AI policy development for New Zealand organisations.
New Zealand has chosen existing law over an AI Act. Since 1 May 2026, IPP 3A has applied to personal information an AI tool infers or generates. The Human Rights Act 1993 attaches liability for a discriminatory output to the organisation that deployed the tool. We write the policy that turns those obligations into rules staff can follow, with an owner, a register and a review date on page one.
Built for
The New Zealand instruments a policy has to carry.
All four apply now, and a policy written without them is out of date.
BUSINESSES
MBIE Responsible AI Guidance for Businesses
Voluntary guidance for every NZ business. It recommends usage policies and standards, a risk inventory and an organisation-wide inventory of AI systems.
PUBLIC SERVICE
GCDO Responsible AI Guidance for the Public Service
Covers governance, security, procurement, accountability, transparency, bias and privacy for generative AI in agencies.
AGENCIES AND HEALTH
GCDO Use of AI Policy template and HIPC amendment
The Public Service AI Toolkit includes a policy template for agencies, and the Health Information Privacy Code 2020 now carries the indirect collection rule.
1 MAY 2026
IPP 3A in force
An agency collecting personal information indirectly has to take reasonable steps to tell the individual. AI inference and generation fall inside that.
What a New Zealand AI policy is judged against.
Each of these failure modes shows up in New Zealand policies, so we design each clause to answer one of them.
- 01Registers
No central list of tools, no impact assessments.
There is no central list of the enterprise generative AI tools in use across the Public Service, and no central set of privacy or AI impact assessments for them. An agency policy that assumes a register exists somewhere else has a gap on its first page, so we put the register inside the policy as a schedule.
- 02Privacy Commissioner
A human in the loop is a paper control on its own.
The Privacy Commissioner warns of automation blindness: a reviewer who is the human in the loop in name and signs off whatever the tool produces. The Commissioner sets eight expectations for any organisation using generative AI, from senior leadership approval and a privacy impact assessment through to procedures for accuracy and for access and correction requests. We use those eight as the floor for a New Zealand policy.
- 03Algorithm Charter
Commitments with no reporting cadence.
The Charter commits signatories to transparency, partnership with Māori, consultation, bias management, peer review and human oversight. Without a reporting cadence inside the policy, those commitments stay on the signing page.
What a New Zealand AI policy must include.
Each clause below answers a specific New Zealand obligation or a regulator's stated expectation. A policy that has principles without these clauses has nothing for a reviewer to test.
The same clause list, as a downloadable template with an NZ edition, is at our AI policy template page.
01
Owner, approver and review date
Companies Act 1993 ss 131 and 137. GCDO template header table.
A named policy owner, a board or executive approver, a version number and a next review date. Boards govern AI through clear board level policies, and directors' duties are unchanged by the technology. Without an approver the document has no standing with a regulator or a court.
02
A responsible senior official and a privacy officer
Privacy Act 2020 s 201. GCDO governance guidance.
The GCDO recommends each agency designate a senior official, a chief digital, risk or data officer, responsible for alignment with the Public Service AI Framework, for risk and assurance, for setting the rules on generative AI use and for involving iwi Māori. Every agency under the Privacy Act already has to have a privacy officer. The policy names both and says what each decides.
03
An AI use register with a screening gate
GCDO register recommendation. Algorithm Charter risk matrix. MBIE inventory.
The GCDO strongly recommends keeping a register of AI use and publishing it. MBIE recommends an inventory per AI system. The Charter's risk matrix grades uses low, moderate or high and scales the commitments to match. The policy makes the register a schedule, assigns a screening outcome to every entry and names the owner who signed it off.
04
Approved enterprise tools, no personal accounts
GCDO template, Use of AI tools section.
The GCDO template permits only agency approved enterprise AI tools. The policy goes one step further and bars personal AI accounts for work. It lists the approved tools by name and tenancy, gives a request path for new ones, and treats everything else as prohibited.
05
Tiered input rules
IPPs 1, 5, 10, 11 and 12. OPC expectation 8. HIPC 2020 rule 12.
A table of what can go into which tool: never, only inside an approved tenancy, or permitted. The Privacy Commissioner expects no personal or confidential information in a tool unless the provider has confirmed it will not retain or disclose it. Any disclosure to an overseas provider runs through IPP 12. Health agencies add rule 12 of the Health Information Privacy Code for overseas transfers.
06
IPP 3A procedure for generated and inferred information
Privacy Amendment Act 2025. In force 1 May 2026.
Where a tool generates, infers or receives personal information from someone other than the individual, the policy records how the individual is made aware and which exception, if any, is relied on. The Privacy Commissioner treats asking a tool a question that produces information about a person as a collection, even when the answer is wrong. The rule is not retrospective, so the procedure applies from the date the policy is adopted.
07
Human review, labelling and records
IPP 8. Public Records Act 2005. OIA and LGOIMA for public bodies.
Outputs are checked by a person with authority before use, material AI input is labelled, and prompts, chat histories and outputs are treated as records. For councils, prompts and chat histories are council information and discoverable under LGOIMA. The GCDO template treats material produced by enterprise AI as official information. Private organisations apply their contractual and statutory retention periods.
08
Decisions about people
Human Rights Act 1993. Algorithm Charter human oversight commitments.
AI is never the sole basis for a decision with a legal or similarly significant effect on a person. A named human holds the authority to overturn the output, the decision is recorded, and there is a channel to challenge it. The Human Rights Act prohibits discrimination in employment, housing, education and access to goods and services, and the liability for a discriminatory outcome sits with the organisation that deployed the tool. The Charter asks public signatories for a nominated contact and a route for challenge or appeal.
09
Te Tiriti and Māori data governance
OPC expectation 5. GCDO guidance. Te Mana Raraunga principles.
The policy identifies Māori data in scope using Te Mana Raraunga's definition, commits to engagement with Māori on tools that affect Māori, records a data location preference consistent with the Rangatiratanga principle, and requires accuracy testing for Māori because the Privacy Commissioner has found that systems trained overseas do not work accurately for Māori. Private organisations are not Treaty parties. The Privacy Commissioner and the GCDO both expect engagement, and the expectation applies to anyone holding Māori data. Detail is on our Māori data governance page.
10
Workforce consultation
Employment Relations Act 2000 s 4. Public Service AI Framework.
The duty of good faith requires consultation before decisions that adversely affect employees, and introducing AI that changes roles, hours, monitoring or required skills is such a decision. Under the Public Service AI Framework, public service workers have the right to be consulted on changes to their work. The policy sets the consultation trigger and rules out covert monitoring.
11
Procurement and vendor terms
MBIE AI Procurement appendix. IPP 12. GCDO procurement coordination.
Before any AI service is bought: where the data is hosted, whether the vendor trains on it, its security history, breach notice terms and an exit route. MBIE's guidance carries an AI procurement appendix and the GCDO asks agencies to coordinate AI procurement through its office. The policy makes the checklist a condition of purchase.
12
Incident handling with a manual fallback
Privacy Act 2020 Part 7.
A definition of an AI incident, a reporting path, the authority to take a tool offline, a documented manual process to fall back on, and a link into the notifiable privacy breach procedure for a breach likely to cause serious harm.
13
Training and an annual review with triggers
GCDO skills and capabilities guidance. MBIE skills building. Algorithm Charter twelve-month review.
An induction module for everyone, role specific training for people who build, buy or approve AI, and a fixed annual review with named triggers. Of the published New Zealand policies we have read, the GCDO template and the council policies all say they will be reviewed regularly, without naming an interval, so the policy names one.
The GCDO template is free. Read it before you engage anyone.
The Government Chief Digital Officer's Use of Artificial Intelligence Policy template is the right starting point for an agency. Its own text calls it a starting point that should be tailored. Here is where the tailoring has to happen.
What the template gives you
- /A header table for approval date, review date and policy owner.
- /Six guiding principles drawn from the Public Service AI Framework, including a legal, regulatory and ethical context principle.
- /A policy approach covering governance, responsible use, transparency, human supervision, data privacy and security, and alignment with other policies.
- /Rules for enterprise AI tools: only approved tools, no personal information in prompts, no enterprise AI in decisions that could adversely affect a person, review and label outputs, and outputs are official information.
- /A list of the legislation an agency has to read it against, from the Bill of Rights Act to the Official Information Act, and the Treaty of Waitangi.
What it leaves for you to write
- /The approved tool list itself, by name and tenancy.
- /An incident reporting procedure and a manual fallback.
- /Any training requirement.
- /A review interval. The template says to update regularly.
- /The AI use register the GCDO's own governance guidance recommends.
- /A procurement section.
- /An IPP 3A procedure for information the tool generates or receives indirectly.
- /Māori data governance beyond the Treaty statement: definition of Māori data in scope, engagement, data location, accuracy testing for Māori.
- /A private sector edition. The template is written for agencies, and the Fair Trading Act, the Companies Act and contractual retention do not appear in it.
One policy suite in four layers.
New Zealand government guidance describes four distinct instruments. We write them as one suite with a governance policy at the top and three schedules beneath it, so a small organisation adopts one document and a Crown entity adopts all four.
Layer 1
AI governance policy
Board approved
Purpose, scope, principles tied to controls, roles, the register and screening gate, decisions about people, Te Tiriti and Māori data governance, incident handling and the review cadence. This is the document the board signs and the document ISO/IEC 42001 clause 5.2 asks top management to establish.
Layer 2
Generative AI acceptable use schedule
For every staff member
Approved tools, the tiered input table, output review, labelling and records. The Privacy Commissioner's eight expectations and the GCDO's enterprise tool rules are the minimum this schedule has to meet.
Layer 3
Employee AI usage standard
Owned by people and culture
Permitted tasks, disclosure of AI assistance, accountability for outputs, consequences under the employment agreement or the Code of Conduct for the Public Sector, and the Employment Relations Act consultation trigger. MBIE's guidance lists non-compliance with a defined usage policy as a trigger for action, which is the point of writing one.
Layer 4
AI procurement annex
For anyone buying AI
The due diligence checklist and the contract terms: no training on your data, data location, breach notice, audit rights, exit. Built from MBIE's procurement appendix and IPP 12. Financial sector clients add FMA and RBNZ outsourcing expectations.
How a New Zealand policy engagement runs.
The Privacy Commissioner expects organisations to understand how their people already use AI, so the engagement starts with discovery.
01
Tool discovery and register
We find every AI tool in use, including personal accounts, and build the first version of the register with a screening outcome against the Algorithm Charter risk matrix for each entry.
02
Obligation mapping
We map each registered use to the IPPs including 3A, the Human Rights Act, the Employment Relations Act, the Fair Trading Act, HIPC 2020 where health information is involved, and for public bodies the Charter, the Framework and the Official Information Act.
03
Drafting with the people who will enforce it
Legal, privacy, digital and people teams draft with us. Where Māori data is in scope, we recommend engagement with iwi or Māori data experts and build the policy's commitments around what that engagement produces, rather than writing them on their behalf. Working from our template, the first draft takes one working week.
04
Approval and consultation
Board or executive sign-off, then workforce consultation under the good faith duty before the policy changes anyone's work. We run the review cycle rather than leaving it to the policy owner to chase. Plan on 2 to 4 weeks for sign-off and consultation together.
05
Rollout and first review date
Quick reference guides, manager briefings, the induction module and the acknowledgement form. The annual review date and the triggers are set before we leave.
Questions New Zealand clients ask.
Is a written AI policy legally required in New Zealand?
No statute requires one. The obligations come from the Privacy Act 2020, the Human Rights Act 1993, the Employment Relations Act 2000, the Fair Trading Act 1986 and directors' duties under the Companies Act 1993. The Privacy Commissioner expects organisations to use privacy policies to govern their AI tools, and MBIE's Responsible AI Guidance for Businesses recommends usage policies and an AI inventory. New Zealand relies on existing law with no standalone AI Act, which leaves the policy as the instrument that does the work.
What changed with IPP 3A on 1 May 2026?
IPP 3A requires an agency that collects personal information from someone other than the individual to take reasonable steps to make that individual aware of specified matters. The Privacy Commissioner treats asking an AI tool a question that generates information about a person as a collection. An AI policy that permits inference or generation of personal information needs an IPP 3A procedure, and health agencies have the same rule in the amended Health Information Privacy Code.
The GCDO publishes a free AI policy template. Why engage PolyGovern?
The GCDO template is a public sector starting point built around six principles and a set of rules for enterprise AI tools. It has no approved tool list, no incident procedure, no training requirement, no register, no procurement section, no IPP 3A procedure and no Māori data governance detail beyond a Treaty statement. Our work adds each of those and writes the private sector edition the template was never meant to be.
Do Te Tiriti and Māori data governance apply to a private company?
Private organisations are not Treaty parties. The Privacy Commissioner expects engagement with Māori about impacts on taonga, and the GCDO expects agencies to involve iwi Māori. Any organisation holding Māori data has an expectation to meet, and Te Mana Raraunga's principles are the reference framework. We recommend engaging Māori data experts for that clause and say so in the policy.
How do the policies treat ChatGPT, Copilot and other offshore tools?
The policy names the approved enterprise tools and bars personal accounts. It sets a tiered table of what information can go into each tool, applies IPP 12 to any disclosure to an overseas provider, and requires vendor terms that rule out training on the organisation's data. Health agencies also apply rule 12 of the Health Information Privacy Code 2020.
How long before the policy needs reviewing?
We set an annual review plus named triggers: a privacy breach involving AI, new Privacy Commissioner guidance, a new class of tool entering the organisation, an audit finding, or a change in law. The GCDO template says only to update regularly. The Algorithm Charter's own twelve-month review clause is the precedent we follow.
IPP 3A has been in force since May. Write the policy that accounts for it.
A scoping call covers which tools are in use, which of the thirteen clauses you already have, and whether Māori data or health information puts extra sections in scope. You leave with a written scope for the engagement.