Deep Dive: Industry codes of practice
25.08.2025Intended as a complement to rules-based regulatory models, industry codes of practice can help establish clear regulatory goals and best practices.
According to the Kenya Communications Authority‘s (CA) approach to developing codes of practice, the mechanism is defined as “a set of professional standards or written guidelines agreed on by members of a particular profession, or written guidelines issued by an official body or a professional association to its member, to help them comply with its ethical standards” (ITU 2023).
The Kenya Communications Authority’s approach to developing codes of practice

Source: ITU, Collaborative regulation for digital transformation in Kenya: A country review, 2023
Several important considerations could indicate the necessity or benefit of codes of practice, including if:
- government regulations are unlikely to be developed or are inappropriate for the specific section of the market;
- overarching legislation exists and the objective is to help promote compliance by developing controls to improve industry standards;
- the need for, and commitment to, the development of controls to improve industry standards is widely acknowledged; or
- the objective is to provide customer-focused benefits beyond the minimum standards.
Levels of government involvement
As codes are produced in direct collaboration with industry actors, regulators can exercise a high degree of flexibility when it comes to delegating development of key provisions. A more light-handed, self-regulatory approach may favor industry actors having greater say over the kinds of codes established. Increased regulator involvement would result in a more equal say in the types of regulations and standards that should be included, ensuring public interests are well reflected and protected.
Mandatory vs. voluntary codes
Regulatory authorities may also reserve the power to prescribe codes as either voluntary or mandatory (Table 1). Mandatory codes are binding on all industry actors regardless of whether they have signed onto the relevant codes, while voluntary codes only apply to those that have signed onto them (OECD 2013).
Table 1. Examples of mandatory and voluntary codes of practice
| Country | Description | Mandatory or Voluntary |
| Australia | The Australian Code of Practice for Securing the Internet of Things for Consumers was released in 2020 as a set of voluntary principles intended to provide industry actors with the necessary security protocols to protect consumers. In July 2021, the Australian government announced its intent to make the set of guidelines mandatory, illustrating an important case in which an initially voluntary code of practice became enforceable. | Mandatory |
| Cambodia | Developed by the Ministry of Post and Telecommunications (MPTC), the Global Partnership to End Violence Against Children, UNICEF Cambodia, line ministries, industry actors, and other relevant stakeholders, the Cambodian Child Online Protection Guidelines for the Digital Technology Industry provide industry with uniform child online protection standards. | Voluntary |
| Kenya | The CA has issued a mandatory Code of Practice on the Deployment of Communications Infrastructure. Drafted in consultation inter alia with the National Environment Management Authority, the Kenya Bureau of Standards, the Radiation Protection Board and the Kenya Civil Aviation Authority, the code is intended to streamline deployment of communication infrastructure. | Mandatory |
Regulators can also consider regulations requiring private industry actors to submit their own codes of practice. In Kenya, the Information and Communications (Consumer Protection) Regulations (CA 2010) require licensees to submit a commercial code of practice to the CA within six months of receiving a license. While licensees are afforded flexibility in terms of how they apply these standards, the CA does mandate that the same basic principles (e.g., complaints-handling procedures, emergency assistance services) be consistent throughout all the codes of practice.
Key principles
Box 1. Key principles of code of practice development
Important principles to incorporate when developing codes of practice
- codes of practice should aim to be as inclusive of stakeholders as possible, with regulators remaining open to input from a variety of industry actors;
- whenever possible, regulators should rely on industry self-regulation as a means of enforcing codes of practice;
- codes of practice should operate through voluntary agreements and ideally function without the need for codified enforcement mechanisms; and
- regulators should strive to promote consumer confidence in private actors who voluntarily adopt codes of practice; increased consumer confidence in code-compliant organizations, achieved through means such as public campaigns, could facilitate further adoption of agreed upon regulatory standards.
Box 2. Collaborative regulation agreements through codes of practice
Examples of collaborations through codes of practice in the ICT sector
European Union: EU 2022 Code of Practice on Disinformation
India: Ministry of Information and Broadcasting issues Digital Media Ethics Code
South Africa: ICASA Code for Persons with Disabilities regulations, 2021
Benefits and challenges
A mechanism that employs high levels of collaboration and coordination between public and private actors, a code of practice can offer several benefits to ICT regulators. These can include:
- encouraging industry self-regulation;
- improving consumer confidence in the industry and organizations subscribing to it; and
- promoting responsible business practices.
The primary challenges related to codes of practice often amount to insufficient or ambiguous enforcement mechanisms and a lack of consistent communication and transparency between public and private actors. While industry codes may include appropriate provisions in line with best practices, many of these agreements are voluntary and it is ultimately up to the private-sector actor to comply. If codes are not introduced as mandatory and/or there is no legal backing to turn voluntary codes into mandates, regulators have little power to enforce industry-developed standards. Moreover, issues of transparency and accountability can be further exacerbated without a strong culture of information sharing between the private actor and the regulator. This is especially prevalent in highly technical fields including cybersecurity, artificial intelligence (AI), search engine algorithms, and online platforms.
References
Communications Authority of Kenya (CA). 2010. Kenya Information and Communications (Consumer Protection) Regulations. https://repository.ca.go.ke/bitstream/handle/123456789/754/Kenya-Information-and-Communications-Consumer-Protection-Regulations-2010-Draft-Consumer-Protection-Guidelines-8-Sep-2020.pdf?sequence=1&isAllowed=y.
ITU. 2023. Collaborative regulation for digital transformation in Kenya: A country review. https://digitalregulation.org/wp-content/uploads/D-PREF-THEM.32_Kenya-2023-PDF-E.pdf.
OECD (Organization for Economic Co-operation and Development). 2013. Alternatives to traditional regulation. https://www.oecd.org/gov/regulatory-policy/42245468.pdf.
Last updated on: 01.09.2025