correct a false positive. Remediation changes a record or practice only after the relevant evidence has been assessed. Treating those steps as a single “audit result” would hide where a question stands and who is expected to act next.

The program’s name changed from “audit” to “review” after community feedback. The label does not settle the substance: a review can reveal a concern, but the public status alone is not proof of a breach. Equally, reaching a reporting milestone does not remove the need to complete any corrective work that remains.

APNIC says its next community update is scheduled for December 2026. That is the next useful checkpoint. It can show whether the analysis rows have moved, whether NIR checking has begun or finished, and whether the end-year target remains achievable. The early-2027 announcement should then be read as a separate program-closeout milestone, with any continued remediation reported alongside it rather than silently counted as complete.

Sources