An AI risk management framework for Aotearoa's light-touch regulatory landscape.
New Zealand has no AI-specific risk regulation. The burden of deciding how AI risk is classified, assessed, and reported falls on your organisation, and under the Companies Act 1993, on your directors personally. We design the standing framework that answers that question once: taxonomy, risk appetite, assessment method, controls library, and board reporting, aligned to NIST AI RMF, ISO/IEC 23894, ISO 31000, and the Privacy Act 2020.
Built for
What the framework contains.
How we build itNZ AI risk taxonomy
Classification covering Privacy Act 2020 violations, Fair Trading Act breaches, Treaty of Waitangi obligation failures, Māori data sovereignty risks, and algorithmic bias against Māori and Pacific communities.
AI risk appetite statement
Board-approved tolerances for each risk category, tied to Companies Act 1993 sections 131-138, so every future assessment has a line to measure against.
Assessment methodology
A tiered method and templates your own team runs on each AI system, with Te Tiriti, Māori data sovereignty, and cultural safety built in as a standing dimension.
Risk register and controls library
Pre-populated AI risk register with NZ-specific risks plus 50+ controls covering Fair Trading Act checks, Privacy Act safeguards, cultural safety reviews, and Algorithm Charter alignment.
The voluntary approach has a catch.
Light-touch regulation sounds like freedom. In practice, every AI risk decision your organisation makes is a judgement call. If that judgement turns out to be wrong, there is no prescribed standard to point to as a defence.
- 01Personal liability
Director exposure under the Companies Act.
Section 137 of the Companies Act 1993 requires directors to exercise reasonable care, diligence, and skill. If an AI system causes harm and the board cannot demonstrate it understood and managed the risks, directors face personal liability. Most boards have no AI risk framework to rely on.
Board-level AI governance - 02Constitutional obligation
Treaty obligations add unique complexity.
AI systems that process data relating to Māori and Pacific communities carry risk dimensions that do not exist anywhere else. Māori data sovereignty, cultural safety, and Treaty of Waitangi obligations create risk categories that no off-the-shelf framework addresses. Te Tiriti o Waitangi demands controls built specifically for Aotearoa.
Māori data governance - 03Multiple statutes
Multiple laws, no unified view.
Privacy Act 2020 covers personal information. Fair Trading Act 1986 covers misleading conduct. Companies Act 1993 covers director duties. Consumer Guarantees Act covers service quality. Your AI risks sit across all of them, but no single framework connects the dots. We build the integrated risk view your organisation needs.
Privacy Act compliance guide
Built for a market without a rulebook.
Importing an overseas risk framework and bolting it onto your organisation does not work. We use the ISO 31000 risk process as the spine, NIST AI RMF and ISO/IEC 23894 for the AI-specific content, and rebuild the taxonomy, appetite, and controls around obligations unique to Aotearoa.
01
NZ regulatory risk mapping
We map every AI use case against specific NZ legislation: Privacy Act 2020 information privacy principles, Fair Trading Act misleading conduct provisions, Companies Act director duties, and sector-specific obligations from the FMA or RBNZ. Every risk is tied to an actual legal obligation.
02
AI risk taxonomy for Aotearoa
A risk classification system that includes the categories generic frameworks miss: Māori data sovereignty risks, cultural safety impacts for Māori and Pacific populations, Treaty of Waitangi obligation breaches, vendor concentration risks from offshore AI providers, and algorithmic bias affecting communities already underserved.
03
Risk appetite and tolerance setting
We work with the board to set how much AI risk the organisation will accept in each category, expressed as tolerances an assessor can test against. The appetite statement is framed around Companies Act section 137 duties, so directors can show they defined "reasonable care" before any incident.
04
Controls and mitigations design
For each identified risk: Privacy Act 2020 compliance checkpoints, Fair Trading Act content review processes, cultural safety evaluation workflows, vendor dependency thresholds, and model performance boundaries. Controls are practical enough to actually implement.
05
Governance integration and reporting
We embed AI risk into your existing governance structures rather than layering on another committee. Board reporting templates translate AI risk into language directors can act on, with clear escalation triggers and decision rights tied to your organisational risk appetite.
Framework deliverables.
Every deliverable is built for Aotearoa's legal and cultural context. To assess a single system before deployment, see AI risk assessment.
NZ AI risk taxonomy
A classification system covering Privacy Act 2020 violations, Fair Trading Act breaches, Treaty of Waitangi obligation failures, Māori data sovereignty risks, algorithmic bias against Māori and Pacific communities, and vendor concentration exposure. Delivered as a structured document and Excel file for GRC integration.
Standards alignment map
A traceability matrix showing where each framework element satisfies NIST AI RMF (Govern, Map, Measure, Manage), ISO/IEC 23894 guidance, the ISO 31000 process, the 13 information privacy principles, and ISO/IEC 42001 Annex B. One document answers the auditor, the regulator, and the certification body.
Assessment methodology and templates
The tiered method your team runs on every AI system from now on: intake questionnaire, classification rules, scoring rubric, and sign-off template. Te Tiriti o Waitangi obligations, Māori data sovereignty, and cultural safety for Māori and Pacific populations are a standing dimension of the method.
AI risk appetite statement
A board-approved statement of how much AI risk the organisation will accept in each taxonomy category, with measurable tolerances and escalation triggers. Framed around Companies Act 1993 sections 131-138 so it doubles as the evidence trail directors need to demonstrate reasonable care.
Board reporting pack and KRIs
Key risk indicators for each category, a quarterly dashboard template, and an escalation protocol. Written in the language directors act on, with each indicator tied back to a tolerance in the appetite statement.
Risk register and controls library
Pre-populated AI risk register with NZ-specific risks, control mappings, and assessment fields. Includes 50+ controls covering Fair Trading Act compliance checks, Privacy Act 2020 safeguards, cultural safety reviews, vendor dependency management, and algorithmic accountability measures aligned to the Algorithm Charter.
Who needs an AI risk management framework.
If your organisation is deploying AI in New Zealand and nobody has asked "what could go wrong, and who is liable?", this is where you start.
Financial services under FMA and RBNZ
Banks, insurers, and fund managers who need to demonstrate they are managing AI risks within their existing regulatory obligations before the Financial Markets Authority or Reserve Bank of New Zealand asks. We build compliance aligned to CoFI Act fair conduct requirements and operational resilience expectations.
Government and public sector
Agencies subject to the Public Service AI Framework that need to operationalise risk controls for AI systems affecting New Zealanders, with particular attention to Treaty of Waitangi obligations and algorithmic accountability under the Algorithm Charter.
Organisations serving Māori and Pacific communities
Health, education, and social service providers whose AI systems must account for cultural safety, Māori data sovereignty, and equitable outcomes for underserved populations.
Directors and board members
Directors who want documented evidence that AI risks are being managed, because under Companies Act 1993, "we did not know" is not a viable defence.
Common questions about AI risk management frameworks in NZ.
What AI risks are unique to New Zealand?
Three categories stand out. First, Treaty of Waitangi obligations create risk dimensions around Māori data sovereignty, cultural safety, and equitable outcomes. Second, New Zealand's small market means heavy reliance on offshore AI vendors, creating concentration risks. Third, the absence of AI-specific regulation means your organisation bears full responsibility for defining "reasonable" risk management.
How do Treaty of Waitangi obligations affect AI risk?
Te Tiriti principles of partnership, participation, and protection apply to how AI systems collect, process, and make decisions about Māori. Risks include training data that underrepresents or misrepresents Māori, algorithms that produce inequitable outcomes for Māori and Pacific populations, and Māori data sovereignty issues when Māori data is processed offshore without appropriate governance.
What does the FMA expect regarding AI risk management?
The Financial Markets Authority expects regulated entities to manage AI risks under their existing obligations, including conduct licensing, fair dealing, and client care duties under the CoFI Act 2022. The RBNZ holds the same expectation for operational resilience. We build risk frameworks that align to these expectations and position your organisation ahead of any future formalisation.
Can directors be personally liable for AI failures?
Yes. Under sections 131-138 of the Companies Act 1993, directors must act in good faith, in the best interests of the company, and with reasonable care, diligence, and skill. If an AI system causes significant harm and the board cannot demonstrate it took reasonable steps to understand and manage those risks, individual directors face personal liability. A documented AI risk framework is the clearest evidence of due diligence.
Is this the same as an AI risk assessment?
No. An AI risk assessment examines one system and produces a register, heat map, and treatment plan for that system. The framework is the organisation-wide structure that defines how every assessment is run: the taxonomy, the risk appetite, the method, the controls library, and what reaches the board. If you have a specific system waiting on a deployment decision, start with an AI risk assessment. If your third assessment is surfacing the same gaps as the first, you need the framework.
How does the framework relate to NIST AI RMF, ISO/IEC 23894, ISO 31000, and ISO 42001?
ISO 31000 supplies the risk process every NZ risk team already recognises. NIST AI RMF supplies the four AI-specific functions (Govern, Map, Measure, Manage) and ISO/IEC 23894 supplies the AI risk guidance that sits on top of 31000. We use those three as the structure and rebuild the content for Aotearoa. For organisations pursuing ISO 42001 certification, the framework maps to the Annex B control requirements, so one build serves local compliance and international certification.
How long does this take and what does the engagement look like?
Most engagements run 8 to 14 weeks: regulatory mapping and discovery (2 to 3 weeks), taxonomy and risk appetite (3 to 5 weeks), assessment method and controls library (2 to 3 weeks), and governance integration and board reporting (1 to 3 weeks). The timeline depends on the number of AI systems in scope and the regulatory complexity of your sector.
Further reading
NIST AI RMF explained
The four functions and 72 subcategories, and how a New Zealand framework uses them without a US obligation.
Read the guideFramework crosswalk
ISO 42001, NIST AI RMF, the Public Service AI Framework and IPP 3A mapped row by row.
Read the guideAI risk assessment template
A two-register workbook built on ISO 23894 and ISO 42005, with the scales each framework publishes.
Get the templateBuild your AI risk framework for New Zealand.
In a market with no prescribed AI risk framework, the organisations that build their own set the standard. Talk to us about developing a risk framework that reflects NZ law, Treaty of Waitangi obligations, and the reality of how your organisation actually uses AI.