Artificial Intelligence Governance for New Zealand Government Agencies
Digital.govt.nz published the Public Service AI Framework. The Algorithm Charter for Aotearoa New Zealand set out transparency commitments. Now every agency needs to turn those into procurement criteria, risk registers, supplier assessments, and governance structures that satisfy both Cabinet expectations and Te Tiriti o Waitangi obligations. We bridge the gap between published guidance and operational reality.
The Framework Exists. The Implementation Gap Is Real.
Agencies have the guidance from Digital.govt.nz and the OECD AI Principles that underpin it. What they lack are the operational tools to put it into practice across procurement, risk management, and day-to-day use of AI.
"We are procuring AI tools but have no evaluation criteria"
Government Procurement Rules require you to assess supplier reputation, pricing, supply chain risks, and privacy and security posture. The Responsible AI Guidance for GenAI adds further expectations around data traceability and exit strategies. The Algorithm Charter commits agencies to transparency about how algorithms affect people. Without AI-specific evaluation criteria aligned to these commitments, procurement teams are left guessing.
Build procurement evaluation criteria →"Our risk assessment process does not cover AI"
The Public Service AI Framework calls for robust risk management proportionate to each use case. But most agency risk registers were not designed for algorithmic bias, model drift, or third-party AI dependencies. Your organisation needs AI-specific risk categories layered onto existing processes, aligned with the OECD AI Principles on robustness, security, and accountability, not a separate system that duplicates effort.
Develop AI risk assessment capability →"We have Treaty obligations but no AI-specific guidance"
Te Tiriti o Waitangi requires government agencies to protect Māori interests. When AI systems process Māori data, affect Māori communities, or inform decisions with Treaty implications, generic governance frameworks fall short. The principle of kaitiakitanga (guardianship and stewardship) demands that Māori data sovereignty be built into your AI governance from the start, not bolted on as an afterthought.
Integrate Treaty-compliant governance →From the Algorithm Charter to Operational Governance
The Algorithm Charter for Aotearoa New Zealand commits signatory agencies to transparency, partnership with communities, and meaningful human oversight. We help agencies translate those commitments into documented processes that withstand scrutiny from the Te Kawa Mataaho Public Service Commission, the Privacy Commissioner, and the public.
Transparency and Explainability
The Algorithm Charter requires agencies to be transparent about how algorithms affect decisions about individuals. For AI, this means documenting which systems influence outcomes, how they work, what data they use, and how members of the public can seek review. We build explainability documentation that meets both Charter commitments and Privacy Act 2020 obligations around automated decision-making.
Partnership with Māori and Affected Communities
The Charter calls for meaningful engagement with communities affected by algorithmic decisions, particularly tangata whenua. This goes beyond consultation. It requires partnership consistent with Te Tiriti o Waitangi. We develop iwi and hapū engagement frameworks that honour both the Charter commitments and the broader obligations of Māori data governance, grounded in the principle of kaitiakitanga.
Data and Privacy Governance
The Privacy Act 2020 applies to every AI system that processes personal information within government agencies. Its 13 Information Privacy Principles constrain how data is collected, used, disclosed, and stored. We ensure your AI procurement and deployment satisfy both the Privacy Act and the Public Service AI Framework's data traceability requirements, including offshore transfer documentation when vendors process data outside New Zealand.
Procurement Under Government Rules
AI procurement is still procurement. The Government Procurement Rules and Principles apply, but agencies need AI-specific criteria at every stage. This includes evaluating supplier data handling practices, model transparency, bias testing procedures, security certifications, supply chain dependencies, and exit strategies, all aligned with the Responsible AI Guidance for GenAI published on digital.govt.nz.
Across Every Level of New Zealand Government
Different organisations face different governance pressures. Central government departments operate under Cabinet expectations and the Te Kawa Mataaho Public Service Commission. Local councils answer directly to ratepayers. Crown entities have their own accountability structures. We tailor our approach to your specific context, ensuring that AI governance integrates with your existing decision-making processes rather than creating a parallel bureaucracy.
Central Government Departments
Ministries and departments with direct Cabinet accountability. Subject to Public Service AI Framework expectations, Algorithm Charter commitments, and all-of-government procurement rules. We address the intersection of Ministerial responsibility and operational AI deployment.
Local Government and Councils
Auckland Council, Wellington City Council, and regional councils deploying AI for resource consenting, transport planning, and citizen services. Accountable to ratepayers and local communities, including mana whenua. We incorporate both local government accountability requirements and community engagement obligations.
Crown Entities and SOEs
Organisations like Te Whatu Ora (Health New Zealand), education institutions, and state-owned enterprises navigating AI governance within their sector-specific regulatory environments. Each entity faces distinct compliance pressures, from the Health Information Privacy Code to education sector standards, that demand tailored governance solutions.
What We Deliver for Government Agencies
Practical tools and strategies that integrate with your existing processes. Not abstract frameworks that sit on a shelf. Every deliverable reflects the specific requirements of New Zealand's public sector governance landscape.
Framework Implementation Plan
- • Phased roadmap mapped to your agency's AI maturity and innovation goals
- • Gap analysis against Public Service AI Framework and Algorithm Charter
- • Responsible AI Guidance for GenAI operationalisation
- • Staff roles, responsibilities, and escalation pathways
AI Procurement Evaluation Criteria
- • Supplier assessment scorecards for AI vendors
- • Due diligence checklists aligned to Government Procurement Rules
- • AI-specific contract clauses and SLA templates
- • Exit strategy and data portability requirements
Treaty of Waitangi Compliance Governance
- • Māori data governance principles embedded in AI policy through kaitiakitanga
- • Iwi and hapū consultation frameworks for AI deployment
- • Cultural impact assessment templates grounded in te ao Māori
- • Te Tiriti o Waitangi alignment documentation for each AI system
Agency Risk Assessment Framework
- • AI risk categories integrated into existing risk registers
- • Use-case-level risk classification aligned with OECD AI Principles
- • Proportionate controls based on risk tier and impact on New Zealanders
- • Ongoing monitoring triggers and review schedules
Data Traceability Protocols
- • Data flow mapping for each AI system
- • Offshore data transfer documentation under Privacy Act 2020
- • Retention schedules aligned to Public Records Act
- • Vendor data handling verification procedures
Cross-Agency Coordination
- • Shared governance standards for multi-agency AI projects
- • Interoperability requirements for data sharing between organisations
- • Joint procurement governance for common-use AI solutions
- • Knowledge-sharing frameworks for cross-agency coordination
The Regulatory Landscape for Government AI in Aotearoa
New Zealand's approach to artificial intelligence governance is light-touch and principles-based, but that does not mean there are no obligations. Government agencies face a layered set of requirements from multiple sources.
National AI Strategy (July 2025)
New Zealand was the last OECD country to publish its National AI Strategy. Aligned with OECD AI Principles, it emphasises adoption over development, voluntary guidance, and an agile approach to regulation. For government agencies, it sets the strategic direction: responsible AI adoption that reflects democratic values, fairness, transparency, and accountability. We help agencies operationalise these principles within their specific mandates.
Public Service AI Framework (February 2025)
Published on digital.govt.nz, this framework provides guidance on procurement, risk management, and responsible use of AI across the public service. While encouraged rather than mandated, Cabinet expectations and Ministerial oversight mean agencies face significant reputational and political risk if they deploy AI without reference to the framework. We help agencies align their operations to each element.
Privacy Act 2020
The primary legislation governing personal information in New Zealand. Its 13 Information Privacy Principles apply to every AI system that collects, uses, or discloses personal information. For government agencies, compliance requires purpose limitation, data accuracy for AI training sets, breach notification to the Privacy Commissioner, and safeguards for cross-border data transfers when using offshore AI vendors.
Treaty of Waitangi and Māori Data Sovereignty
Te Tiriti o Waitangi creates constitutional obligations that extend to how government agencies use AI. The National AI Strategy explicitly incorporates Treaty obligations and Māori perspectives into AI ethics. Agencies must consider Māori data governance, protect against algorithmic bias affecting Māori communities, and uphold kaitiakitanga in their AI programmes.
Common Questions From Government Agencies
Is the Public Service AI Framework mandatory?
The framework itself is guidance, not regulation. However, Cabinet expectations, Ministerial oversight, the Te Kawa Mataaho Public Service Commission, and public accountability mean agencies are expected to demonstrate they are following it. An agency that deploys AI without reference to the framework faces significant reputational and political risk. The Responsible AI Guidance for GenAI further strengthens these expectations for generative AI specifically. We help organisations build governance that satisfies these expectations while remaining proportionate to their AI maturity.
How does the Algorithm Charter for Aotearoa affect our agency?
The Algorithm Charter commits signatory agencies to transparency about how algorithms influence decisions about people, to meaningful community engagement, and to human oversight of algorithmic decision-making. If your agency has signed the Charter, these commitments need to be reflected in your AI governance documentation, procurement evaluation criteria, and public communications. Even for non-signatory agencies, the Charter sets a benchmark that the public and media increasingly expect all government organisations to meet.
What are our Treaty of Waitangi obligations for AI?
Government agencies have constitutional obligations under Te Tiriti o Waitangi. When AI systems process data about Māori, inform decisions that affect Māori communities, or are deployed in contexts with Treaty implications, agencies need to ensure Māori data sovereignty principles and kaitiakitanga are respected. This includes meaningful partnership with iwi and hapū, not just consultation as a checkbox exercise. The New Zealand National AI Strategy explicitly recognises these obligations.
How do we coordinate AI governance across multiple agencies?
Cross-agency AI projects, shared platforms, and all-of-government procurement arrangements all need coordinated governance. This means agreeing on shared risk assessment standards, data sharing protocols, vendor management responsibilities, and accountability for outcomes. Without explicit coordination, each organisation creates its own approach, leading to inconsistency and gaps. We have experience building shared governance approaches that work across agency boundaries while respecting each agency's distinct accountability structures.
What should our AI exit strategy look like?
The Public Service AI Framework and Government Procurement Rules both emphasise exit planning. For AI, this means ensuring you can retrieve your data, that models are not so tightly integrated that switching vendors causes service disruption, and that you retain ownership of any fine-tuned models or training data. Exit strategies should be defined before contract signing, not after a vendor relationship deteriorates. We build exit strategy documentation that protects both the agency and the New Zealand public.
How do OECD AI Principles shape our governance requirements?
New Zealand's National AI Strategy is explicitly aligned with the OECD AI Principles. These principles, covering human-centred values, fairness, transparency, robustness, and accountability, form the ethical foundation for government AI governance. In practical terms, this means your governance framework should demonstrate how each AI system respects rule of law, protects privacy, ensures security and safety, provides transparency to affected individuals, and maintains clear accountability chains. We translate these principles into actionable governance documentation.
Your Agency Has the AI Governance Framework. We Help You Operationalise It.
Book an implementation workshop to map the Public Service AI Framework and Algorithm Charter to your agency's specific context: your procurement pipeline, your risk appetite, your Treaty of Waitangi obligations, and your existing governance structures. Our team turns guidance into operational governance for New Zealand government agencies.