In force
Privacy Act 2020
Replaced the 1993 Act. The information privacy principles, IPP 3A included since 1 May 2026, apply to all AI data handling.
AI governance built for Aotearoa's regulators and Te Tiriti obligations.
We advise New Zealand banks, insurers, government agencies, and Crown entities on AI governance under the Privacy Act 2020, Te Tiriti o Waitangi, FMA / RBNZ expectations, and the Public Service AI Framework.
Built for
Boards & risk committees · Chief risk officers · Chief information officers · General counsel · Public-sector AI leads
We work against: Privacy Act 2020 / Te Tiriti o Waitangi / Public Service AI Framework / FMA / RBNZ guidance / ISO/IEC 42001 / EU AI Act / NIST AI RMF
What you walk away with.
Full engagement methodologyAI inventory & risk register
A documented map of every AI system in use, classified by risk tier and tied to a named accountable owner.
Mapped controls
Controls mapped against the 13 Privacy Principles, ISO 42001, and the Public Service AI Framework where applicable.
Treaty-aware practice
Governance practices that respect whakapapa, embed kaitiakitanga, and protect tangata whenua in AI outputs.
Audit-ready evidence pack
A single evidence pack a regulator, internal auditor, or external reviewer can work through end to end.
The instruments shaping Aotearoa's AI rulebook.
Domestic instruments and the international frameworks that affect New Zealand organisations.
Active
Public Service AI Framework
GenAI procurement guidance for government agencies. Traceability, risk assessment, and exit strategies.
Guidance
National AI Strategy
New Zealand's first national AI strategy. Signals a shift from fully voluntary to guided governance.
Phasing in
EU AI Act
Prohibitions and general-purpose AI rules already apply. High-risk obligations follow on 2 December 2027, and NZ companies serving EU customers are in scope.
No AI-specific law. The obligations are already in place.
Aotearoa was the last OECD nation to publish a national AI strategy. Existing law still applies, and catching up after a regulator asks is far harder than building the framework first.
- 01In force
Principles without a playbook.
The Privacy Act 2020 sets 13 information privacy principles. The Fair Trading Act prohibits misleading conduct. The Companies Act 1993 requires director due diligence. All of them apply to AI systems, none come with implementation guidance for algorithmic decision-making.
Privacy Act compliance guide - 02Constitutional obligation
Te Tiriti and kaitiakitanga.
Te Tiriti o Waitangi creates obligations around Māori data sovereignty that most AI governance frameworks ignore. Kaitiakitanga calls for guardianship, not only compliance. Crown entities, organisations receiving public funding, and any deployer working with Māori data need governance that respects whakapapa and protects against AI systems that perpetuate bias against tangata whenua.
Māori data governance - 03Active monitoring
Regulators are already watching.
The FMA, RBNZ, and Office of the Privacy Commissioner are each monitoring AI adoption in their respective remits. The Public Service AI Framework sets procurement, traceability, and exit-planning expectations for government agencies using generative AI. Wider regulation is expected to follow the National AI Strategy.
Public Service AI Framework - 04Phasing in
International frameworks reach NZ exporters.
The EU AI Act applies to any New Zealand organisation placing AI on the European market. Its bans and general-purpose AI rules already apply, and high-risk obligations start on 2 December 2027. ISO/IEC 42001 certification is becoming the de facto international benchmark for AI management systems and is increasingly required by enterprise procurement teams.
Regulatory compliance overview
How we deliver AI governance for Aotearoa.
Three practice tracks, each tied to documented artefacts. Structures that hold up where there is no prescriptive rulebook.
Track A
Governance & strategy
Accountability structures, AI policies, and operating models that satisfy Privacy Act principles and board-level due diligence under the Companies Act 1993.
Track B
Assessment & assurance
Independent evaluation of AI systems against the 13 Privacy Principles, cultural impact for Te Tiriti obligations, and assurance ahead of regulatory tightening.
Track C
Compliance & advisory
Privacy Act obligations, Treaty-aligned data practices, Public Service AI Framework readiness, and leadership education on evolving expectations.
Sector-specific governance work.
From Auckland's financial district to Wellington's public service and Christchurch's technology sector, every industry faces distinct governance pressures.
Further reading
The PolyGovern AI Governance Framework
The structure behind every New Zealand engagement, mapped to the instruments that bind here.
Read the guideAI governance maturity model
Five levels of AI governance maturity and the evidence that proves each one.
Read the guideGuides, templates and checklists
ISO 42001, NIST AI RMF, shadow AI, AI policy and risk assessment, written from the primary documents.
Browse the resourcesStart with the AI Risk Calculator. Then talk to us.
The calculator gives you a baseline view of your AI risk exposure against ISO 42001 and EU AI Act lenses in under five minutes. From there we can map your governance against the Privacy Act 2020, Te Tiriti obligations, and FMA / RBNZ expectations.