Māori data sovereignty and Māori data governance for organisations building AI in Aotearoa.

The Māori Data Governance Model reads Article 2 as guaranteeing protection of iwi and hapū tino rangatiratanga over their taonga, which in a modern context includes data. Section 14 of the Public Service Act 2020 requires the public service to support the Crown's Treaty relationships.

The Waitangi Tribunal found the risks to Māori interests from the agreement's e-commerce provisions were significant and that relying on exceptions to manage them fell short of the Crown's duty of active protection. It treated mātauranga Māori as central to Māori identity. The Tribunal made no recommendations because the Crown changed position and agreed to a review of digital trade policy.

WAI 262, Ko Aotearoa Tēnei, is the Tribunal inquiry into flora, fauna and mātauranga Māori. It is the basis the Model and MBIE use for treating data as taonga. It is not a data ruling. WAI 2575, the health services inquiry, underpins HISO 10094:2022, the Health New Zealand protocol for Māori descent and iwi affiliation data.

The Whānau Ora Commissioning Agency sought identifiable data on unvaccinated Māori in Te Ika-a-Māui. The High Court held the Ministry of Health did not have adequate regard to Te Tiriti and its principles as informed by tikanga when exercising its discretion under rule 11 of the Health Information Privacy Code. The Ministry released the data under conditions. The case confirms that tikanga can be a relevant factor in how the privacy principles are interpreted.

Pou 8 of the Māori Data Governance Model supplies the questions. Is this Māori data, and is that status fixed regardless of context? Is it of special significance to specific collectives, such as iwi affiliation, whakapapa or mātauranga? Is it for, about or by Māori? Does it need special protection, such as storage in a Māori-controlled facility, repatriation or encryption? Does it carry economic opportunity? Is it sensitive? Run every dataset in the AI inventory through those questions and record the answers against the dataset, with the tapu or noa status as a field.

The Model also lists what not to do: assume a universal data ontology, outsource the ontology to a party with no understanding of te ao Māori, treat Māori data as sitting on a spectrum of more or less Māori, use an arbitrary proportion threshold to decide whether governance applies, or confuse Māori data with data that Māori need.

Worked examples. A hospital's iwi affiliation field is governed by HISO 10094:2022 and sits at the collective-significance end. A bank's customer ethnicity flag is Māori data even after the bank aggregates it for a lending model. A council's environmental sensor data about a river is Māori data where the river is a taonga of mana whenua. A recorded te reo Māori customer call is Māori data whether or not the caller is Māori. Māori decision: the tapu or noa status of each dataset and the classification ontology itself. The Model says the ontology must be Māori-led and designed.

The decision path has three steps. First, check whether the use was within the purpose the data was collected for; a model trained on data collected for service delivery is a new purpose. Second, check whether the data has collective significance under the classification above. Pou 4 of the Model states that individual consent is inadequate where collective interests and risks exist, and asks what would constitute a collective privacy violation. Third, where collective significance exists, identify the collective, which will be a whānau, hapū, marae or rūnanga, rōpū Māori or iwi.

Free, prior and informed consent from that collective is then the standard, per Te Mana Raraunga principle 5.2 and the Te Kāhui Raraunga AI Framework, which also says never to share data where consent was not given for reuse or integration. Where consent is less defined, the principles require stronger governance arrangements to compensate, which in practice means a documented decision by the collective's representatives and a review date. Māori decision: whether collective consent is required, and whether it is given.

Te Kāhui Raraunga has recommended that Māori data sovereignty requirements be written into cloud contracts, and the Model names the US CLOUD Act as a jurisdictional risk. The contract clauses we draft cover storage location and any change to it; disclosure of the provider's exposure to foreign compelled-access laws; a prohibition on using the organisation's data to train the provider's models; disclosure of any synthetic data generated from it; return or deletion of Māori data on exit with evidence; and sub-processor transparency.

For public service agencies the Cloud First directives at paragraphs 48.5 to 48.8 apply on top, and the decision record needs to show the Te Tiriti and Māori data consideration the directive requires. The Model's preference is onshoring wherever practicable with Māori involved in the decision. Māori decision: the storage location for datasets with collective significance. See also third-party AI risk.

Pou 6 and 7 of the Te Kāhui Raraunga AI Framework ask that every algorithm's whakapapa be documented, including the data it was trained on, real or synthetic, and that algorithms be registered, tested, critiqued and retested. An organisation certifying against ISO/IEC 42001:2023 already has the places to put this. The table shows where each requirement lands.

The Office of the Privacy Commissioner also expects overseas systems to be checked for accuracy on Māori before use. Large foundation models were trained on scraped te reo Māori content with no input from Māori, so the provenance record has to reach past your fine-tuning data to the foundation model underneath it.

Section 15 of the Data and Statistics Act 2022 binds only the Government Statistician, and it is still the clearest statutory statement of what good engagement looks like: it begins early, it is meaningful, it includes an early discussion about how to engage in the particular context, and it considers opportunities for Māori to partner. An engagement plan for an AI programme uses those four tests as its structure, adds the Te Arawhiti engagement guidelines that GCDO guidance points to, and budgets for Māori participation. Pou 1 of the Model names the cultural tax placed on Māori staff and advisors who are asked for unpaid cultural advice. MBIE's business guidance asks that Māori sit on the governance board.

PolyGovern facilitates the process. Mana whenua and the relevant iwi, hapū or Māori organisations hold the relationship, and the plan says so. Māori decision: who the right parties are and how they wish to engage. Related: AI governance for government agencies.

Te Aka Whai Ora, the Māori Health Authority, has been disestablished. Iwi Māori Partnership Boards and the Hauora Māori Advisory Committee remain. Health New Zealand has not published a Māori data sovereignty framework. The working instruments are HISO 10094:2022 for Māori descent and iwi affiliation fields, rule 11 of the Health Information Privacy Code as read in Te Pou Matakana, and the Privacy Act. Te Arawa's partnership board and Te Taura Ora o Waiariki have both started their own Māori health data platforms. Our healthcare AI governance page covers the clinical side.

Boards should hold their data and digital strategies and bring the same due diligence to them that they bring to finance. The questions for directors: which of our datasets are Māori data, who decided their status, which AI systems use them, whose consent covers that use, where are they hosted and under whose jurisdiction, and who at the board table is accountable for the answers.