Our methodology
The Evidence-First Method.
Most AI governance work produces a document that describes good intentions. Ours produces evidence that controls exist and are operating, captured as you go, in a form a regulator or your board can read on any given day.
Four phases, each tied to a defined artefact, with Te Tiriti obligations designed in from Phase 1 and assurance that continues after go-live.
Map
You cannot govern what you have not located.
Every AI system, data flow and automated decision point goes into an inventory, including the tools staff adopted without asking. Each entry is classified against the regimes that reach it in New Zealand: the Privacy Act 2020 and its 13 information privacy principles, Te Tiriti obligations and Māori data governance expectations, the Algorithm Charter and the Public Service AI Framework for agencies, FMA and RBNZ conduct and prudential expectations, and ISO/IEC 42001 scope. Exporters also get an EU AI Act risk tier.
Output
An AI system inventory and a classification register, the baseline every later phase is measured against.
NIST Map · ISO 42001 Plan
Frame
Nothing is governance for its own sake.
The governance architecture comes next: policies, roles, accountabilities, risk appetite and the operating model that connects them. Each control is traced to the obligation it discharges, so a privacy principle, an Algorithm Charter commitment or a Māori data governance expectation has a named control and a named owner. Te Tiriti considerations are designed in at this stage rather than reviewed at the end.
Output
A governance framework, policy stack, accountability map and a control-to-obligation traceability matrix.
NIST Govern · ISO 42001 Plan
Control
Policy that sits in a folder is not a control.
The framework is embedded into the workflows that carry the risk: the model lifecycle, approval gates, third-party onboarding, privacy impact assessments and incident handling. Evidence capture becomes part of business as usual, so a request from the Office of the Privacy Commissioner can be answered from records that already exist.
Output
Implemented controls, approval gates, model governance procedures and a standing evidence trail.
NIST Measure + Manage · ISO 42001 Do
Assure
An evidence position that is current on the day someone asks for it.
Independent verification that the controls are working, reported at board and supervisory grade on a defined cycle. The evidence position can go in front of the Privacy Commissioner, the FMA, the RBNZ, the Auditor-General or your own risk committee whenever they ask, and the Te Tiriti and Māori data governance commitments are tested on the same cadence as everything else.
Output
Assurance reports and a regulator-ready evidence pack, refreshed on a defined cycle.
NIST Manage · ISO 42001 Check + Act
Why the method ends in continuous assurance.
AI systems change after they go live. A governance model that stops at deployment leaves the Office of the Privacy Commissioner, an auditor, or your board looking at evidence that no longer matches the system in production.
Phase 4 closes that gap. Board reporting and a defined refresh cycle carry the governance forward, so the evidence pack stays current between reviews. Te Tiriti obligations and Māori data sovereignty are held through the same cadence rather than reviewed once and filed away.
Every service sits inside a phase.
You can engage the whole method end to end, or start at the phase where your gap is. Each service below produces the artefact that phase contributes to the evidence pack.
See full service detailPhase 01
Map
Phase 02
Frame
Phase 03
Control
How the method runs as a programme.
The four phases run in sequence. Each one ends at a decision gate the sponsor signs, and the artefact from one phase is the input to the next. Most organisations need 6 to 9 months to reach a defensible position, and Phase 4 keeps it current from there. The sequence below is what a New Zealand organisation works through, with the instrument each step answers to.
The PolyGovern AI Governance Framework sets out the eleven elements these phases build, and the maturity model describes the evidence that marks each level. The AI Risk Calculator gives a baseline read before Phase 1 opens.
Māori data decisions are taken in Phase 2 with the organisation's iwi and Māori partners. The Māori data governance page covers that work, and the Privacy Act 2020 page covers the IPP 3A and PIA steps.
Phase 01
Map
Allow 4 to 6 weeks
Algorithm Charter risk matrix · IPP 3A · OPC expectation of a PIA before use · ISO 42001 clause 4
Workstreams
- /AI inventory, including the tools staff adopted on their own.
- /Classification of each system against the Privacy Act 2020, the Algorithm Charter risk matrix for signatory agencies, Te Tiriti and Māori data considerations, and ISO/IEC 42001 scope.
- /Collection notice review for personal information gathered from a source other than the individual, which IPP 3A has required since 1 May 2026.
- /An accountable owner named against every system.
In hand at the end
A classified AI inventory with an owner on every entry, and the list of systems that need a privacy impact assessment before anything else happens.
Decision gate
The sponsor confirms the inventory is complete. A system that is not on it does not move to Phase 2.
Phase 02
Frame
Allow 6 to 8 weeks
PSAIF Governance and Guardrails pillars · Algorithm Charter Partnership commitment · MBIE guidance · ISO 42001 clauses 5 and 6
Workstreams
- /AI policy written against MBIE's Responsible AI Guidance for Businesses for private organisations, or the Public Service AI Framework principles for agencies.
- /Roles and accountability, including the senior official the GCDO generative AI guidance recommends for oversight.
- /Risk appetite statement with the thresholds that trigger escalation.
- /Māori data governance position, agreed with the iwi and Māori partners the organisation already works with.
In hand at the end
A policy stack, an accountability map and a control-to-obligation matrix that names which control answers which privacy principle, Charter commitment or framework principle.
Decision gate
The board or the chief executive adopts the policy and the risk appetite. Controls are not built against an appetite nobody has approved.
Phase 03
Control
Allow 8 to 12 weeks
Algorithm Charter Transparency and Human oversight commitments · OPC PIA expectation · Biometric Processing Privacy Code where biometrics are processed · ISO 42001 clause 8
Workstreams
- /Approval gates in the model lifecycle and in procurement, using the topics in MBIE's AI Procurement Checklist for supplier terms.
- /Privacy impact assessments on the schedule Phase 1 produced, updated when a system changes.
- /Human oversight points with a named contact and a channel to challenge a decision, which the Algorithm Charter asks signatory agencies to provide.
- /Evidence capture inside each workflow, so the record exists before anyone asks for it.
In hand at the end
Operating controls with an evidence trail, and a privacy impact assessment on file for every system that needed one.
Decision gate
Each control is tested once in operation and the result is recorded. A control with no record does not pass.
Phase 04
Assure
Ongoing, tested and reported each quarter
PSAIF accountability principle (reporting, auditing, independent review) · ISO 42001 clauses 9 and 10
Workstreams
- /Control testing on a cycle the risk committee sets.
- /Board reporting with drift, incident and complaint metrics.
- /Evidence pack refresh, so the version in the file matches the system in production.
- /A watch on the instruments still moving: the Law Commission review of automated decision-making by government, and the Public Service AI Assurance Regime, which is under development.
In hand at the end
Assurance reports and a current evidence pack that can go to the Privacy Commissioner, the FMA, the RBNZ, the Auditor-General or the board on the day they ask.
Decision gate
No exit gate exists. The cycle runs again, and a new system joins at Phase 1.
Questions about running the roadmap in New Zealand.
Does New Zealand require an AI governance programme by law?
No statute requires one. New Zealand's AI Strategy takes a light-touch, principles-based regulatory stance, with existing privacy, consumer and human rights law applying as it stands. The pressure comes from those laws, from the Office of the Privacy Commissioner's expectations, and from the Public Service AI Framework for agencies. Each phase of the roadmap answers one of them.
Is the Public Service AI Framework binding on agencies?
No. The Framework is non-binding. It sets five principles and six pillars for the GCDO work programme. The Algorithm Charter is a voluntary commitment by the agencies that signed it. Neither applies to private organisations, which is why the roadmap uses MBIE's Responsible AI Guidance for Businesses as the reference for them.
Where does IPP 3A fit in the roadmap?
In Phase 1. IPP 3A commenced on 1 May 2026 and applies to personal information collected from a source other than the individual on or after that date. Scraped, inferred or vendor-supplied data used in an AI system is indirect collection, so the inventory records the source of each system's data and the notice that was given. It does not reach information collected before that date.
Can we start at Phase 3 because we already have an AI policy?
Only if the inventory and the control-to-obligation matrix exist. A policy without an inventory cannot say which systems it governs, and Phase 3 builds controls against the matrix. Most organisations that arrive with a policy spend a short Phase 1 and Phase 2 confirming what the policy covers, then move on.
How does the roadmap handle Māori data?
As a Phase 2 governance decision. The organisation's position on Māori data is agreed with the iwi and Māori partners it already works with before any control is built, then tested in Phase 4 on the same cycle as everything else. The detail sits on the Māori data governance page.
What does the board see at the end of each phase?
A single artefact from each phase: the classified inventory, then the adopted policy and risk appetite, then the control test results, then the assurance report. The maturity model page sets out the evidence that marks each level, and the AI Risk Calculator gives a first read before Phase 1 starts.
Start with a map. Leave with an evidence pack.
Run the calculator for a baseline read on your exposure, then we scope the phase that fits where you are and outline the work to close the gap.