Governance & Regulation

Overview

AI governance is one of the defining policy challenges of our time. New Zealand needs regulatory frameworks that protect people and values without stifling beneficial innovation. Our small size is an advantage here — we can move quickly, experiment, and iterate — but it also means we carry limited weight in setting global norms, making our domestic frameworks and international coalition-building doubly important.

A critical dimension: sovereignty. If NZ's public services, healthcare, and economic systems depend on AI controlled by foreign governments or corporations, governance is hollow. Regulatory frameworks that rely entirely on the good behaviour of offshore vendors are not regulation — they are wishful thinking. This section addresses both the rules we need and the practical infrastructure — including sovereign inference on open-source models — required for genuine self-determination.

NZ's Current Regulatory Landscape

New Zealand enters the AI era with a patchwork of relevant but incomplete frameworks. The Privacy Act 2020 updated the 1993 Act to include stronger information privacy principles, mandatory breach notification, and broader cross-border transfer obligations - but was drafted before large language models became mainstream, and it does not address automated decision-making directly.

The Algorithm Charter for Aotearoa New Zealand, launched in 2020 and signed by approximately 30 government agencies including Stats NZ, Ministry of Social Development, Inland Revenue, and the Ministry of Justice, commits signatories to transparent use of algorithms, bias testing, human oversight, and meaningful explanation of automated decisions. The Charter is voluntary and non-binding, and monitoring of compliance has been inconsistent.

The Digital Strategy for Aotearoa (2022) sets a high-level vision for inclusive, trusted digital participation but does not prescribe specific AI governance mechanisms. It identifies digital inclusion, trust, and economic growth as pillars - all of which AI policy must serve - but largely defers implementation to sector-specific strategies.

The 2025 strategic turn

In 2025 the policy landscape shifted from silence to a defined, deliberately light-touch posture. Three documents now anchor the government's approach:

• Public Service AI Framework (February 2025) — guidance from the Government Chief Digital Officer setting expectations for how public service agencies adopt AI, building on the Algorithm Charter but extending coverage and responsibilities. Still guidance, still without statutory force.
• New Zealand's Strategy for Artificial Intelligence: Investing with Confidence (8 July 2025) — the country's first national AI strategy, framed around accelerating private-sector adoption and removing legislative barriers rather than installing new guardrails. The strategy commits NZ to OECD AI Principles (rule of law, human rights, fairness, privacy, safety) and projects AI could add $76 billion to NZ GDP by 2038.
• Responsible AI Guidance for Businesses (July 2025) — released alongside the strategy. Voluntary, principles-based advice on managing AI risks across development, deployment, and adoption. No mandatory impact assessment, no audit obligation, no enforcement.

The signal is clear: the government has chosen adoption-first, regulation-later. New Zealand is no longer the only OECD country without a national AI strategy, but it remains one of the few without statutory AI rules. The strategy is a stance, not a regulator — it tells Crown agencies and businesses what to aim for, not what they must do.

Outside government, the AI Forum of New Zealand published the AI Blueprint for Aotearoa New Zealand, an industry-led framework setting goals for NZ to become a recognised hub of responsible AI innovation by 2030. The Blueprint prioritises six sectors — agriculture, architecture/engineering/construction, creative industries, education, environment, and health — and tracks NZ's international position (currently 26th of 37 countries on the AI Forum's benchmark). A refreshed 2026 edition is being rolled out through launch events in Auckland, Wellington, and Christchurch in late March 2026. Like the government strategy, the Blueprint is non-binding; unlike the government strategy, it speaks for industry rather than the Crown. Both documents are useful inputs to a future statutory framework, but neither substitutes for one.

Where the gap still sits

There is still no dedicated AI legislation. There is no statutory right to explanation for automated decisions, no mandatory algorithmic impact assessment regime, and no independent AI regulator. The Privacy Commissioner and the Human Rights Commissioner have both flagged the gap; the 2025 strategy explicitly chose not to close it. Treasury Analytical Note AN 24/06 (The Impact of artificial intelligence: an economic analysis, July 2024) frames the choice plainly: countries are splitting between those adopting comprehensive AI-specific legislation (the EU, China) and those relying on existing frameworks updated piecemeal (NZ's current path). Treasury notes that even on the second path, existing rules — copyright is the example given — will need substantive updating to handle AI. The "do nothing new" option does not exist.

A defensible reading of the strategy is that it buys time — light-touch now, formal rules once practice has matured. A more critical reading is that it leaves harms (biased decisions, opaque automation in welfare and policing, worker surveillance) unaddressed while incentives push agencies and businesses to deploy faster. Both readings can be true at once. Either way, building a statutory framework on top of the existing strategy and guidance is the foundational governance task of this decade.

Sub-sections

• AI Ethics — Ethical principles, accountability frameworks, and worker protections for AI in NZ
• Data Sovereignty — Data rights, privacy, Māori data sovereignty, and sovereign compute infrastructure
• International Cooperation — NZ's role in global AI governance and key bilateral partnerships