What Was Announced
On 27 March 2026, the ACMA announced that it will replace the industry-developed Telecommunications Consumer Protections Code — universally called the TCP Code — with an industry standard that the regulator determines itself under section 125 of the Telecommunications Act 1997.
The ACMA’s stated reasoning is worth quoting rather than paraphrasing, because the wording is precise about what was wrong with the old arrangement. The intention is to move the remaining consumer protections “into direct regulation so that expectations are consistent, obligations are clear and are backed by stronger and more immediately available enforcement powers for the regulator”.
Three phrases in that sentence are doing real work. Consistent expectations means the current rules are applied unevenly. Clear obligations means they are currently ambiguous enough to argue about. And more immediately available enforcement powers means that when a telco breaches them today, doing something about it takes too long.
Why a phone company is writing this up
Partly because it is genuinely important and badly covered. But also because it is a fair question to put to any provider, including us: are you in favour of being regulated more directly? The honest answer is that a provider running its own network and its own support desk has very little to fear from clearer obligations, because the rules mostly describe what it already does. The providers with something to lose are the ones whose current practices only survive because the rules are ambiguous and slow to enforce. That is not a marketing claim, it is just the structure of the situation.
A Code and a Standard Are Not the Same Thing
This distinction is the entire story, and it is invisible unless somebody explains it.
Australian telecommunications has long relied on registered industry codes. Industry bodies write the rules; the ACMA registers them; compliance is then a matter of the code being followed, with the regulator’s ability to act generally requiring a sequence of steps before it reaches consequences. It is co-regulation, and the logic behind it was reasonable: the industry understands its own operations, and rules written by practitioners are more workable than rules written by outsiders.
An industry standard made under section 125 is a different instrument. The regulator writes it. Compliance is a direct legal obligation rather than adherence to a registered industry document, and the enforcement pathway is shorter.
| Registered industry code (now) | Industry standard (proposed) | |
|---|---|---|
| Who writes it | Industry bodies, through negotiation among providers | The ACMA, after public consultation |
| Who it is written for | Workability across a diverse industry | The outcome the regulator wants to see |
| Clarity of obligation | Negotiated language, which tends to leave room | Drafted to be enforced, so drafted to be unambiguous |
| Enforcement speed | Slower — the concern the ACMA named directly | “More immediately available” in the ACMA’s own words |
| Consultation | Industry-led drafting process | At least 30 days public consultation, per section 132 |
The practical translation for a customer: the protections are becoming easier for a regulator to act on. Not necessarily broader — that depends on the drafting, which is what the consultation is for — but harder to argue around and faster to enforce. For a business that has ever been on the wrong end of a billing dispute that dragged on for months, that is the change that matters.
Your Business Is a Protected Customer
Here is the fact that surprises nearly every business owner who hears it: the TCP Code’s protections extend to small business customers, not only to households.
Telco consumer protections are widely assumed to be a residential matter — something that helps a pensioner disputing a mobile bill but not a company with an ABN. That assumption is wrong, and it costs businesses real money, because a business that believes it has no protections does not invoke any.
The areas the TCP Code has covered for residential and small business customers alike:
Advertising
How services and pricing may be presented. The rules exist because “unlimited”, “from” and headline rates that exclude the charges everyone pays have a long history in this industry.
Responsible selling
Obligations around how a service is sold to you — whether you were given the information needed to make an informed decision, and whether what you were sold was suitable.
Fair treatment of vulnerable customers
Protections for customers in difficult circumstances. Relevant to sole traders and family businesses more often than people expect, since the line between the household and the business is frequently the same person.
Credit and debt management
How a provider may pursue money it says you owe, including what must happen before disconnection or debt collection. This is the section businesses in a billing dispute most need and least often read.
Information you must be given
Clear summaries of what a service costs and includes, so plans can be compared honestly rather than only through a salesperson.
Complaint handling
Obligations about how complaints are received, acknowledged and resolved — including that a provider must have a process, and must tell you about escalation rather than letting a matter go quiet.
The practical consequence of not knowing this
A business that thinks it has no rights negotiates as though it has none. It accepts a disputed charge because arguing seems futile. It signs a contract it has not been given the material terms of. It absorbs a fault that goes unfixed for weeks because there is nobody above the provider to appeal to. All three of those are situations the rules already contemplate. The escalation path is set out later in this article, and it is free.
One caveat to keep this honest: “small business” in the telco protections context is a defined term with thresholds, and the definition and its treatment are precisely the sort of thing the new standard’s drafting and consultation will settle. If your business is large enough that its status is genuinely unclear, that is a question for the consultation and for your own advice — not something to resolve from an article.
Why Self-Regulation Ran Out of Road
Regulators do not take over rule-writing from an industry that is performing well. It is worth understanding the pattern that led here, because it also tells you what to look for in a provider.
The ACMA publishes Telecommunications Consumer Complaints reports quarterly, and the report for the January to March 2026 quarter ranked the complaint-handling performance of 33 telcos. That publication is itself informative about the regulator’s approach: comparative, public and repeated. Naming and ranking is what a regulator does when it wants market pressure to do some of the work.
Alongside complaints sit the outages. Australia has had a sustained run of significant network failures, several touching the emergency call service, and each one demonstrated the same structural problem — that the consequences arrived slowly and unevenly while the harm arrived immediately.
27 Mar 2026
ACMA announces the TCP Code will be replaced by a direct industry standard
33
Telcos ranked in the Jan–Mar 2026 consumer complaints report
s125
The Telecommunications Act 1997 power being used to make the standard
30 days
Minimum public consultation period required by section 132
This is not a story that started in March 2026 either. The direction has been consistent for several years: the transparency rules that took effect on 30 June 2026 forced telcos to publish standardised coverage maps and maintain public registers of resolved outages, and the Scams Prevention Framework put scam-disruption duties on providers directly. Each of those moved something that used to be discretionary into something that is required and checkable. Replacing the TCP Code is the same move applied to the core of the customer relationship.
What the Regulator Is Actually Chasing
A regulator’s enforcement priorities are a public statement of where it will spend its attention, and they are unusually useful to read as a customer — they tell you which of your problems now have institutional weight behind them.
The ACMA’s 2026–27 compliance and enforcement priorities are:
| Priority | Why it is there | What it means for your business |
|---|---|---|
| Disrupting branded SMS scams | Scam messages impersonating trusted brands remain a primary vector for fraud against Australians | Your business SMS sender identity is now inside a regulated system. If you send messages to customers, registration and correct configuration matter — see the SMS Sender ID Register |
| Reliable access to Triple Zero | Multiple outages have affected emergency call access, with real consequences | Your phone system's emergency call behaviour is not a detail. Triple Zero from a cloud phone covers what you are responsible for and what your provider is |
| Protections for customers affected by domestic, family and sexual violence | Telecommunications accounts are a recognised vector for coercive control | If you employ people, the account-security practices here are worth understanding — see customer identity authentication |
| Regulating mobile phone equipment | Non-compliant devices create interference and safety risks | Mostly a supplier concern, but relevant if you import or resell devices |
| Overseeing new gambling advertising reforms | A separate policy programme landing in the same period | Not applicable to most businesses, included for completeness |
ACMA Chair Nerida O’Loughlin summarised the posture directly: “Whether it is making sure people can reach Triple Zero in an emergency, helping stop scam messages before they reach consumers, or ensuring vulnerable customers receive the protections they are entitled to, the ACMA will act where industry falls short.”
“Where industry falls short” is the operative phrase. It is not the language of a regulator expecting to supervise a well-functioning voluntary system.
The Case That Shows the New Posture
Statements of intent are cheap. Litigation is not, and it is the clearest available evidence of how seriously to take the shift.
The ACMA has commenced proceedings in the Federal Court against Optus Mobile in relation to the 18 September 2025 outage, which affected some people’s ability to connect to the emergency call service.
Two things about that are worth noticing. First, the subject: not a billing practice or an advertising claim, but access to Triple Zero — the single obligation in Australian telecommunications with no acceptable failure rate. Second, the venue: the Federal Court, rather than an administrative process resolved quietly between regulator and provider.
What a customer should take from this
Not schadenfreude about a competitor — large outages are a risk faced by every network operator, and any provider claiming immunity is overselling. The useful lesson is structural: emergency call reliability is now a matter that gets tested in court, which means it is worth asking your own provider concrete questions about it. How does the platform behave when a site fails? How is your service address for emergency calls maintained and how do you update it? Who is accountable if it is wrong? Redundancy when you depend on a single network is the engineering side of the same question, and the Optus Triple Zero outage covers the incident itself.
When This Takes Effect
Not yet, and the sequence matters if you are trying to work out whether to care now.
| Stage | Status |
|---|---|
| ACMA announces intention to replace the TCP Code with a standard | Done — 27 March 2026 |
| Drafting and public consultation, minimum 30 days under section 132 | The process the ACMA said it would undertake |
| The industry standard is determined and commences | Follows consultation |
| The 2019 TCP Code ceases to be registered | Happens when the new standard commences |
Until the new standard commences, the 2019 TCP Code remains in force. So the protections described in this article are not future protections you are waiting for. They exist today. What is changing is how directly they are written and how quickly they can be enforced.
That has a practical implication for the next section: there is no reason to wait for the new standard before using the rights you already have.
How to Actually Use Your Rights
Rules only matter if somebody invokes them. The escalation path in Australian telecommunications is genuinely effective and costs a business nothing, and the reason it is underused is that most people do not know it exists past step one.
| Step | What to do | The thing people get wrong |
|---|---|---|
| 1. Complain to your provider, properly | Lodge a formal complaint, not a support call. Ask for a complaint reference number and get it in writing | Ringing support repeatedly is not a complaint and generates no record. The reference number is what makes everything after this possible |
| 2. Keep a contemporaneous record | Date, time, who you spoke to, what was promised, what the fault or charge actually is. Email yourself a summary after each call | Reconstructing six weeks of phone calls from memory later. Notes written at the time carry far more weight than recollection |
| 3. Escalate to the Telecommunications Industry Ombudsman | If the provider has not resolved it, take it to the TIO. The service is free to you and covers small business customers | Not knowing the TIO covers businesses at all. This is the single most valuable fact in this article |
| 4. Report systemic conduct to the ACMA | The TIO handles your individual dispute. The ACMA handles rule-breaking. If the behaviour looks like a pattern rather than a one-off, report it | Expecting the ACMA to resolve a personal billing dispute, or expecting the TIO to punish a provider. They do different jobs |
A note on tone that makes a practical difference: the businesses that get results are not the ones that shout. They are the ones with dates, reference numbers and a specific statement of what they want done. A complaint that says “on 14 July I was told X, on 2 August the charge was applied anyway, reference ABC123, and I am asking for the charge reversed” gets resolved. A complaint that says the service is terrible does not, however justified it is.
Reading a Provider Before You Sign
The most useful thing this regulatory shift gives you is not enforcement. It is published information, which lets you avoid the dispute rather than win it.
Read the complaints reports
The ACMA publishes comparative complaint-handling performance quarterly. It ranked 33 telcos in the January to March 2026 report. Free, public, and considerably more informative than a testimonials page.
Read the outage register
Providers must maintain public registers of resolved outages. Read your shortlist's. What you are looking for is not zero incidents — that is unrealistic — but honest, specific, timely entries.
Read the coverage maps
Standardised coverage maps exist so they can be compared. Check the addresses that matter to you rather than the national picture.
Ask who operates the network
When something breaks, layers between you and the infrastructure are layers between the fault and the fix. Who owns the network covers why this determines how a bad day goes.
Test support before you buy
Ring the support line as a prospect, at an awkward hour. Whoever answers, and how long it takes, is the most accurate research you will do all week.
Read the exit terms
Contract length, early termination, and how numbers are released. A provider confident in its service does not need to make leaving difficult.
Regulation Is a Floor, Not a Feature
It would be easy to end this by claiming that stronger rules are wonderful news for customers and leave it there. The more useful conclusion is a little more careful.
Regulation sets a minimum. It defines the worst treatment that is legally permitted, and it gives you a route to redress when a provider goes below it. Those are real and valuable things, and the shift to a directly enforceable standard makes them more real. But a rule you have to invoke has already cost you something — the time to document the problem, the weeks waiting on a complaint, the attention taken away from your actual business.
The test worth applying
The goal is not a provider whose regulatory compliance is excellent. It is a provider you never have to check. If you find yourself researching escalation paths and reading complaints data about your current provider, the rules are not your problem — they are your consolation. Choose so that the protections stay theoretical.
What the March 2026 announcement genuinely tells you is that Australia has concluded, after twenty years of evidence, that asking this industry to write its own rules did not produce good enough outcomes. That is a significant admission, and it is worth carrying into your own procurement. Whatever the new standard says, the best position for your business is to have chosen a provider for whom the rules mostly just describe what it already does.
In the meantime: you have protections today, they cover your business, they are free to invoke, and the escalation path runs provider, then Ombudsman, then regulator. Most business owners reading this did not know that an hour ago. That is the practical takeaway, whatever the drafting eventually says.