Georgia: technology regulation at a glance

Framework: Georgia AML/CFT Law (amended Jan 2023) + NBG Rule on VASP Registration (Aug 2023) + proposed amendments to Organic Law of NBG (submitted Sept 2025, subordinate acts due Sept 2026); supervised by the National Bank of Georgia (NBG)

Georgia operates a live VASP mandatory-registration regime under the National Bank of Georgia since January 2023, covering exchanges, custody, and portfolio management with AML/CFT obligations. Stablecoin issuance rules and a fines framework for VASPs are in force, while a significant expansion, adding minimum capital requirements, expanded supervisory powers, and consumer-protection rules, was submitted to Parliament in September 2025 with implementing acts due by September 2026. Individuals face no capital-gains tax on crypto trading; businesses pay a 15% distributed-profits tax under the Estonian model.

Framework: Council of Europe Framework Convention on Artificial Intelligence (signed September 2024); fragmented multi-agency oversight across Ministry of Economy and Sustainable Development, Innovation and Technology Agency, and Digital Governance Agency; UNESCO AI Readiness Assessment in progress (2025-2026); no dedicated domestic AI law or regulator

Georgia has enacted no domestic AI-specific legislation and has no national AI strategy or dedicated regulatory authority. The country's primary normative commitment is the Council of Europe Framework Convention on Artificial Intelligence, the first binding international AI treaty, which Georgia signed in September 2024 alongside the EU, US, and UK. Domestic governance is fragmented across multiple agencies, and a UNESCO-backed AI readiness assessment launched in late 2025 is intended to inform future policy development.

Framework: Law of Georgia on Personal Data Protection (No. 3144/2023); supervisory authority: Personal Data Protection Service (PDPS / pdps.ge)

Georgia enacted a comprehensive GDPR-aligned personal data protection law (No. 3144/2023) on 14 June 2023, superseding the 2011 law. Core provisions entered force on 1 March 2024, with additional obligations (DPIAs, DPO requirements) phased in through June 2024 and January 2025-2027. The independent Personal Data Protection Service (PDPS) enforces the law, conducts inspections, and imposes fines.

Framework: Law of Georgia on Payment Systems and Payment Services (as amended), administered by the National Bank of Georgia (NBG)

Georgia has a well-established payment services licensing regime under which non-banking institutions may register with the National Bank of Georgia (NBG) as Payment Service Providers (PSPs), covering payment initiation, account information, card services, and e-money issuance. Open Banking rules are actively in force, capital adequacy requirements for PSPs took effect in January 2024, and an NBG-led national Instant Payment System is in advanced development targeting Q4 2026 launch.

Framework: Law of Georgia on Labour Migration; Law of Georgia on the Legal Status of Foreigners and Stateless Persons; June 26 2025 parliamentary amendments introducing mandatory work permits (effective March 1 2026, transition until January 1 2027); administered by the Ministry of Internally Displaced Persons, Labour, Health and Social Affairs

Georgia operates the 'Remotely from Georgia' program, a dedicated digital nomad visa, free of charge, valid for 12 months, open to nationals of 95+ visa-free countries earning at least $2,000/month. Sweeping legislative amendments adopted in June 2025 add a mandatory work-permit layer effective March 1 2026, ending Georgia's previously near-frictionless de facto open-door for remote workers. Concurrently, a new IT-sector residence permit was introduced in September 2025 for qualifying tech professionals.

Framework: No comprehensive online safety law; partial regime comprising the Law on the Protection of Family Values and Minors (2024), the Law on Transparency of Foreign Influence (2024/2025), and the Law on Personal Data Protection (2023, in force March 2024), overseen by the Personal Data Protection Service (PDPS)

Georgia (the country) has no comprehensive online safety statute equivalent to the EU DSA or UK Online Safety Act. It regulates online content and platforms through a patchwork of laws: a 2024 anti-LGBTQ content law restricting online and broadcast media, a 2024-2025 foreign-influence registration regime that burdens civil-society and online media outlets, and a GDPR-aligned personal data protection law in force since March 2024. Freedom House rated Georgia 70/100 (Free) in its Freedom on the Net 2025 report but noted the country suffered the sharpest decline among Free-rated nations, driven by growing self-censorship and legal pressure on digital media.

Framework: Law of Georgia on Information Security (2012, as amended through 2025); National Cybersecurity Strategy 2021-2024; CERT-GOV-GE under the Data Exchange Agency of the Ministry of Justice; Department of Information and Cybersecurity of the National Security Council

Georgia's primary cybersecurity instrument is the Law on Information Security, which designates critical information system subjects, imposes mandatory immediate incident reporting to CERT-GOV-GE, and requires those subjects to adopt internal security policies. National-level coordination is provided by the National Security Council's Department of Information and Cybersecurity, which oversees implementation of the 2021-2024 National Cybersecurity Strategy, the country's third such strategy. CERT-GOV-GE, operational since 2011 under the Ministry of Justice's Data Exchange Agency, serves as the principal technical response body.

Framework: Law of Georgia on Entrepreneurs (enacted 2 August 2021, in force 1 January 2022); Law of Georgia on Promotion and Guarantees of Investment Activity; registration authority: National Agency of Public Registry (NAPR) under the Ministry of Justice of Georgia

Georgia is highly open to foreign business formation: foreigners may own 100% of a Georgian LLC with no minimum share capital, no mandatory local partner, and no residency requirement. Registration is handled by NAPR at Public Service Halls nationwide and can be completed within one business day. A 2021 legislative reform modernised the corporate law framework to align with EU Association Agreement obligations.