AI governance grounded in Te Tiriti o Waitangi and Māori data sovereignty.
Within te ao Māori, data carries whakapapa. It reflects relationships, histories, and knowledge systems that belong to collectives, not just individuals. AI governance in Aotearoa must hold that weight before it holds anything else.
We work alongside Māori data governance expertise to build frameworks that honour tikanga Māori while integrating with your existing governance structures. The aim is genuine partnership and practical, culturally grounded action, not a bolt-on appendix.
For
Why Māori data governance matters for AI.
The relationship between AI and Māori data governance reflects deeper questions about power, rights, and responsibilities in Aotearoa New Zealand. Data about Māori individuals, whānau, hapū, and iwi is not simply "personal information" in the way the Privacy Act 2020 conceives of it. Within te ao Māori, data carries whakapapa. It reflects relationships, histories, and knowledge systems that belong to collectives, not just individuals. When AI systems process this data without understanding these dimensions, they risk causing harm that no privacy compliance checklist can anticipate.
New Zealand's National AI Strategy, released in July 2025, explicitly incorporates Treaty of Waitangi obligations and acknowledges the need for Māori perspectives to inform AI ethics. The OECD AI Principles that underpin the strategy emphasise fairness, transparency, and accountability. In the New Zealand context, where the Crown's Treaty partner has distinct rights and expectations around data, those concepts take on particular meaning. Te Mana Raraunga, the Māori Data Sovereignty Network, has articulated principles that go beyond Western privacy frameworks to address collective data rights, the guardianship responsibilities inherent in kaitiakitanga, and the protection of mana in how data is collected, stored, shared, and used.
For organisations deploying AI in Aotearoa, this is not an abstract policy debate. Government agencies have explicit Treaty obligations. Healthcare organisations serving Māori communities must consider hauora and cultural safety. Financial services businesses making algorithmic decisions need to understand how bias affects Māori populations specifically. Technology companies building or deploying AI need governance that reflects the country they operate in. Māori data governance is where constitutional obligation, ethical responsibility, and practical governance intersect.
The gap most organisations do not know they have.
Your organisation has probably deployed AI systems that process data about Māori communities, make decisions affecting Māori stakeholders, or operate where Treaty obligations apply. When was the last time your AI procurement included a cultural impact assessment?
- 01Framework blind spot
International frameworks ignore Treaty obligations.
AI governance frameworks designed overseas provide no guidance on Te Tiriti o Waitangi, Māori data sovereignty, or te ao Māori perspectives in AI ethics. They were not built for Aotearoa New Zealand's bicultural context and cannot address the rights, relationships, and responsibilities that Te Tiriti creates. Adopting these frameworks without adaptation means your governance has a significant blind spot.
- 02Cultural risk
No framework for cultural impact assessment.
You can assess AI for privacy risk, security risk, and operational risk. Can you assess for cultural harm? For impacts on mana whenua? For violations of kaitiakitanga principles? For the appropriation or misuse of mātauranga Māori? Without assessment methodologies grounded in te ao Māori, these risks remain invisible until harm occurs, and the harm may be to relationships and trust that are difficult to rebuild.
- 03Intent without structure
Good intentions without structured approaches.
Te Tiriti requires partnership, active protection, and equity. The Algorithm Charter for Aotearoa commits government agencies to transparent, accountable algorithm use. Most organisations want to honour these commitments. What they lack is a structured approach that translates principles into governance practices: when to consult, how to engage meaningfully, what decision rights exist, and how to maintain accountability over time.
Te ao Māori principles in AI governance.
These principles have guided responsible stewardship of knowledge and resources for generations. They are not add-ons to Western governance frameworks. They offer a distinct and valuable perspective on how AI should be developed, deployed, and governed in Aotearoa.
Kaitiakitanga: guardianship and stewardship
Kaitiakitanga speaks to the responsibility of guardianship, of caring for something so it can be passed on in good condition to future generations. Applied to AI and data, kaitiakitanga means treating data not as a resource to be extracted and exploited, but as a taonga that requires careful, responsible stewardship. Organisations acting as kaitiaki of Māori data must consider the long-term consequences of how AI systems use, transform, and share that data.
Mana: authority, dignity, prestige
Mana encompasses authority, dignity, prestige, and the inherent worth of individuals and communities. When AI systems make decisions about Māori individuals or communities, the impact on mana must be considered. Does the AI system respect the mana of the people it affects? Does it preserve their dignity in how decisions are made and communicated? Do Māori communities have appropriate authority over how their data is used? Governance frameworks must create space for these questions.
Whakapapa: relationships and connections
Whakapapa describes genealogy, lineage, and the web of relationships that connect people to one another and to the world around them. Data about Māori individuals exists within these relational networks. An individual's health data, for example, may carry implications for their whānau and wider community. AI systems that treat data as isolated individual records miss these collective dimensions. Governance must account for the relational nature of Māori data.
Rangatiratanga: sovereignty and self-determination
Rangatiratanga refers to the right of Māori to exercise authority over their own affairs, including their data. Māori data sovereignty, as articulated by Te Mana Raraunga, asserts that Māori have inherent rights and interests in data about Māori people, language, culture, resources, and environments. AI governance must recognise these rights and create mechanisms for Māori to exercise meaningful control over how AI systems use data that is about them or derived from their communities.
Te Mana Raraunga and Māori data sovereignty in AI.
Te Mana Raraunga, the Māori Data Sovereignty Network, established the foundational principles that guide how organisations across Aotearoa should approach Māori data in AI systems. These principles assert that Māori data (data about Māori people, their communities, resources, and taonga) is subject to the rights and interests of Māori as a collective, not merely as individual data subjects under the Privacy Act 2020. This distinction is fundamental to responsible AI governance in New Zealand.
For organisations deploying AI, Te Mana Raraunga principles create obligations that go beyond what Privacy Act 2020 compliance alone can address. The Privacy Act protects individual privacy rights through its 13 Information Privacy Principles. Māori data governance addresses collective rights: the right of iwi and hapū to exercise rangatiratanga over data that describes their communities, their health outcomes, their economic participation, and their cultural practices. When an AI system aggregates, analyses, or makes decisions using this data, it must operate within governance frameworks that recognise Māori authority.
New Zealand's National AI Strategy and the OECD AI Principles both emphasise inclusive and equitable AI governance. In Aotearoa, that means ensuring AI adoption does not replicate the data extraction patterns that have historically disadvantaged Māori communities. We help organisations understand these obligations and build governance that honours them in practice, creating sustainable frameworks that strengthen over time through genuine partnership.
How we embed Māori data governance in AI frameworks.
We work with Māori data governance experts and iwi advisors to build frameworks that reflect te ao Māori principles while integrating with your existing risk and compliance structures. This work requires cultural competency, humility, and genuine partnership.
01
Identify Māori data and assess impacts
We start by understanding where your AI systems intersect with Māori data and communities. Which systems process information about Māori individuals or communities? Where do AI decisions affect Māori stakeholders disproportionately? What data has cultural significance, contains whakapapa information, or relates to mātauranga Māori? Output: Māori data mapping, impact inventory, scope assessment.
02
Embed Treaty principles
We integrate Te Tiriti o Waitangi principles into your AI governance framework: partnership (working with Māori as partners in decisions about their data, not just consulting after decisions are made), active protection (safeguarding Māori data sovereignty and preventing harm from AI systems), and equity (ensuring AI does not perpetuate or deepen existing inequities). Output: Treaty-aligned AI governance principles and decision framework.
03
Build culturally grounded risk assessment
We create assessment methodologies that evaluate AI through a te ao Māori lens. Does this AI system respect mana? Is kaitiakitanga being practised in how data is collected, held, and shared? Have collective rights under whakapapa been considered alongside individual privacy rights under the Privacy Act 2020? Are there risks to mātauranga Māori from how the AI system processes or generates knowledge? Output: cultural impact assessment methodology, templates, and guidance.
04
Establish consultation structures
We help your organisation turn partnership into structured, repeatable processes: when and how to engage iwi, hapū, and Māori stakeholders in AI decisions, consultation protocols that respect tikanga, decision rights for cultural concerns that carry real weight, and ongoing monitoring with Māori participation. Sustainable governance, not one-off consultation exercises. Output: consultation framework, accountability protocols, ongoing engagement strategy.
05
Integrate with existing governance
Māori data governance does not replace your Privacy Act 2020 compliance, ISO/IEC 42001:2023 processes, or sector-specific regulatory obligations. It strengthens them. We ensure Māori data governance integrates with existing risk management, privacy compliance, and organisational governance so Te Tiriti obligations are embedded in how decisions are made, not bolted on. Output: integrated governance framework, compliance mapping, implementation roadmap.
Who needs Māori data governance for AI.
The Treaty obligations and data sovereignty expectations apply differently across sectors, but the underlying responsibility is shared.
Government agencies and Crown entities
Central and local government organisations have explicit Te Tiriti o Waitangi obligations. If you are deploying AI that affects Māori communities, handles Māori data, or operates in areas where Treaty principles apply, you need governance that reflects these obligations. The Public Service AI Framework and Algorithm Charter for Aotearoa both reference Treaty commitments, but translating these into operational governance requires specialist support and genuine engagement with Māori perspectives.
Healthcare organisations
Health data about Māori communities requires particular care under both the Health Information Privacy Code 2020 and Treaty obligations. AI in healthcare must consider hauora Māori, health equity, and cultural safety. The significant health disparities experienced by Māori mean that AI systems deployed without cultural governance risk perpetuating or deepening inequities. Te Whatu Ora and district health organisations need frameworks that centre hauora Māori in AI governance.
Organisations handling Māori data
Any organisation processing information about Māori individuals or communities, whether through surveys, service delivery, research, or commercial operations, has responsibilities around Māori data sovereignty. When AI processes this data, the obligations are amplified. Automated decisions, pattern recognition, and predictive analytics all raise specific concerns about how Māori data is used and who benefits from the insights generated.
Government contractors and technology vendors
Technology businesses and consultancies selling AI systems to government agencies in Aotearoa New Zealand need to demonstrate Treaty-aligned governance to win and retain contracts. The Public Service AI Framework and Government Procurement Rules increasingly expect suppliers to demonstrate cultural competency and Māori data governance capability. Building this into your practices is both a business requirement and an ethical responsibility.
Frequently asked questions.
Is Māori data governance a legal requirement?
Te Tiriti o Waitangi creates constitutional obligations for the Crown and, through various legislation, for organisations operating in Aotearoa New Zealand. While no single statute is titled "Māori Data Governance Act," the Treaty principles of partnership, active protection, and equity apply across government and increasingly inform expectations for the private sector. The National AI Strategy explicitly incorporates Treaty obligations. For government agencies and Crown entities, these obligations are clear and enforceable. For private sector organisations, Māori data governance is a growing expectation from iwi, regulators, and the broader community.
How does Māori data governance relate to Privacy Act 2020 compliance?
The Privacy Act 2020 protects individual privacy rights through its 13 Information Privacy Principles. Māori data governance addresses complementary but distinct concerns: collective data rights, cultural safety, and the sovereignty of Māori over data about their people, language, culture, and resources. An AI system can be fully compliant with the Privacy Act while still failing to honour Māori data governance obligations. Both frameworks must be addressed for responsible AI governance in New Zealand.
What does kaitiakitanga mean in practice for AI governance?
Kaitiakitanga, the principle of guardianship and stewardship, means treating Māori data as a taonga to be cared for rather than a resource to be extracted. In practical AI governance terms, this translates to establishing clear stewardship responsibilities for Māori data, ensuring data is used in ways that benefit the communities it comes from, maintaining data quality and security, considering the long-term consequences of AI processing, and creating mechanisms for Māori communities to exercise oversight over how their data is used in AI systems.
Do private sector organisations need Māori data governance?
If your organisation processes data about Māori individuals or communities through AI systems, the answer is yes. This is particularly true for businesses seeking government contracts, operating in regulated sectors like financial services or healthcare, or building AI products for the New Zealand market. Beyond legal and commercial considerations, Māori data governance reflects good practice and cultural respect in a bicultural nation. Businesses that take this seriously build stronger relationships with Māori stakeholders and demonstrate the kind of responsible leadership that benefits all of Aotearoa.
Building Treaty-aligned AI governance starts with a conversation.
We work alongside Māori data governance expertise to integrate Te Tiriti obligations into AI frameworks with cultural competency, respect, and genuine partnership. Confidential discussion. Aotearoa-specific knowledge.