🌐 RIRs and AI: Internet Governance Learns to Use LLMs

The Story So Far

Internet governance runs on a thin layer of trust: resource allocation must be fair, routing data must be accurate, and member data must be protected. That makes AI adoption in the Regional Internet Registries (RIRs) uniquely sensitive. These organizations are already dealing with fraud, identity verification, and security risks. Now they are deciding where LLMs can help — and where they could introduce unacceptable legal or operational exposure.

The record to date shows three different levels of maturity: ARIN has a documented internal policy framework and has discussed AI use publicly; RIPE NCC has held a detailed community panel on AI risks and opportunities; APNIC has embedded a generative AI usage policy inside its Acceptable Usage Policy. LACNIC and AFRINIC have not published comparable AI/LLM policy documents in the sources reviewed for this report.

Why RIRs Are a Special Case

RIRs are not just normal IT organizations. They allocate and register IP addresses and Autonomous System Numbers, and they operate registry systems that underpin global routing trust. Many of their processes handle sensitive member data. That makes AI policy less about productivity and more about governance, liability, and risk management.

For this report, we reviewed RIR meeting transcripts, security audit documentation, and annual reports published between late 2024 and early 2026. Where no public AI/LLM policy documentation was found, we note that explicitly rather than assuming absence.

RIR Snapshot (Public Record)

Who Is Involved

The public record shows RIR AI policy discussions anchored in governance and risk functions, not engineering teams alone:

• ARIN: Board-level and Risk & Cybersecurity Committee attention, plus formal policy listings in security audit documentation.
• RIPE NCC: Services Working Group, with input from security, communications, registry, and strategy stakeholders.
• APNIC: Secretariat internal policy integration (Acceptable Usage Policy).

RIR-by-RIR Notes

ARIN: Internal Policy, Cautious Usage

ARIN 56 (October 2025) includes the clearest public statement so far. The CEO noted that ARIN has an internal AI usage policy and that AI use was limited to nonconfidential data. The transcript also emphasizes the need to track AI usage and avoid exposing member data.

Separately, ARIN’s SOC 3 report lists “Generative AI Usage” among its formal policies, which signals that AI governance is now part of ARIN’s control environment.

RIPE NCC: Public Deliberation

At RIPE 91, the RIPE NCC Services Working Group hosted a session explicitly focused on AI risks and opportunities. The panel highlighted phishing and fake identity risks, environmental concerns, and the importance of human oversight. The tone was not promotional; it was operational and risk-aware.

Selected Remarks (with Attribution) and Why the Absolutism Fails

“Maybe I see the dependence one there and on the previous one there was something about brain rot, I think that needs a lot of care to avoid.”

— Antony Gollan (RIPE NCC, Manager Communications Team) (source; role)

This is a fair warning about over‑reliance, but it is not a case against controlled use. Dependency risk is managed the same way RIRs already manage other critical tooling: fallback paths, human review, and clear boundaries on where AI is allowed.

If “brain rot” is the standard, perhaps we should issue chisels and hammers and revoke keyboards too — just to keep everyone’s hands strong.

“One I really like is no AI at all. At least for me. It's hard to forget that we see AI as a given and it's not. It's definitely something that we should also consider, is there an issue with us relying on old fashioned brain power, so to say, and I think that's not the case.”

— Gabor de Wit (RIPE NCC, Chief Registry Officer) (source; role)

“No AI at all” is a slogan, not a policy. It ignores that narrow, low‑risk uses (translation, internal summarization, and documentation triage) are both governable and already happening. A blanket rejection just pushes usage into the shadows where it cannot be audited.

“Yes. The others mention the environmental impact, of course I think it's important. I would like to highlight the loss of competence, because in my mind, that's one of the risks, once you start to rely too much on AI, it's really difficult to come back from.”

— Robert Kisteleki (RIPE NCC, Principal Software Engineer) (source; role)

The risk is real, but the solution is not abstinence. It is accountability: define where AI can be used, require named human owners for outputs, and enforce periodic non‑AI verification paths. That is governance, not nostalgia.

“We have all experienced now large companies that have gone too far down that particular brain rot rabbit hole and you are spending time talking to a bot that the computer says no or will make stuff up or whatever else. And while I appreciate the differences between paid versions and not paid versions of models, these are still fundamentally largely based on theft, it's that straightforward.”

— Brian Nisbet (HEAnet; RIPE Security WG Co-chair) (source; role)

This is a caution about bad deployments, not evidence that all AI use is unsafe. The lesson is to design guardrails, not to prohibit any use whatsoever.

“I am Gill from ODH. I think the AI models that we think about right now are the LLMs, mostly, and they are all statistics based models. And when we think of the statistics we think about approximation. And I think most of the services that the RIPE NCC give to the community are not approximations, they are precisely algorithmically valid. So you can use AI where you don't need precision and authority, but wherever you need authority you can't use AI, you can use it to help you build it, but not be authoritative about it.”

— Gill (ODH) (affiliation not confirmed in public RIPE NCC sources; identified as “ODH” in transcript) (source)

This is correct about authoritative outputs — and it is also compatible with limited AI use. No one is arguing that RIR registries should become probabilistic. The unfounded leap is the assumption that any AI use must touch authoritative decision‑making. It doesn’t.

“Thanks to and welcome to indeed our scribe and chat monitors and wonderful steno people.”

— Brian Nisbet (RIPE 91 Security WG transcript)

The explicit thanks to human stenography is a quiet reminder that this transcript is a human‑produced record, not automated LLM output. Ironically, the meeting relies on people, not bots, to preserve accuracy — exactly the standard we should apply to AI‑assisted work.

Meeting notes: RIPE NCC Services WG Minutes (RIPE 91)

A blunt reading of the discussion is that none of the speakers demonstrates even a basic, operational understanding of how LLM systems are trained, where they fail, and how risk can be bounded. That gap is a common governance mistake: policy gets written around anxiety, not around the actual mechanics of the technology being regulated.

The broader tone is hard to miss: RIPE NCC staff and community voices in this session tilt negative on AI, which suggests we should not expect rapid operational efficiencies from AI adoption in the near term. That stands in contrast to ARIN’s more pragmatic posture — an internal policy, clearly scoped use on nonconfidential data, and public acknowledgement that AI can be used under governance controls.

Source: RIPE 91 Services WG transcript

APNIC: Policy Embedded in AUP

APNIC’s 2023 Annual Report notes that a generative AI usage policy was drafted and merged into the Acceptable Usage Policy. This implies internal governance alignment, even if a public-facing, standalone AI policy is not published yet.

LACNIC and AFRINIC: Policy Not Yet Public

We did not locate public AI/LLM usage policies or transcript references in official sources reviewed for this report. That is not proof of absence; it indicates the public record is thin and worth monitoring as new reports and meeting materials appear.

Governance Friction Points

RIRs face policy questions that look different from typical software organizations. The highest-risk issues are not about code quality but about confidentiality, procedural integrity, and transparency to members.

• Member data boundaries — AI tools often rely on third-party services, raising questions about data residency and retention.
• Decision integrity — resource allocation and registration decisions need auditable human reasoning, not opaque automation.
• Disclosure expectations — members need to know when AI assistance is used in policy drafts, communications, or incident summaries.

What RIRs Are Doing Right

1. Framing AI as a Governance Problem

ARIN and RIPE NCC frame AI as a matter of risk, confidentiality, and accountability, not just productivity. That matches their role as stewards of sensitive member data and routing security.

2. Putting Policy on Paper

ARIN’s SOC 3 report explicitly lists “Generative AI Usage” as part of its policy set. APNIC reports that it drafted a generative AI policy and placed it inside its Acceptable Usage Policy. Both are concrete signals that AI use is not left to individual discretion.

3. Public Transparency (So Far)

RIPE NCC’s RIPE 91 panel gives the community a window into real concerns: phishing risk, fake identities, environmental impact, and the need for human oversight. That discussion is a form of transparency that most organizations do not provide.

What’s Not Working Yet

1. Lack of Clear, Public-Facing Rules

Even where internal policies exist, public-facing policy statements are limited. Members and contributors still lack a consistent, plain-language statement of what AI is allowed to do across RIR services.

This matters because RIRs are member-driven organizations. When policy is internal-only, members cannot easily validate whether AI use aligns with the community’s risk tolerance or with privacy commitments made in other documents.

2. Fragmented Maturity Across RIRs

The current record shows uneven adoption: ARIN and APNIC have written policies; RIPE NCC is actively discussing; LACNIC and AFRINIC have no visible policy documents yet. That variance makes cross-RIR expectations hard to align.

The NRO exists to coordinate RIRs on shared technical and policy issues. AI/LLM governance is a candidate for that coordination, but no cross-RIR framework has appeared in public sources yet.

3. Limited Guidance on AI-Generated Submissions

Several meeting discussions note the possibility that AI is already being used in community submissions. Few public rules explain disclosure requirements or how AI-generated documents will be reviewed.

What a Baseline RIR AI Policy Should Cover

• Data classification — what data can be used with AI tools, and what is prohibited.
• Approved use cases — e.g., summarization, translation, policy search, internal documentation.
• Prohibited use cases — e.g., automated decision-making for resource allocation or registration.
• Disclosure rules — when AI assistance must be declared in submissions or reports.
• Human accountability — named responsible humans for all AI-assisted outputs.
• Auditability — logging and review procedures for AI-assisted workflows.

What to Watch Next

• New RIR annual reports that update policy language or governance practices.
• Meeting transcripts where AI is discussed as a formal agenda item.
• Presentation guidelines that explicitly discourage AI‑generated text or art in submissions.
• Published Acceptable Use or security policies that move from internal to public guidance.

Signals from Presentation Rules

RIPE has also codified skepticism about AI‑assisted presentations. Its presentation presentation guidelines advise submitters to avoid significant use of generative AI for text or art (while allowing basic assistive tools such as spelling or grammar checks). That is not a transcript remark, but it is an official policy signal about how the community wants AI‑authored content handled in meeting materials.

Why This Matters for Internet Governance

AI policy in the RIRs is not a peripheral issue — it is a test of governance culture. These organizations exist to provide neutral, reliable stewardship of Internet resources. Their AI choices will show whether they can adopt new tools without undermining trust or exposing member data. The fact that some RIRs are already documenting policy while others remain silent suggests this will be a long-running governance story, not a one-time decision.

Primary Sources

• ARIN 56 Day 1 Transcript (AI policy and usage discussion)
• ARIN SOC 3 Report (lists “Generative AI Usage” policy)
• RIPE 91: RIPE NCC Services WG Transcript (AI panel)
• RIPE 91: Security WG Transcript (stenography acknowledgment)
• RIPE NCC Services WG Minutes (RIPE 91)
• RIPE 92 Presentation Guidelines (AI-generated content guidance)
• APNIC 2023 Annual Report (generative AI usage policy)

Official Documentation

• NRO: Regional Internet Registries overview

Secondary Sources

• UN IGF 2023 Summary Report (AI governance themes)