AI governance in Fiji without an AI or data protection law

Fiji has no AI law and no data protection statute, but that does not leave AI unregulated. The Constitution protects personal information, financial institutions have binding cybersecurity rules from the Reserve Bank of Fiji, and the Online Safety Act deals with harmful electronic communications. The Government has also set out where the rules are heading. This guide covers what applies now, what is coming and how to prepare.

What applies to AI in Fiji today

The Constitution. Section 24 of the 2013 Constitution gives every person the right to personal privacy, including confidentiality of their personal information and communications and respect for their private and family life. A law may limit those rights to the extent necessary. Section 24 has no rules on notices, assessments or automated decisions, but its standard applies whenever an AI system collects, analyses or discloses personal information.

Financial sector rules. The Reserve Bank of Fiji’s PSPS 2 on cybersecurity risk, in force since 31 March 2023, binds commercial banks, credit institutions, insurers, insurance brokers, the Fiji National Provident Fund, the Fiji Development Bank and other supervised entities. It does not mention AI, but its requirements reach AI systems directly.

Online safety. The Online Safety Act 2018 established the Online Safety Commission to promote responsible online behaviour and deter harm caused by electronic communications. The Commissioner said in December 2025 that AI is not named in the legislation but falls under a broad clause in the existing statute, which is being reformed. The same month the Commission and the Fijian Elections Office signed a memorandum of understanding to monitor AI-generated fake content, including deepfakes, ahead of the 2026 general election.

What is coming

The National Digital Strategy 2025-2030, launched on 3 April 2025, sets the direction. It makes four commitments that matter for AI.

• A National AI Framework. Built through stakeholder consultation, with policy guidelines on ethical use, data privacy, accountability and governance of AI in government and the private sector.
• Data protection law. A review of the data protection landscape benchmarked against the GDPR and ISO/IEC 27001, followed by a data protection legal framework and legislation.
• Rules for emerging technologies. Specific legal frameworks for AI and other emerging technologies in business, with a regulatory sandbox.
• A National Cloud Policy. Security protocols and data sovereignty guidelines for cloud adoption.

Cabinet’s endorsement of a National Privacy and Personal Data Protection Policy was reported on 11 October 2025. The Prime Minister said it lays the foundation for national privacy and personal data protection legislation and that Fiji will take steps to join Convention 108+, the Council of Europe convention on automatic processing of personal data.

On 15 October 2026 the Government said Fiji is one of six Pacific Island countries in an Australian-funded project on responsible AI adoption, led by Standards Australia with CSIRO and Ethical AI Consulting, and implemented locally with the Digital Government Transformation Office.

If you are a financial institution

PSPS 2 is where AI governance already has teeth. Four of its requirements carry straight across to AI.

Inventory. Entities must identify and inventory all information, information processing and communication assets and assign each an owner. AI systems, the data they use and the accounts they act through belong on that inventory.

Third parties. Third-party services must not weaken the cybersecurity control environment. You need due diligence on each provider, time-limited access, management of changes to the service, service level agreements with cybersecurity provisions, and contract clauses that let you and the Reserve Bank review the provider’s relevant systems and sites. That reaches AI model and platform providers that process your data.

Testing and change. Security testing and controls over system acquisition, development and change apply to AI systems as they do to other systems.

Incidents. A cybersecurity incident that materially affects the institution or its customers must be notified to the Reserve Bank within 24 hours, and incidents are reported quarterly. An AI system that leaks customer data, or an AI agent that is compromised, is a cybersecurity incident.

How to prepare now

Build the register. List every AI system and agent you use, including AI features switched on inside existing software and tools staff picked up themselves, each with an owner. The AI system register guide covers what each entry needs.

Mark what touches personal information. For each system, record whether it handles personal information about customers, staff or the public, and where that information goes. Those systems carry the section 24 risk now and will carry the data protection law’s duties later.

Manage AI vendors. Most AI arrives through vendors. Put each AI provider through due diligence and check the contract covers confidentiality, security and change. The vendor AI risk guide covers what to ask.

Set the rules for staff. An acceptable use policy and basic training tell staff which AI tools they may use and what information they must not put into them.

Pick a framework. Without a local AI framework, use an international one such as ISO/IEC 42001 or the NIST AI RMF to structure the work, so it maps onto the National AI Framework when it arrives.

Where Aicura fits

Aicura’s AI Register holds every AI system and agent with its owners, status and version history, and Discovery surfaces AI in use that is not yet on it. Vendor records hold due diligence and contracts against the systems that depend on them. Risk assessments, policies, training records, monitoring and incident records sit on the same system records, and from Pro Aicura assesses against ISO/IEC 42001 and the NIST AI RMF. That supports the work Fiji’s rules and plans describe. It is guidance for your own judgement, not a ruling on your obligations.

Aicura is hosted on AWS in Sydney, Australia, for every customer, with AI inference through Amazon Bedrock in Australia. Information you put into Aicura leaves Fiji, and Aicura’s data processing agreement covers how it is handled.

A note on this page

This is a practitioner’s reading of the instruments that apply in Fiji as at 18 October 2026. It is not legal advice. Read the primary sources, and take advice on how they apply to your organisation.