Editor’s note: This monthly recap distils regulatory developments across Australia, New Zealand, Canada, and the UK – from landmark legislation to enforcement action, framework reform to international obligations. Our aim: help regulators understand what is happening, why it matters, and what’s coming in the weeks ahead. And if you haven’t already, consider signing up for our monthly newsletter.
As 2026 begins, several of the most consequential regulatory decisions of the past year have crossed a critical threshold from lawmaking into live enforcement.
Australia has moved from legislating social media age restrictions to enforcing them in real time. New Zealand is dismantling its foundational planning statute and replacing it with a more permissive regime. Canada is reinstating mandatory criminal penalties while embedding technology companies into child safety enforcement chains. The UK, meanwhile, is consolidating its Online Safety Act oversight framework and pressing regulators to balance growth mandates with stretched capacity.
Formerly abstract proposals or parliamentary debates, these shifts have become realities, with operational requirements, supervisory obligations, and compliance frameworks that regulators must now manage.
December revealed a pattern of simultaneous tightening and loosening: stricter rules where political visibility is high (online harms, child safety, electoral processes) and deliberate deregulation where growth and investment are at stake (environmental approvals, infrastructure permitting, project fast-tracking). This is less a paradox for regulators to resolve, and more a two-track reality to navigate. Supervisory capacity, prioritisation, and risk frameworks must now account for this split explicitly.
The third shift is structural: governments are distributing regulatory work to non-state actors at scale. Platforms must verify age and manage community. Tech companies must detect and report harmful content. These are no longer market-based features; they are regulatory obligations backed by significant penalties. How regulators maintain oversight, audit capacity, and proportionality as they absorb this delegation will define regulatory credibility in 2026.
Regulatory orientation: what is now live or unavoidable
Below is a snapshot of what regulators are now dealing with. Deeper analysis follows.
Australia
- Social media age restrictions are now in effect for under‑16s on nine platforms as of 10 December 2025. The eSafety Commissioner is assessing compliance on platforms’ systems and processes.
- Nine platforms (including Meta, TikTok, YouTube, Snapchat, and Twitch) must prevent under‑16s from creating or maintaining accounts or face penalties up to A$49.5 million.
- Age assurance relies on behavioural signals, natural language processing, and activity patterns – not government ID mandate.
- ASIC’s 2026 enforcement priorities emphasise private credit, financial reporting misconduct, misleading pricing, and insurance claims handling.
New Zealand
- Resource Management Act (RMA) replacement bills were sent to Environment Select Committee on 15 December 2025.
- New regime promises roughly 46 per cent reduction in resource consents and nationwide standardised planning rules; full operation expected by end of decade.
- Transitional measures: existing resource consents extended until end-2027; Fast‑Track Approvals Act amended to soften some controversial provisions.
- Landowner compensation framework introduces “regulatory takings” concept.
- Electoral Amendment Bill passed third reading: shortens enrolment deadlines, reinstates general prisoner voting ban, tightens treating rules.
United Kingdom
- Autumn Budget 2025 sets fiscal envelope for regulators with tight spending constraints.
- Environmental regulators face calls for increased funding; capacity – not burden – flagged as primary constraint.
- Companies House identity verification rollout continuing; 12‑month window for existing directors and people with significant control.
Canada
- Criminal Code overhaul and Protecting Victims Act package announced on 9 December 2025, covering sexual violence, intimate partner violence, coercive control, and child abuse reforms.
- Bill C‑16 (Protecting Victims Act) introduced 8 December 2025; reintroduces mandatory minimum penalties for child sexual offences with constrained judicial override model.
- Mandatory reporting obligations for child sexual abuse and exploitation material (CSAEM) expanded from telecom/ISP providers to all “Internet services” (platforms, hosting, cloud).
- Quebec Bill 5 tabled 9 December; allows cabinet to exempt designated megaprojects from ~30 statutes (environment, land protection, mining, parks).
- AIDA regulation stalled in late 2025; sectoral and soft-law initiatives carry forward.
What regulators are now implementing
Australia: platform enforcement at scale
The eSafety Commissioner is now operationalising live enforcement of age restrictions on nine platforms. The framework does not require government ID but permits platforms to use behavioural detection, activity analysis, and natural language processing to infer age. Enforcement focuses on whether platforms’ systems and processes constitute “reasonable steps” – a standard that will evolve through early notices, engagement, and (likely) litigation.
From a supervisory standpoint, the commissioner must assess whether verification accuracy is sufficient without creating surveillance infrastructure that exceeds the original harm-prevention intent. Meta’s account deactivations began in November; others are deploying systems in real time. Early 2026 will show whether the enforcement posture tilts toward strict compliance or practical accommodation as implementation friction becomes clear.
Supervisory implications: The eSafety Commissioner will need to publish early compliance assessments and guidance on what constitutes “reasonable steps”. Questions of age-verification accuracy, privacy impact, and platform liability for false positives will emerge quickly. Regulators in other jurisdictions are watching; Australia’s enforcement choices will likely become international reference points within 12 months.
What’s next: Compliance assessments expected Q1 2026. Constitutional and administrative law challenges on freedom of political communication are likely but timing remains uncertain. Two-year legislative review mandated for December 2027.
New Zealand: transition amid simultaneous deregulation and tightening
Regulators and councils now operate in a transitional state. The RMA is not yet repealed, but replacement bills are in select committee with public consultation due in early 2026. Existing resource consents have been extended to end-2027, creating a temporary buffer. Fast-Track Approvals powers remain in force with some amendments. Electoral rules have tightened immediately.
For councils and environmental regulators, this means managing multiple overlapping approval regimes simultaneously: legacy RMA consents, new fast-track pathways, compensation claims from landowners, and electoral rules that may dampen community engagement on development issues. The risk is that transition confusion and capacity constraints allow sub-optimal decisions to proceed unexamined.
Chapman Tripp’s analysis of the “single largest economic reform in a generation” and RNZ’s detailed piece on the “devil in the resource management reform detail” both flag implementation risks: urban sprawl, reduced community input, and unclear protection of iwi co-governance rights under the new regime.
Supervisory implications: Councils and regional authorities need immediate guidance on how to apply national direction (when issued) to legacy consents and new applications. The compensation framework introduces new fiscal and legal risk if thresholds and triggers are ambiguous. Iwi engagement protocols must be clarified before fast-track projects are designated under the new regime.
What’s next: Select Committee submissions due Q1 2026. Bills likely to pass in 2026; full operation expected by end of decade. Litigation over exemption scope and Indigenous co-governance rights is foreseeable.
Canada: mandatory minimums and platform liability expansion
Bill C‑16 is in early parliamentary stages but already signals immediate compliance obligations for technology companies. The expansion of mandatory CSAEM reporting from telecom/ISP providers to all “Internet services” creates new reporting duties for platforms, hosting providers, and cloud services. Regulators will need to coordinate with the Department of Justice, law enforcement, and tech companies to clarify reporting standards, timelines, and liability shields.
The constrained judicial override model for mandatory minimums is designed to survive Charter challenge but will likely face litigation once applied in borderline cases. Prosecutors and courts will navigate the boundary between “limited and exceptional circumstances” and routine sentencing discretion.
Supervisory implications: Tech companies are already assessing overlap between C‑16 reporting obligations and provincial privacy laws, particularly in Quebec. Regulators and privacy commissioners should publish joint guidance on interpretation and interaction before the bill passes. Enforcement agencies must resource training on new reporting standards and evidentiary protocols.
What’s next: C‑16 expected to pass Parliament in January or February. Tech companies will begin implementation planning immediately. Charter challenges are likely if and when new mandatory minimums are applied; Supreme Court involvement is foreseeable by late 2026.
Quebec and federal governments: fast-track project regimes now in policy
Quebec Bill 5 is expected to pass by early February 2026. Once operational, cabinet will designate priority projects (renewable energy, critical minerals, transport, housing) and suspend or modify application of environmental, land protection, mining, and parks statutes. The federal Building Canada Act model is already operational; Quebec’s variant consolidates similar power at the provincial level.
Environmental law groups, particularly the CQDE, argue the regime undermines procedural fairness and environmental assessment. The practical challenge for regulators is advising government on project suitability, monitoring whether conditions on fast-tracked projects are actually met, and maintaining credibility as environmental and Indigenous protections are formally shelved for designated projects.
Supervisory implications: Regulators must develop frameworks for assessing project-level exemptions and monitoring compliance with conditions. Public participation and Indigenous consultation expectations will need clarification – fast-tracking the approval process does not (or should not) eliminate engagement obligations. The first wave of designations will be a critical signal of how broadly these powers are intended to be used.
What’s next: Bill 5 passage expected by February 2026. Cabinet announcement of first designated projects likely within weeks. Litigation over exemption scope and Indigenous rights is foreseeable.
Critical themes shaping early 2026
Platform regulation as live enforcement, not just law on paper
December turned platform regulation from legislative theory into real-time implementation. Australia’s social media age ban requires nine platforms to operate verification systems that the eSafety Commissioner will evaluate against a “reasonable steps” standard – a judgement that will evolve as enforcement practice develops. Other jurisdictions are watching closely. If this mix of experimentation and significant penalties proves workable, Australia could become a reference point; if it stalls in litigation, evasion, or privacy backlash, it will be cited as a cautionary case.
This means building enforcement capacity for a new type of obligation: real-time platform supervision at scale, with penalties sufficient to compel technical redesign. The eSafety Commissioner will need to balance strict enforcement with practical accommodation of technical feasibility and privacy protection.
Environmental and planning deregulation, with new tensions for accountability
New Zealand’s RMA replacement and Quebec’s Bill 5 both accelerate project approvals for infrastructure, energy, and resource developments while preserving formal environmental and Indigenous protections on paper. The pattern is to centralise decision-making, standardise rules, and reduce local community input. In practice, regulators and councils face a difficult navigation: faster approvals are now a government priority, but environmental quality and procedural fairness cannot be (visibly) abandoned.
This would require developing supervision frameworks for regimes that are deliberately designed to reduce process rigor, which can be operationally and reputationally challenging since they must oversee systems that are, by design, less protective than their predecessors.
A sharper punitive edge in criminal and electoral rules
Canada’s Criminal Code reforms and New Zealand’s Electoral Amendment Bill both lean harder on legal obligation and sanction. Reinstated mandatory minimums, expanded reporting duties, shorter enrolment windows, and renewed prisoner voting bans all move in a more restrictive direction. Set alongside simultaneous deregulatory moves on planning, these choices suggest governments are calibrating strictness differently across domains – tightening where harms are politically visible and loosening where growth and investment are at stake.
This creates a work-programme tension: supervising stricter obligations in one domain while accommodating deregulatory mandates in another. Capacity and prioritisation decisions cannot be neutral.
Tech as enforcement infrastructure – regulation by proxy
Bill C‑16’s expanded CSAEM reporting duties and Australia’s age-verification obligations show how quickly governments are turning technology companies into operational extensions of state enforcement. Online service providers are now part of the regulatory chain – detecting, preserving, and reporting harmful activity at scale. This can extend regulatory reach rapidly, but it also embeds complex risk judgements into private systems whose primary accountability is commercial, not public, unless regulators consciously build audit mechanisms, guidance, and oversight capacity.
For regulator’s perspective, 2026 will test whether agencies can supervise non-state enforcement partners at scale without proportionality failures or accountability gaps.
Fragmentation and loss of international coherence
Australia’s age-based access rules, New Zealand’s planning overhaul, Quebec’s project fast-tracks, and the UK’s Online Safety Act are all moving on different regulatory tracks. For cross-border firms, compliance strategies will tend to be shaped by the strictest or least predictable jurisdiction in each domain, rather than any shared baseline. This complicates cooperation and comparative learning among regulators, but it also creates space for experimentation and cross-jurisdictional borrowing where approaches appear workable.
December – January watch list
Immediate (January 2026)
- Australia: eSafety Commissioner early enforcement steps and informal platform engagement; first potential compliance notices.
- Canada: Parliamentary progress on Bill C‑16; tech industry implementation planning for CSAEM reporting regime.
- UK: Companies House identity verification uptake metrics and first signals on deadline enforcement.
Near term (January – February 2026)
- Quebec: Bill 5 passage and announcement of first designated fast-track projects.
- New Zealand: Electoral Amendment Bill operationalisation (enrolment deadlines, prisoner voting, treating rules).
- Canada: Department of Justice and law enforcement guidance on C‑16 reporting obligations.
Longer view (Q1 – Q2 2026)
- Australia: Constitutional and administrative law challenges to social media ban framework; litigation strategy clarification.
- New Zealand: RMA replacement select committee hearings and reports; signals on how far initial proposals are moderated.
- Cross‑jurisdiction: Implementation calendar crowding: digital safety, financial services, planning, environmental regimes all converging. Our 2026 deadlines overview maps the terrain.
Final word
“We’re strengthening the law because victims and survivors deserve a modern and robust justice system that does more to protect them and keep their communities safe. The comprehensive reforms in this bill are necessary to strengthen our criminal and family justice system and prevent the re‑traumatisation of victims.”
–The Honourable Ruby Sahota, Secretary of State (Combatting Crime), on the Protecting Victims Act and Criminal Code reforms announced on 9 December 2025.
Planning for 2026: a regulatory checklist
As regulators enter the new year, December’s legislative choices now translate into operational work. Three immediate planning questions:
Work programme allocation: How will your agency allocate capacity between stricter enforcement obligations (online safety, CSAEM reporting, mandatory minimums) and deregulatory mandates (faster approvals, fewer consents, project exemptions)? Capacity is finite; prioritisation choices should be explicit, not accidental.
Risk and supervision frameworks: How will you maintain oversight of non-state enforcement partners – platforms, tech companies, private services – that are now part of your regulatory chain? Audit capacity, guidance consistency, and proportionality safeguards need early design.
Stakeholder and colleague coordination: How will you engage councils, oversight bodies, privacy commissioners, and sister agencies to navigate overlapping and sometimes contradictory mandates? Silos will create supervision gaps and credibility risks.
December’s pattern was not a one-off. It signals how regulatory pressure will distribute across 2026 – tighter in some domains, looser in others, all at once. Planning frameworks that reflect this split reality, rather than hoping for coherence, will serve regulators best as the year unfolds.
The Modern Regulator is an independent publication delivering news, insight, and analysis on regulation and regulatory practice for regulators, policymakers, and governance professionals across Australia, New Zealand, the UK, Canada, and globally. Subscribe for monthly updates.
