Māori Data Governance for Artificial Intelligence Systems
Embed Te Tiriti o Waitangi obligations and Māori data sovereignty principles into your AI governance framework. In Aotearoa New Zealand, these constitutional obligations are not optional, they are foundational to responsible AI.
Most AI governance frameworks are designed in overseas contexts that have no equivalent to Te Tiriti, no concept of Māori data sovereignty, and no grounding in te ao Māori values. They cannot guide New Zealand organisations on the obligations, relationships, and responsibilities that arise from our bicultural foundations. We work alongside Māori data governance expertise to build frameworks that honour tikanga Māori while integrating with your existing governance structures, helping your organisation move from good intentions to practical, culturally grounded action.
Why Māori data governance matters for AI
The relationship between AI and Māori data governance reflects deeper questions about power, rights, and responsibilities in Aotearoa New Zealand. Data about Māori individuals, whānau, hapū, and iwi is not simply "personal information" in the way the Privacy Act 2020 conceives of it. Within te ao Māori, data carries whakapapa. It reflects relationships, histories, and knowledge systems that belong to collectives, not just individuals. When AI systems process this data without understanding these dimensions, they risk causing harm that no privacy compliance checklist can anticipate.
New Zealand's National AI Strategy, released in July 2025, explicitly incorporates Treaty of Waitangi obligations and acknowledges the need for Māori perspectives to inform AI ethics. The OECD AI Principles that underpin the strategy emphasise fairness, transparency, and accountability, but these concepts take on particular meaning in the New Zealand context where the Crown's Treaty partner has distinct rights and expectations around data. Te Mana Raraunga, the Māori Data Sovereignty Network, has articulated principles that go beyond Western privacy frameworks to address collective data rights, the guardianship responsibilities inherent in kaitiakitanga, and the protection of mana in how data is collected, stored, shared, and used.
For organisations deploying AI in Aotearoa, this is not an abstract policy debate. Government agencies have explicit Treaty obligations. Healthcare organisations serving Māori communities must consider hauora and cultural safety. Financial services businesses making algorithmic decisions need to understand how bias affects Māori populations specifically. Technology companies building or deploying AI need governance that reflects the country they operate in. Māori data governance is where constitutional obligation, ethical responsibility, and practical governance intersect.
The gap most organisations do not know they have
Your organisation has probably deployed AI systems that process data about Māori communities, make decisions affecting Māori stakeholders, or operate where Treaty obligations apply. When was the last time your AI procurement included a cultural impact assessment? When did your governance framework consider Māori data sovereignty?
International frameworks ignore Treaty obligations
AI governance frameworks designed overseas provide no guidance on Te Tiriti o Waitangi, Māori data sovereignty, or te ao Māori perspectives in AI ethics. They were not built for Aotearoa New Zealand's bicultural context and cannot address the rights, relationships, and responsibilities that Te Tiriti creates. Adopting these frameworks without adaptation means your governance has a significant blind spot.
No framework for cultural impact assessment
You can assess AI for privacy risk, security risk, and operational risk. But can you assess for cultural harm? For impacts on mana whenua? For violations of kaitiakitanga principles? For the appropriation or misuse of mātauranga Māori? Without assessment methodologies grounded in te ao Māori, these risks remain invisible until harm occurs, and the harm may be to relationships and trust that are difficult to rebuild.
Good intentions without structured approaches
Te Tiriti requires partnership, active protection, and equity. The Algorithm Charter for Aotearoa commits government agencies to transparent, accountable algorithm use. Most organisations in New Zealand want to honour these commitments. What they lack is a structured approach that translates principles into governance practices: when to consult, how to engage meaningfully, what decision rights exist, and how to maintain accountability over time.
Te ao Māori principles in AI governance
Effective Māori data governance for AI draws on principles that have guided the responsible stewardship of knowledge and resources for generations. These principles are not add-ons to Western governance frameworks; they offer a distinct and valuable perspective on how AI should be developed, deployed, and governed in Aotearoa New Zealand.
Kaitiakitanga (guardianship and stewardship)
Kaitiakitanga speaks to the responsibility of guardianship, of caring for something so it can be passed on in good condition to future generations. Applied to AI and data, kaitiakitanga means treating data not as a resource to be extracted and exploited, but as a taonga (treasure) that requires careful, responsible stewardship. Organisations acting as kaitiaki of Māori data must consider the long-term consequences of how AI systems use, transform, and share that data.
Mana (authority, dignity, and prestige)
Mana encompasses authority, dignity, prestige, and the inherent worth of individuals and communities. When AI systems make decisions about Māori individuals or communities, the impact on mana must be considered. Does the AI system respect the mana of the people it affects? Does it preserve their dignity in how decisions are made and communicated? Do Māori communities have appropriate authority over how their data is used? Governance frameworks must create space for these questions.
Whakapapa (relationships and connections)
Whakapapa describes genealogy, lineage, and the web of relationships that connect people to one another and to the world around them. Data about Māori individuals exists within these relational networks. An individual's health data, for example, may carry implications for their whānau and wider community. AI systems that treat data as isolated individual records miss these collective dimensions. Governance must account for the relational nature of Māori data.
Rangatiratanga (sovereignty and self-determination)
Rangatiratanga refers to the right of Māori to exercise authority over their own affairs, including their data. Māori data sovereignty, as articulated by Te Mana Raraunga, asserts that Māori have inherent rights and interests in data about Māori people, language, culture, resources, and environments. AI governance must recognise these rights and create mechanisms for Māori to exercise meaningful control over how AI systems use data that is about them or derived from their communities.
Te Mana Raraunga and Māori data sovereignty in artificial intelligence
Te Mana Raraunga, the Māori Data Sovereignty Network, established the foundational principles that guide how organisations across Aotearoa should approach Māori data in AI systems. These principles assert that Māori data (data about Māori people, their communities, resources, and taonga) is subject to the rights and interests of Māori as a collective, not merely as individual data subjects under the Privacy Act 2020. This distinction is fundamental to responsible AI governance in New Zealand.
For organisations deploying AI, Te Mana Raraunga principles create obligations that go beyond what Privacy Act 2020 compliance alone can address. The Privacy Act protects individual privacy rights through its 13 Information Privacy Principles. Māori data governance addresses collective rights: the right of iwi and hapū to exercise rangatiratanga over data that describes their communities, their health outcomes, their economic participation, and their cultural practices. When an AI system aggregates, analyses, or makes decisions using this data, it must operate within governance frameworks that recognise Māori authority.
New Zealand's National AI Strategy and the OECD AI Principles both emphasise inclusive and equitable AI governance. In Aotearoa, this means ensuring that AI adoption does not replicate the data extraction patterns that have historically disadvantaged Māori communities. Our team helps organisations understand these obligations and build governance that honours them in practice, creating sustainable frameworks that strengthen over time through genuine partnership.
How we embed Māori data governance in AI frameworks
We work with Māori data governance experts and iwi advisors to build frameworks that reflect te ao Māori principles while integrating with your existing risk and compliance structures. This work requires cultural competency, humility, and genuine partnership.
Identify Māori data and assess impacts
We start by understanding where your AI systems intersect with Māori data and communities. Which systems process information about Māori individuals or communities? Where do AI decisions affect Māori stakeholders disproportionately? What data has cultural significance, contains whakapapa information, or relates to mātauranga Māori? This mapping exercise reveals the scope of Māori data governance obligations across your organisation and provides the foundation for targeted, meaningful governance.
Deliverable: Māori data mapping, impact inventory, scope assessment
Embed Treaty principles in AI governance
We integrate Te Tiriti o Waitangi principles into your AI governance framework: partnership (working with Māori as partners in decisions about their data, not just consulting after decisions are made), active protection (safeguarding Māori data sovereignty and preventing harm from AI systems), and equity (ensuring AI does not perpetuate or deepen existing inequities). This includes practical governance mechanisms: decision rights for cultural concerns, escalation pathways, and accountability structures that reflect genuine partnership rather than tokenistic engagement.
Deliverable: Treaty-aligned AI governance principles and decision framework
Build culturally grounded risk assessment
We create assessment methodologies that evaluate AI through a te ao Māori lens. Does this AI system respect mana? Is kaitiakitanga being practised in how data is collected, held, and shared? Have collective rights under whakapapa been considered alongside individual privacy rights under the Privacy Act 2020? Are there risks to mātauranga Māori from how the AI system processes or generates knowledge? These questions complement standard risk assessment and ensure cultural risks are identified alongside operational, privacy, and regulatory risks.
Deliverable: Cultural impact assessment methodology, templates, and guidance
Establish consultation and accountability structures
We help your organisation turn partnership into structured, repeatable processes: when and how to engage iwi, hapū, and Māori stakeholders in AI decisions, consultation protocols that respect tikanga, decision rights for cultural concerns that carry real weight, and ongoing monitoring with Māori participation. This creates sustainable governance rather than one-off consultation exercises, building relationships and capability that strengthen over time.
Deliverable: Consultation framework, accountability protocols, ongoing engagement strategy
Integrate with existing compliance and governance
Māori data governance does not replace your Privacy Act 2020 compliance, ISO 42001 processes, or sector-specific regulatory obligations. It strengthens them. We ensure your Māori data governance framework integrates with existing risk management, privacy compliance, and organisational governance structures so that Te Tiriti obligations are embedded in how your organisation makes decisions about AI, not bolted on as an afterthought.
Deliverable: Integrated governance framework, compliance mapping, implementation roadmap
Who needs Māori data governance for AI
Government agencies and Crown entities
Central and local government organisations have explicit Te Tiriti o Waitangi obligations. If you are deploying AI that affects Māori communities, handles Māori data, or operates in areas where Treaty principles apply, you need governance that reflects these obligations. The Public Service AI Framework and Algorithm Charter for Aotearoa both reference Treaty commitments, but translating these into operational governance requires specialist support and genuine engagement with Māori perspectives.
Examples: Government ministries, local councils, Te Whatu Ora, education providers, social service agencies
Healthcare organisations
Health data about Māori communities requires particular care under both the Health Information Privacy Code 2020 and Treaty obligations. AI in healthcare must consider hauora Māori, health equity, and cultural safety. The significant health disparities experienced by Māori mean that AI systems deployed without cultural governance risk perpetuating or deepening inequities. Te Whatu Ora and district health organisations need frameworks that centre hauora Māori in AI governance.
Examples: Te Whatu Ora, private hospitals, primary care networks, aged care providers, mental health services
Organisations handling Māori data
Any organisation processing information about Māori individuals or communities, whether through surveys, service delivery, research, or commercial operations, has responsibilities around Māori data sovereignty. When AI processes this data, the governance obligations are amplified. Automated decisions, pattern recognition, and predictive analytics all raise specific concerns about how Māori data is used and who benefits from the insights generated.
Examples: Research organisations, social service providers, educational institutions, NGOs
Government contractors and technology vendors
Technology businesses and consultancies selling AI systems to government agencies in Aotearoa New Zealand need to demonstrate Treaty-aligned governance to win and retain contracts. The Public Service AI Framework and Government Procurement Rules increasingly expect suppliers to demonstrate cultural competency and Māori data governance capability. Building this into your practices is both a business requirement and an ethical responsibility.
Examples: SaaS providers, AI platform vendors, consultancies, system integrators
Frequently asked questions
Is Māori data governance a legal requirement?
Te Tiriti o Waitangi creates constitutional obligations for the Crown and, through various legislation, for organisations operating in Aotearoa New Zealand. While there is no single statute titled "Māori Data Governance Act," the Treaty principles of partnership, active protection, and equity apply across government and increasingly inform expectations for the private sector. The National AI Strategy explicitly incorporates Treaty obligations. For government agencies and Crown entities, these obligations are clear and enforceable. For private sector organisations, Māori data governance is a growing expectation from iwi, regulators, and the broader community.
How does Māori data governance relate to Privacy Act 2020 compliance?
The Privacy Act 2020 protects individual privacy rights through its 13 Information Privacy Principles. Māori data governance addresses complementary but distinct concerns: collective data rights, cultural safety, and the sovereignty of Māori over data about their people, language, culture, and resources. An AI system can be fully compliant with the Privacy Act while still failing to honour Māori data governance obligations. Both frameworks must be addressed for responsible AI governance in New Zealand.
What does kaitiakitanga mean in practice for AI governance?
Kaitiakitanga, the principle of guardianship and stewardship, means treating Māori data as a taonga to be cared for rather than a resource to be extracted. In practical AI governance terms, this translates to establishing clear stewardship responsibilities for Māori data, ensuring data is used in ways that benefit the communities it comes from, maintaining data quality and security, considering the long-term consequences of AI processing, and creating mechanisms for Māori communities to exercise oversight over how their data is used in AI systems.
Do private sector organisations need Māori data governance?
If your organisation processes data about Māori individuals or communities through AI systems, the answer is yes. This is particularly true for businesses seeking government contracts, operating in regulated sectors like financial services or healthcare, or building AI products for the New Zealand market. Beyond legal and commercial considerations, Māori data governance reflects good practice and cultural respect in a bicultural nation. Businesses that take this seriously build stronger relationships with Māori stakeholders and demonstrate the kind of responsible leadership that benefits all of Aotearoa.
Ready to honour Treaty obligations in your AI governance?
Schedule a consultation to discuss how our team can help your organisation integrate Māori data governance into your AI frameworks, with the cultural competency, respect, and genuine partnership this important work requires.
Confidential discussion. Culturally grounded expertise. Aotearoa New Zealand-specific knowledge.