Short answer
New Zealand AI governance help comes from Levy Street (Wellington), law firms such as Russell McVeagh, Bell Gully and MinterEllisonRuddWatts (Auckland and Wellington) and Simpson Grierson, consultancies such as NSP (Auckland) and Simply Privacy, and BSI for ISO/IEC 42001 certification. Choose by the question you need answered: a lawyer for legal advice, a certification body for a certificate, and an operational adviser for the policy, register and monitoring.
- New Zealand has no AI-specific act; MBIE says existing privacy, consumer and human rights law applies.
- Choosing rule: lawyers for legal advice, BSI for certification, operational advisers for day-to-day controls.
- Since 1 May 2026, IPP 3A generally requires notice when personal information is collected from someone else.
- Levy Street wrote this guide, is listed first and does not give legal advice.
- Of the ten providers listed, only BSI published a price, for ISO/IEC 42001 training.
AI governance means deciding in writing which AI you use, for what, with which information, who owns each system and how mistakes are caught. This guide lists New Zealand providers who help, and which kind of help answers which question.
New Zealand AI governance providers compared
| Provider | Based in | What it says it offers | Published proof | Prices published | Suits |
|---|---|---|---|---|---|
| Levy Street | Wellington, works nationally | AI register, use policy, risk tiers, privacy impact assessments, board reporting | Portfolio; free policy and risk register templates | No | Organisations with AI in use or being built |
| Bell Gully | Auckland, Wellington | Law firm: AI governance frameworks, board reporting, procurement | Named AI Lead partner; describes its own AI governance group | No | Legal advice and board reporting |
| BSI | NZ site of a global certification body | ISO/IEC 42001 training, pre-certification assessment and certification | Lists UKAS, RvA and ANAB accreditation for ISO/IEC 42001 | Yes, one-day course $995 (as listed) | Organisations seeking a certificate |
| Deloitte New Zealand | NZ member firm | Governance, trust and regulatory advisory for AI agents | Trustworthy AI framework; published research | No | Large organisations |
| EY New Zealand | NZ member firm | Responsible AI services: governance framework, readiness assessment, training | Named client case study | No | Large and regulated organisations |
| MinterEllisonRuddWatts | Auckland, Wellington | Law firm: governance frameworks, AI use policies, procurement, privacy | Anonymised matters; named client (Autohive) | No | Legal advice for regulated organisations |
| NSP | Auckland | AI acceptable use policy, risk register, staff training, 12-month programme | None on the service page | No | Small businesses linking AI to cyber insurance |
| Russell McVeagh | Auckland, Wellington | Law firm: governance frameworks, policies and controls | Anonymised matters | No | Boards and listed companies |
| Simply Privacy | NZ (city not stated) | Responsible AI frameworks, algorithmic impact assessments, AI audits | Named testimonials | No | Privacy-led governance, public sector |
| Simpson Grierson | Auckland, Wellington, Christchurch | Law firm: AI advice; help developing or reviewing AI use policies | Published AI governance series | No | Legal review of an AI use policy |
Legal advice, certification or day-to-day governance?
Most organisations need some of each, from different providers.
| Kind of help | Typical provider | What you get | When you need it |
|---|---|---|---|
| Legal advice | Law firms | Advice on obligations, contracts and liability; policy review | AI touching customers, staff decisions, regulated work or vendor contracts |
| Certification | Certification bodies such as BSI | ISO/IEC 42001 training, an independent audit and a certificate | Customers, tenders or regulators ask for evidence |
| Operational governance | Consultancies and AI engineers, including Levy Street | A register, a short policy, risk tiers, impact assessments and monitoring | As soon as staff use AI tools, and before any system acts on its own |
A certificate shows a management system exists, not that a given chatbot behaves. A policy says what should happen; logs and permission limits make it happen.
Provider profiles
Levy Street
Levy Street is a Wellington AI engineering and advisory company whose AI governance advisory produces an AI register, a use policy, risk tiers, privacy impact assessments for the riskiest systems, an approval workflow and board reporting, tested on two live systems before rollout. Our engineers build controls such as access limits and logging into the systems. We work alongside your lawyers and do not give legal advice or certify compliance. See the property management agent for APL Property, designed so staff keep every decision.
Bell Gully
Bell Gully is a law firm with offices in Auckland and Wellington whose AI practice advises on AI governance frameworks and board reporting, AI procurement and AI in workplace decisions. It has a partner designated as AI Lead and describes its own AI use policy and governance group.
BSI
BSI’s New Zealand site offers ISO/IEC 42001 services from the standard and training through pre-certification assessment to certification. Its one-day ISO/IEC 42001 requirements course was listed at $995 as a virtual classroom, with in-house delivery available.
Deloitte New Zealand
Deloitte New Zealand’s agentic AI services include strategy with pragmatic governance, trust, legal and regulatory advisory, and governance and trust implementation, founded on its Trustworthy AI framework. It also publishes research on AI governance.
EY New Zealand
EY New Zealand’s Responsible AI services include a GenAI governance framework, a Responsible AI Readiness Assessment and training programmes, and feature a case study on a governance framework built for Mott MacDonald.
MinterEllisonRuddWatts
MinterEllisonRuddWatts, a law firm with offices in Auckland and Wellington, has an AI advisory practice that helps boards set governance frameworks, develops and reviews AI use policies, and advises on procurement and privacy. Its published matters include governance work for an NZX-listed agribusiness.
NSP
NSP is an Auckland managed IT and cyber security provider whose AI governance and compliance service gives small businesses an AI acceptable use policy, a risk register, staff training records and a governance structure, mapped to frameworks including the NIST AI Risk Management Framework and ISO/IEC 42001. Its 12-month programme includes an evidence pack for cyber insurers.
Russell McVeagh
Russell McVeagh, a law firm with offices in Auckland and Wellington, helps organisations develop governance frameworks for AI, including policies, controls and decision-making structures. Its September 2026 board handbook, AI governance: A practical framework, is available on request.
Simply Privacy
Simply Privacy is a New Zealand privacy and AI governance consultancy whose services include Responsible AI frameworks, algorithmic impact assessments, AI health checks and independent AI audits. It says it is an approved supplier on the government Marketplace and publishes testimonials from Stats NZ and Foundation North.
Simpson Grierson
Simpson Grierson, with offices in Auckland, Wellington and Christchurch, advises on AI through its digital, new technologies and AI practice. Its AI governance series sets out what an AI use policy should cover, and its team offers help developing or reviewing one.
How to choose AI governance help
Know which question you need answered, then ask any provider, including us:
- Who owns the policy and register when the engagement ends?
- Will you test the rules against one of our real tools or systems?
- Do you cover the Privacy Act 2020, including IPP 3A, and our sector’s rules?
- Who turns rules into technical controls such as access limits, logging and approval steps?
- Is the output sized to us: a two-page policy for a 12-person firm, not a 60-page framework?
- What does a yearly review cost?
For a view on where you stand, book a short assessment conversation. Our free AI use policy template and AI risk register template are a start before you pay anyone.
Where AI governance goes wrong
- A policy nobody follows. Principles with no owner, register or incident log protect nobody. Our lesson on creating a team AI use policy keeps it short.
- Paper controls on systems that act. A rule that an agent must not send money means little unless it lacks permission to. Controls belong in the system, which is why governance links to AI security reviews.
- Certification as the goal. An audit can pass while a live tool still gives customers wrong answers.
- One-off assessments. Vendors change models and terms often; every assessment needs a review date.
The New Zealand rules governance has to cover
As at October 2026, New Zealand regulates AI through existing law. MBIE’s AI Strategy (July 2025) describes “a light-touch and principles-based approach”, and its Responsible AI Guidance for Businesses is voluntary. That guidance reminds businesses that anyone handling personal information must have a privacy officer.
- Privacy Act 2020. The Privacy Commissioner’s starting point is that the Act applies to everyone using AI tools in New Zealand. Its AI guidance expects a privacy impact assessment before AI tools are used and human review before acting on outputs.
- IPP 3A. Since 1 May 2026, an organisation that collects personal information from someone other than the person must generally take reasonable steps to tell them, as soon as reasonably practicable. That can include AI tools that enrich records about people.
- Public sector work. The Public Service AI Framework is advisory for agencies, not binding, but suppliers should expect questions shaped by it.
- Free local frameworks. AI Forum New Zealand’s AI Governance Pathways scale governance to size and risk.
Sources
- Artificial Intelligence, Bell Gully, accessed 20 October 2026
- ISO 42001 AI management system, BSI New Zealand, accessed 20 October 2026
- ISO/IEC 42001:2023 Artificial Intelligence Requirements course, BSI New Zealand, accessed 20 October 2026
- Agentic AI services, Deloitte New Zealand, accessed 20 October 2026
- AI at a crossroads: building trust as the path to scale, Deloitte New Zealand, accessed 20 October 2026
- Responsible AI services, EY New Zealand, accessed 20 October 2026
- AI advisory, MinterEllisonRuddWatts, accessed 20 October 2026
- AI governance and compliance, NSP, accessed 20 October 2026
- Artificial Intelligence / AI, Russell McVeagh, accessed 20 October 2026
- AI governance: A practical framework, Russell McVeagh, 24 September 2026
- Services, Simply Privacy, accessed 20 October 2026
- Simply Privacy home, Simply Privacy, accessed 20 October 2026
- Digital, new technologies and AI, Simpson Grierson, accessed 20 October 2026
- AI Governance Series: Part Two, start with an effective AI use policy, Simpson Grierson, accessed 20 October 2026
- Contact us (offices), Simpson Grierson, accessed 20 October 2026
- AI Governance Pathways, AI Forum New Zealand, accessed 20 October 2026
- New Zealand’s Strategy for Artificial Intelligence: Investing with confidence, MBIE, July 2025
- Responsible AI Guidance for Businesses, MBIE, July 2025
- Artificial intelligence, Office of the Privacy Commissioner, 21 September 2023
- Artificial intelligence and the Information Privacy Principles, Office of the Privacy Commissioner, September 2023
- IPP 3A, Office of the Privacy Commissioner, accessed 19 October 2026
- Privacy Act 2020, New Zealand Legislation, version as at 1 October 2026
- Public Service AI Framework, digital.govt.nz, last updated 29 January 2025
- AI Advisory Pilot Programme: explore AI for your business, business.govt.nz, last edited 20 August 2026
Written by the Levy Street team in Wellington. Last updated 19 October 2026.