Map
You cannot govern what you have not located.
Output
AI system inventory & risk classification
NIST Map · ISO 42001 Plan
AI governance services in New Zealand.
Twenty services across five practice areas, each scoped against the Privacy Act 2020, the Public Service AI Framework, FMA and RBNZ expectations, and ISO/IEC 42001. Pick the service that matches your question and the page will tell you what the engagement produces.
Practice area 01
Governance and strategy.
Operating models, policies and board oversight designed for a market without a prescriptive AI rulebook, where the Privacy Act 2020 and Te Tiriti obligations do the binding.
01
AI governance consulting
Operating model · Committees
02
AI strategy development
Roadmap · Use-case prioritisation
03
AI policy development
Policy suite · Approval workflow
04
Risk framework development
NIST AI RMF · ISO 23894
05
Board-level AI governance
Companies Act 1993 · Charters
06
Model governance
Validation · Lifecycle controls
Practice area 02
Assessment and assurance.
Evaluations of AI systems and the governance around them, written for the Office of the Privacy Commissioner, the FMA or your own audit committee.
01
AI audit and assessment
Internal audit · External review
02
AI risk assessment
Risk register · Remediation plan
03
AI impact assessment
Algorithm Charter · Community impact
04
ISO 42001 certification
Gap analysis · AIMS design
05
AI ethics implementation
Principles · Operating controls
06
Third-party AI risk
Vendor concentration · Exit planning
Practice area 03
Regulatory compliance.
The 13 information privacy principles, the Algorithm Charter, the Public Service AI Framework and Māori data governance expectations, each tied to a control and an owner.
Practice area 04
Training and advisory.
Role-based training for staff, briefings for directors on Companies Act duties, and a retainer for the questions that come up after the project ends.
Our methodology
The Evidence-First Method.
Most AI governance work produces a document that describes good intentions. Ours produces evidence that controls exist and are operating, in a form a regulator or your board can read on any given day.
Continuous assurance, not a point-in-time checkbox.
Frame
Every control is mapped to the obligation it discharges, so nothing is governance for its own sake.
Output
Governance framework, policy stack & control-to-regulation matrix
NIST Govern · ISO 42001 Plan
Control
Policy that sits in a folder is not a control. We wire it into the workflows that carry risk.
Output
Implemented controls, approval gates & a standing evidence trail
NIST Measure + Manage · ISO 42001 Do
Assure
Not an annual snapshot stale the day after sign-off, but a maintained evidence position.
Output
Assurance reports & a regulator-ready evidence pack
NIST Manage · ISO 42001 Check + Act
Start with a 30-minute scoping call if the right service is unclear.
We map your AI systems against New Zealand regulatory requirements and name the one engagement that closes the gaps. There is no obligation.